AIDA64 Extreme
 
Version  AIDA64 v8.00.8000
Benchmark Module  4.7.918.8-x64
Homepage  http://www.aida64.com/
Report Type  Report Wizard
Computer  DESKTOP-M1V6K8T
Generator  Marius
Operating System  Microsoft Windows 11 Home 10.0.26200.8037 (Win11 25H2 2025 Update)
Date  2026-07-13
Time  17:31


Summary
 
Computer:
Computer Type  ACPI x64-based PC
Operating System  Microsoft Windows 11 Home
OS Service Pack  -
Internet Explorer  11.1882.26100.0
Edge  145.0.3800.97
DirectX  DirectX 12.0
Computer Name  DESKTOP-M1V6K8T
User Name  Marius
Logon Domain  DESKTOP-M1V6K8T
Date / Time  2026-07-13 / 17:31
 
Motherboard:
CPU Type  6C+4c Intel Core Ultra 5 225T, 4400 MHz (44 x 100)
Motherboard Name  HP ProDesk 4 Mini G1i Desktop AI PC
Motherboard Chipset  Intel Arrow Point Q870, Intel Arrow Lake-S
System Memory  32188 MB (DDR5 SDRAM)
DIMM1: Nanya NT16GF64F88AX3S-Q5  16 GB DDR5-5600 DDR5 SDRAM (46-45-45-90 @ 2800 MHz) (42-42-42-84 @ 2633 MHz) (40-40-40-80 @ 2500 MHz) (36-36-36-72 @ 2267 MHz) (32-32-32-64 @ 2000 MHz) (30-30-30-60 @ 1867 MHz) (28-28-28-56 @ 1767 MHz) (26-26-26-52 @ 1633 MHz) (22-22-22-44 @ 1367 MHz)
DIMM5: Micron CT16G56C46S5.C8H  16 GB DDR5-5600 DDR5 SDRAM (46-45-45-90 @ 2800 MHz) (42-42-42-84 @ 2633 MHz) (40-40-40-80 @ 2500 MHz) (36-36-36-72 @ 2267 MHz) (32-32-32-64 @ 2000 MHz) (30-30-30-60 @ 1867 MHz) (28-28-28-56 @ 1767 MHz) (26-26-26-52 @ 1633 MHz) (22-22-22-44 @ 1367 MHz)
BIOS Type  HP (02/23/2026)
 
Display:
Video Adapter  Microsoft Basic Display Adapter
Monitor  Lenovo ThinkVision P24h-10 [23.8" IPS LCD] (291616843009) {2019}
 
Multimedia:
Audio Adapter  Realtek ALC256 @ Intel Arrow Point PCH - Audio Context Engine
 
Storage:
Storage Controller  Microsoft Storage Spaces Controller
Storage Controller  Standard NVM Express Controller
Disk Drive  KINGSTON OM8PJP4512K3-AH0 (476 GB)
SMART Hard Disks Status  OK
 
Partitions:
C: (NTFS)  476.0 GB (438.0 GB free)
Total Size  476.0 GB (438.0 GB free)
 
Input:
Keyboard  HID Keyboard Device
Keyboard  HID Keyboard Device
Mouse  HID-compliant mouse
Mouse  HID-compliant mouse
 
Network:
Primary IP Address  127.0.0.1
Primary MAC Address  B4-E2-5B-29-77-F9
Network Adapter  Intel(R) Ethernet Connection (19) I219-LM
 
Peripherals:
Printer  Microsoft Print to PDF
USB3 Controller  Intel Arrow Point PCH - USB 3.2 Gen 2x2 (20 Gb/s) xHCI Host Controller
USB3 Controller  Intel Meteor Lake-H/U / Arrow Lake - USB xHCI Host Controller
USB Device  Unknown
USB Device  USB Composite Device
USB Device  USB Input Device
USB Device  USB Input Device
USB Device  USB Input Device
USB Device  USB Input Device
 
DMI:
DMI BIOS Vendor  HP
DMI BIOS Version  X23 Ver. 02.04.10
DMI System Manufacturer  HP
DMI System Product  HP ProDesk 4 Mini G1i Desktop AI PC
DMI System Version  SBKPFV3
DMI System Serial Number  1HF6181F4F
DMI System UUID  912545C1-C1A1CF47-99606116-DA94CC05
DMI Motherboard Manufacturer  HP
DMI Motherboard Product  8D17
DMI Motherboard Version  KBC Version 14.24.04
DMI Motherboard Serial Number  PKUAF0F87MD5T3
DMI Chassis Manufacturer  HP
DMI Chassis Version  
DMI Chassis Serial Number  1HF6181F4F
DMI Chassis Asset Tag  1HF6181F4F
DMI Chassis Type  Mini PC


Computer Name
 
Type  Class  Computer Name
Computer Comment  Logical  
NetBIOS Name  Logical  DESKTOP-M1V6K8T
DNS Host Name  Logical  DESKTOP-M1V6K8T
DNS Domain Name  Logical  
Fully Qualified DNS Name  Logical  DESKTOP-M1V6K8T
NetBIOS Name  Physical  DESKTOP-M1V6K8T
DNS Host Name  Physical  DESKTOP-M1V6K8T
DNS Domain Name  Physical  
Fully Qualified DNS Name  Physical  DESKTOP-M1V6K8T


DMI
 
[ BIOS ]
 
BIOS Properties:
Vendor  HP
Version  X23 Ver. 02.04.10
Release Date  02/23/2026
Size  32 MB
System BIOS Version  4.10
Embedded Controller Firmware Version  20.36
Boot Devices  Floppy Disk, Hard Disk, CD-ROM
Capabilities  Flash BIOS, Shadow BIOS, Selectable Boot, Network Service Boot, EDD, BBS
Supported Standards  DMI, ACPI, UEFI
Expansion Capabilities  PCI, PCMCIA
Virtual Machine  No
 
[ System ]
 
System Properties:
Manufacturer  HP
Product  HP ProDesk 4 Mini G1i Desktop AI PC
Version  SBKPFV3
Serial Number  1HF6181F4F
SKU#  BY6X9ET#BCM
Family  103C_53307F HP ProDesk
Universal Unique ID  912545C1-C1A1CF47-99606116-DA94CC05
Universal Unique ID (GUID)  C1452591-A1C1-47CF-9960-6116DA94CC05
Wake-Up Type  Power Switch
 
[ Motherboard ]
 
Motherboard Properties:
Manufacturer  HP
Product  8D17
Version  KBC Version 14.24.04
Serial Number  PKUAF0F87MD5T3
 
[ Chassis ]
 
Chassis Properties:
Manufacturer  HP
Serial Number  1HF6181F4F
Asset Tag  1HF6181F4F
Chassis Type  Mini PC
Boot-Up State  Safe
Power Supply State  Safe
Thermal State  Safe
Security Status  None
 
[ Processors / Intel(R) Core(TM) Ultra 5 225T ]
 
Processor Properties:
Manufacturer  Intel(R) Corporation
Version  Intel(R) Core(TM) Ultra 5 225T
Serial Number  To Be Filled By O.E.M.
Asset Tag  To Be Filled By O.E.M.
Part Number  To Be Filled By O.E.M.
External Clock  100 MHz
Maximum Clock  4900 MHz
Current Clock  3762 MHz
Type  Central Processor
Voltage  0.8 V
Status  Enabled
Socket Designation  U3E1
SMT / CMP Units  1 / 10
Capabilities  64-bit, Multi-Core, Execute Protection, Enhanced Virtualization, Power/Performance Control
 
CPU Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/search.html?ws=text#q=Intel%20Core%20Ultra%205%20225T&sort=relevancy
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Caches / L1 Cache ]
 
Cache Properties:
Type  Unified
Status  Enabled
Operational Mode  Write-Back
Associativity  16-way Set-Associative
Maximum Size  1056 KB
Installed Size  1056 KB
Supported SRAM Type  Synchronous
Current SRAM Type  Synchronous
Error Correction  Parity
Socket Designation  L1 Cache
 
[ Caches / L2 Cache ]
 
Cache Properties:
Type  Unified
Status  Enabled
Operational Mode  Write-Back
Associativity  16-way Set-Associative
Maximum Size  22 MB
Installed Size  22 MB
Supported SRAM Type  Synchronous
Current SRAM Type  Synchronous
Error Correction  Single-bit ECC
Socket Designation  L2 Cache
 
[ Caches / L3 Cache ]
 
Cache Properties:
Type  Unified
Status  Enabled
Operational Mode  Write-Back
Maximum Size  20 MB
Installed Size  20 MB
Supported SRAM Type  Synchronous
Current SRAM Type  Synchronous
Error Correction  Multi-bit ECC
Socket Designation  L3 Cache
 
[ Memory Arrays / System Memory ]
 
Memory Array Properties:
Location  Motherboard
Memory Array Function  System Memory
Error Correction  None
Max. Memory Capacity  64 GB
Memory Devices  2
 
[ Memory Devices / DIMM1 ]
 
Memory Device Properties:
Form Factor  SODIMM
Type  DDR5
Type Detail  Synchronous
Size  16 GB
Max. Clock Speed  5600 MT/s
Current Clock Speed  5600 MT/s
Total Width  64-bit
Data Width  64-bit
Ranks  1
Current Voltage  1.100 V
Device Locator  DIMM1
Bank Locator  Controller0ChannelADimm0
Manufacturer  Nanya
Serial Number  001F4AA2
Part Number  NT16GF64F88AX3S-Q5
Memory Technology  DRAM
Memory Operating Modes  Volatile Memory
Module Manufacturer ID  0B83h
Volatile Size  16 GB
 
[ Memory Devices / DIMM3 ]
 
Memory Device Properties:
Form Factor  SODIMM
Type  DDR5
Type Detail  Synchronous
Size  16 GB
Max. Clock Speed  5600 MT/s
Current Clock Speed  5600 MT/s
Total Width  64-bit
Data Width  64-bit
Ranks  1
Current Voltage  1.100 V
Device Locator  DIMM3
Bank Locator  Controller0ChannelBDimm0
Manufacturer  Micron
Serial Number  EBD4CC20
Part Number  CT16G56C46S5.C8H
Memory Technology  DRAM
Memory Operating Modes  Volatile Memory
Module Manufacturer ID  2C80h
Volatile Size  16 GB
 
[ System Slots / Slot1 / M2 SSD ]
 
System Slot Properties:
Slot Designation  Slot1 / M2 SSD
Type  PCI-E 4.0 x4
Usage  In Use
Data Bus Width  x4
ID  1
 
[ System Slots / Slot2 / M2 SSD ]
 
System Slot Properties:
Slot Designation  Slot2 / M2 SSD
Type  PCI-E 4.0 x4
Usage  Available
Data Bus Width  x4
ID  2
 
[ System Slots / Slot3 / M2 WLAN/BT ]
 
System Slot Properties:
Slot Designation  Slot3 / M2 WLAN/BT
Type  PCI-E 3.0 x1
Usage  In Use
Data Bus Width  x1
ID  3
 
[ Port Connectors / COMA ]
 
Port Connector Properties:
Port Type  Serial Port 16550A Compatible
Internal Reference Designator  COMA
Internal Connector Type  Proprietary
External Reference Designator  COMA
External Connector Type  DB-9 pin male
 
[ Port Connectors / Option Card ]
 
Port Connector Properties:
Internal Reference Designator  Flex-IO1
Internal Connector Type  Proprietary
External Reference Designator  Option Card
External Connector Type  None
 
[ Port Connectors / Option Card ]
 
Port Connector Properties:
Internal Reference Designator  Flex-IO2
Internal Connector Type  Proprietary
External Reference Designator  Option Card
External Connector Type  None
 
[ Port Connectors / DisplayPort 1 ]
 
Port Connector Properties:
Port Type  Video Port
Internal Reference Designator  DP
Internal Connector Type  None
External Reference Designator  DisplayPort 1
 
[ Port Connectors / DisplayPort 2 ]
 
Port Connector Properties:
Port Type  Video Port
Internal Reference Designator  DP
Internal Connector Type  None
External Reference Designator  DisplayPort 2
 
[ Port Connectors / HDMI ]
 
Port Connector Properties:
Port Type  Video Port
Internal Reference Designator  HDMI
Internal Connector Type  None
External Reference Designator  HDMI
 
[ Port Connectors / LAN ]
 
Port Connector Properties:
Port Type  Network Port
Internal Reference Designator  RJ45/USB
Internal Connector Type  None
External Reference Designator  LAN
External Connector Type  RJ-45
 
[ Port Connectors / Front Headset/Headphone ]
 
Port Connector Properties:
Port Type  Audio Port
Internal Reference Designator  HDSET
Internal Connector Type  None
External Reference Designator  Front Headset/Headphone
External Connector Type  Mini-DIN
 
[ Port Connectors / Speaker ]
 
Port Connector Properties:
Port Type  Audio Port
Internal Reference Designator  SPKR
External Reference Designator  Speaker
External Connector Type  None
 
[ Port Connectors / Front TYPE C ]
 
Port Connector Properties:
Port Type  USB
Internal Reference Designator  USBC
Internal Connector Type  None
External Reference Designator  Front TYPE C
External Connector Type  USB
 
[ Port Connectors / Front USB 3.0 Port 1 ]
 
Port Connector Properties:
Port Type  USB
Internal Reference Designator  USB3
Internal Connector Type  None
External Reference Designator  Front USB 3.0 Port 1
External Connector Type  USB
 
[ Port Connectors / Front USB 3.0 Port 2 ]
 
Port Connector Properties:
Port Type  USB
Internal Reference Designator  USB3
Internal Connector Type  None
External Reference Designator  Front USB 3.0 Port 2
External Connector Type  USB
 
[ Port Connectors / Rear USB 3.0 Port 1 ]
 
Port Connector Properties:
Port Type  USB
Internal Reference Designator  USB3
Internal Connector Type  None
External Reference Designator  Rear USB 3.0 Port 1
External Connector Type  USB
 
[ Port Connectors / Rear USB 3.0 Port 2 ]
 
Port Connector Properties:
Port Type  USB
Internal Reference Designator  USB3
Internal Connector Type  None
External Reference Designator  Rear USB 3.0 Port 2
External Connector Type  USB
 
[ Port Connectors / Rear USB 3.0 Port 3 ]
 
Port Connector Properties:
Port Type  USB
Internal Reference Designator  USB3
Internal Connector Type  None
External Reference Designator  Rear USB 3.0 Port 3
External Connector Type  USB
 
[ Port Connectors / Main power ]
 
Port Connector Properties:
Internal Reference Designator  PWR
External Reference Designator  Main power
External Connector Type  None
 
[ Port Connectors / CPU fan ]
 
Port Connector Properties:
Internal Reference Designator  CPUFAN
External Reference Designator  CPU fan
External Connector Type  None
 
[ Port Connectors / HDD fan ]
 
Port Connector Properties:
Internal Reference Designator  HDDFAN
External Reference Designator  HDD fan
External Connector Type  None
 
[ Port Connectors / Power Button and Front LED ]
 
Port Connector Properties:
Internal Reference Designator  PWRLED
Internal Connector Type  None
External Reference Designator  Power Button and Front LED
 
[ Port Connectors / Hood sense ]
 
Port Connector Properties:
Internal Reference Designator  HSENSE
Internal Connector Type  Proprietary
External Reference Designator  Hood sense
External Connector Type  None
 
[ On-Board Devices / Onboard IGD ]
 
On-Board Device Properties:
Description  Onboard IGD
Type  Video
Status  Enabled
Bus / Device / Function  0 / 2 / 0
 
[ On-Board Devices / Onboard Ethernet ]
 
On-Board Device Properties:
Description  Onboard Ethernet
Type  Ethernet
Status  Enabled
Bus / Device / Function  128 / 31 / 6
 
[ On-Board Devices / 128 MB ]
 
On-Board Device Properties:
Description  128 MB
Type  Video
Status  Enabled
 
[ Power Supplies / NULL ]
 
Power Supply Properties:
Device Name  NULL
Manufacturer  NULL
Serial Number  NULL
Asset Tag  NULL
Part Number  High Efficiency
Location  NULL
Hot Replaceable  No
 
[ Cooling Device / CPU Fan ]
 
Device Properties:
Device Description  CPU Fan
Device Type  Chip Fan
Status  OK
 
[ TPM Device ]
 
TPM Device:
Vendor ID  IFX
TPM Version  2.0
Description  SLB9672
Family Configurable via Firmware Update  Supported
Family Configurable via Platform Software Support  Supported
Family Configurable via OEM Proprietary Mechanism  Not Supported
 
[ Intel AMT ]
 
Intel AMT Properties:
Intel AMT  Supported, Enabled
IDE Redirection  Enabled
SOL  Enabled
AMT Network Interface  Enabled
 
[ Intel vPro ]
 
Intel vPro Properties:
ME Firmware Version  19.0.5.2175
PCH PCI Bus / Device / Function  128 / 31 / 0
PCH PCI Device ID  8086-7F03
Wired NIC PCI Bus / Device / Function  128 / 31 / 6
Wired NIC PCI Device ID  8086-550C
AMT  Not Supported
Anti-Theft  Supported, Disabled
Anti-Theft PBA for Recovery  Not Supported
Anti-Theft WWAN  Not Supported
BIOS TXT  Supported
BIOS VT-d  Supported
BIOS VT-x  Supported
CPU VT-x  Supported, Enabled
CPU TXT  Supported, Enabled
KVM  Not Supported
Local Wakeup Timer  Not Supported
Management Engine  Enabled
Small Business Advantage  Supported
Standard Manageability  Supported
 
[ Miscellaneous ]
 
Miscellaneous:
OEM String  FBYTE#3E6J6S6b7B7J7M7Q7T7W7maBapaqasbhcAdXfPguhKjhk8mEn7nVngpDpnpqprqpr2r3rNrXsZua.q2;
OEM String  BUILDID#25WWMEDZ601#SBCM#DBCM;
OEM String  EDK2_1
OEM String  Buff=2
OEM String  MEFWRec
OEM String  HRDWFEATS=VMCSSHAD:1;VTX:1;VTD:1;SGX:0;NONHPBATDET:1;
OEM String  Feature - 100
OEM String  CarbonSupport=1


Overclock
 
CPU Properties:
CPU Type  6C+4c Intel Core Ultra 5 225T
CPU Alias  Arrow Lake-S
CPU Stepping  B0
Engineering Sample  No
CPUID CPU Name  Intel(R) Core(TM) Ultra 5 225T
CPUID Revision  000C0662h
CPU VID  0.7231 V
 
CPU Speed:
CPU Clock  2194.5 MHz
CPU Multiplier  22x
CPU FSB  99.7 MHz (original: 100 MHz)
North Bridge Clock  2094.7 MHz
Memory Bus  2792.9 MHz
DRAM:FSB Ratio  28:1
 
CPU Cache (P-core):
L0 Code Cache  64 KB per core
L0 Data Cache  48 KB per core
L1 Cache  192 KB
L2 Cache  3 MB per core (On-Die, ECC, Full-Speed)
L3 Cache  20 MB (On-Die, ECC, Full-Speed)
 
CPU Cache (E-core):
L1 Code Cache  64 KB per core
L1 Data Cache  32 KB per core
L2 Cache  4 MB (On-Die, ECC, Full-Speed)
L3 Cache  20 MB (On-Die, ECC, Full-Speed)
 
Motherboard Properties:
Motherboard ID  <DMI>
Motherboard Name  HP ProDesk 4 Mini G1i Desktop AI PC
 
Chipset Properties:
Motherboard Chipset  Intel Arrow Point Q870, Intel Arrow Lake-S
Memory Timings  46-45-45-90 (CL-RCD-RP-RAS)
Command Rate (CR)  2T
DIMM1: Nanya NT16GF64F88AX3S-Q5  16 GB DDR5-5600 DDR5 SDRAM (46-45-45-90 @ 2800 MHz) (42-42-42-84 @ 2633 MHz) (40-40-40-80 @ 2500 MHz) (36-36-36-72 @ 2267 MHz) (32-32-32-64 @ 2000 MHz) (30-30-30-60 @ 1867 MHz) (28-28-28-56 @ 1767 MHz) (26-26-26-52 @ 1633 MHz) (22-22-22-44 @ 1367 MHz)
DIMM5: Micron CT16G56C46S5.C8H  16 GB DDR5-5600 DDR5 SDRAM (46-45-45-90 @ 2800 MHz) (42-42-42-84 @ 2633 MHz) (40-40-40-80 @ 2500 MHz) (36-36-36-72 @ 2267 MHz) (32-32-32-64 @ 2000 MHz) (30-30-30-60 @ 1867 MHz) (28-28-28-56 @ 1767 MHz) (26-26-26-52 @ 1633 MHz) (22-22-22-44 @ 1367 MHz)
 
BIOS Properties:
System BIOS Date  02/23/2026
Video BIOS Date  Unknown
DMI BIOS Version  X23 Ver. 02.04.10
 
Graphics Processor Properties:
Video Adapter  Intel Arrow Lake-HX/S - Integrated Graphics Controller
GPU Code Name  Arrow Lake-HX/S (Integrated 8086 / 7D67, Rev 06)
GPU Clock  250 MHz


Power Management
 
Power Management Properties:
Current Power Source  AC Line
Battery Status  No Battery
Full Battery Lifetime  Unknown
Remaining Battery Lifetime  Unknown


Portable Computer
 
Centrino (Carmel) Platform Compliancy:
CPU: Intel Pentium M (Banias/Dothan)  No (Intel Core Ultra 5 225T)
Chipset: Intel i855GM/PM  No (Intel Arrow Point Q870, Intel Arrow Lake-S)
WLAN: Intel PRO/Wireless  No
System: Centrino Compliant  No
 
Centrino (Sonoma) Platform Compliancy:
CPU: Intel Pentium M (Dothan)  No (Intel Core Ultra 5 225T)
Chipset: Intel i915GM/PM  No (Intel Arrow Point Q870, Intel Arrow Lake-S)
WLAN: Intel PRO/Wireless 2200/2915  No
System: Centrino Compliant  No
 
Centrino (Napa) Platform Compliancy:
CPU: Intel Core (Yonah) / Core 2 (Merom)  No (Intel Core Ultra 5 225T)
Chipset: Intel i945GM/PM  No (Intel Arrow Point Q870, Intel Arrow Lake-S)
WLAN: Intel PRO/Wireless 3945/3965  No
System: Centrino Compliant  No
 
Centrino (Santa Rosa) Platform Compliancy:
CPU: Intel Core 2 (Merom/Penryn)  No (Intel Core Ultra 5 225T)
Chipset: Intel GM965/PM965  No (Intel Arrow Point Q870, Intel Arrow Lake-S)
WLAN: Intel Wireless WiFi Link 4965  No
System: Centrino Compliant  No
 
Centrino 2 (Montevina) Platform Compliancy:
CPU: Intel Core 2 (Penryn)  No (Intel Core Ultra 5 225T)
Chipset: Mobile Intel 4 Series  No (Intel Arrow Point Q870, Intel Arrow Lake-S)
WLAN: Intel WiFi Link 5000 Series  No
System: Centrino 2 Compliant  No
 
Centrino (Calpella) Platform Compliancy:
CPU: Intel Core i3/i5/i7 (Arrandale/Clarksfield)  No (Intel Core Ultra 5 225T)
Chipset: Mobile Intel 5 Series  No (Intel Arrow Point Q870, Intel Arrow Lake-S)
WLAN: Intel Centrino Advanced-N / Ultimate-N / Wireless-N  No
System: Centrino Compliant  No
 
Centrino (Huron River) Platform Compliancy:
CPU: Intel Core i3/i5/i7 (Sandy Bridge-MB)  No (Intel Core Ultra 5 225T)
Chipset: Mobile Intel 6 Series  No (Intel Arrow Point Q870, Intel Arrow Lake-S)
WLAN: Intel Centrino Advanced-N / Ultimate-N / Wireless-N  No
System: Centrino Compliant  No
 
Centrino (Chief River) Platform Compliancy:
CPU: Intel Core i3/i5/i7 (Ivy Bridge-MB)  No (Intel Core Ultra 5 225T)
Chipset: Mobile Intel 7 Series  No (Intel Arrow Point Q870, Intel Arrow Lake-S)
WLAN: Intel Centrino Advanced-N / Ultimate-N / Wireless-N  No
System: Centrino Compliant  No
 
Centrino (Shark Bay-MB) Platform Compliancy:
CPU: Intel Core i3/i5/i7 (Haswell-MB)  No (Intel Core Ultra 5 225T)
Chipset: Mobile Intel 8/9 Series  No (Intel Arrow Point Q870, Intel Arrow Lake-S)
WLAN: Intel Centrino Advanced-N / Ultimate-N / Wireless-N  No
System: Centrino Compliant  No


Sensor
 
Sensor Properties:
Sensor Type  CPU, HDD, DIMM TS, SNB
 
Temperatures:
CPU Package  60 °C
CPU IA Cores  60 °C
CPU GT Cores  54 °C
CPU #1 / Core #1  60 °C
CPU #1 / Core #2  58 °C
CPU #1 / Core #3  56 °C
CPU #1 / Core #4  56 °C
CPU #1 / Core #5  58 °C
CPU #1 / Core #6  58 °C
CPU #1 / Core #7  56 °C
CPU #1 / Core #8  58 °C
CPU #1 / Core #9  58 °C
CPU #1 / Core #10  58 °C
DIMM1  49 °C
DIMM5  45 °C
KINGSTON OM8PJP4512K3-AH0  49 °C
 
Voltage Values:
CPU Core  0.723 V
CPU VID  0.723 V
 
Power Values:
CPU Package  7.58 W
CPU IA Cores  0.96 W
CPU GT Cores  0.00 W
CPU Uncore  6.62 W


CPU
 
CPU Properties:
CPU Type  6C+4c Intel Core Ultra 5 225T, 4400 MHz (44 x 100)
CPU Alias  Arrow Lake-S
CPU Stepping  B0
Instruction Set  x86, x86-64, MMX, SSE, SSE2, SSE3, SSSE3, SSE4.1, SSE4.2, AVX, AVX2, FMA, AES, SHA, SHA512, SM3, SM4
Min / Max CPU Multiplier  8x / 25x
Engineering Sample  No
 
CPU Cache (P-core):
L0 Code Cache  64 KB per core
L0 Data Cache  48 KB per core
L1 Cache  192 KB
L2 Cache  3 MB per core (On-Die, ECC, Full-Speed)
L3 Cache  20 MB (On-Die, ECC, Full-Speed)
 
CPU Cache (E-core):
L1 Code Cache  64 KB per core
L1 Data Cache  32 KB per core
L2 Cache  4 MB (On-Die, ECC, Full-Speed)
L3 Cache  20 MB (On-Die, ECC, Full-Speed)
 
CPU Physical Info:
Package Type  1851 Contact FC-LGA
Package Size  45 mm x 37.5 mm
Process Technology  7 nm, CMOS, Cu, High-K + Metal Gate
Typical Power  35 W
 
CPU Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/search.html?ws=text#q=Intel%20Core%20Ultra%205%20225T&sort=relevancy
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
Multi CPU:
CPU #1  Intel(R) Core(TM) Ultra 5 225T, 2496 MHz
CPU #2  Intel(R) Core(TM) Ultra 5 225T, 2496 MHz
CPU #3  Intel(R) Core(TM) Ultra 5 225T, 2496 MHz
CPU #4  Intel(R) Core(TM) Ultra 5 225T, 2496 MHz
CPU #5  Intel(R) Core(TM) Ultra 5 225T, 2496 MHz
CPU #6  Intel(R) Core(TM) Ultra 5 225T, 2496 MHz
CPU #7  Intel(R) Core(TM) Ultra 5 225T, 2496 MHz
CPU #8  Intel(R) Core(TM) Ultra 5 225T, 2496 MHz
CPU #9  Intel(R) Core(TM) Ultra 5 225T, 2496 MHz
CPU #10  Intel(R) Core(TM) Ultra 5 225T, 2496 MHz
 
CPU Utilization:
CPU #1 / Core #1  0%
CPU #1 / Core #2  1%
CPU #1 / Core #3 [E-core]  0%
CPU #1 / Core #4 [E-core]  0%
CPU #1 / Core #5 [E-core]  0%
CPU #1 / Core #6 [E-core]  0%
CPU #1 / Core #7  0%
CPU #1 / Core #8  0%
CPU #1 / Core #9  1%
CPU #1 / Core #10  0%


CPUID
 
CPUID Properties:
CPUID Manufacturer  GenuineIntel
CPUID CPU Name  Intel(R) Core(TM) Ultra 5 225T
CPUID Revision  000C0662h
IA Brand ID  00h (Unknown)
Platform ID  0061h / MC 02h (LGA1851)
Microcode Update Revision  121h
SMT / CMP Units  0 / 10
Tjmax Temperature  105 °C (221 °F)
CPU Thermal Design Power (TDP)  35 W
CPU Thermal Design Current (TDC)  79 A
CPU Max Power Limit  Unlimited Power / 256.00 sec
CPU Power Limit 1 (Long Duration)  35 W / 28.00 sec (Unlocked)
CPU Power Limit 2 (Short Duration)  74 W / 2.44 ms (Unlocked)
Max Turbo Boost Multipliers (P-cores)  1C: 49x, 2C: 49x, 3C: 47x, 4C: 47x, 5C: 47x, 6C: 47x, 7C: 47x, 8C: 47x
Max Turbo Boost Multipliers (E-cores)  1c: 44x, 2c: 44x, 3c: 44x, 4c: 44x, 5c: 44x, 6c: 44x, 7c: 44x, 8c: 44x
 
Instruction Set:
64-bit x86 Extension (x86-64) (AMD64, Intel64)  Supported
AES Extensions  Supported
AMD 3DNow!  Not Supported
AMD 3DNow! Professional  Not Supported
AMD 3DNowPrefetch  Supported
AMD Enhanced 3DNow!  Not Supported
AMD Extended MMX  Not Supported
AMD FMA4  Not Supported
AMD MisAligned SSE  Not Supported
AMD SSE4A  Not Supported
AMD XOP  Not Supported
AMX-BF16  Not Supported
AMX-COMPLEX  Not Supported
AMX-FP16  Not Supported
AMX-INT8  Not Supported
AMX Tile Architecture (AMX-TILE)  Not Supported
APX (APX_F)  Not Supported
APX Flags Supression (NF)  Not Supported
APX New Conditional Instructions (NCI)  Not Supported
APX New Data Destination (NDD)  Not Supported
AVX  Supported, Enabled
AVX2  Supported, Enabled
AVX10.1  Not Supported
AVX10.2  Not Supported
AVX10-VNNI-INT  Not Supported
AVX-512 (AVX512F)  Not Supported
AVX-512 4x Fused Multiply-Add Single Precision (AVX512_4FMAPS)  Not Supported
AVX-512 4x Neural Network Instructions (AVX512_4VNNIW)  Not Supported
AVX-512 52-bit Integer Multiply-Add Instructions (AVX512_IFMA)  Not Supported
AVX-512 BF16 (AVX512_BF16)  Not Supported
AVX-512 Bit Algorithm (AVX512_BITALG)  Not Supported
AVX-512 Bit Matrix Multiply Instructions (AVX512_BMM)  Not Supported
AVX-512 Byte and Word Instructions (AVX512BW)  Not Supported
AVX-512 Conflict Detection Instructions (AVX512CD)  Not Supported
AVX-512 Doubleword and Quadword Instructions (AVX512DQ)  Not Supported
AVX-512 Exponential and Reciprocal Instructions (AVX512ER)  Not Supported
AVX-512 FP16 (AVX512_FP16)  Not Supported
AVX-512 Intersection (AVX512_VP2INTERSECT)  Not Supported
AVX-512 Neural Network Instructions (AVX512_VNNI)  Not Supported
AVX-512 Prefetch Instructions (AVX512PF)  Not Supported
AVX-512 Vector Bit Manipulation Instructions (AVX512_VBMI)  Not Supported
AVX-512 Vector Bit Manipulation Instructions 2 (AVX512_VBMI2)  Not Supported
AVX-512 Vector Length Extensions (AVX512VL)  Not Supported
AVX-512 VPOPCNTDQ  Not Supported
AVX Vector Neural Network Instructions (AVX-VNNI)  Supported, Enabled
AVX-IFMA  Supported, Enabled
AVX-NE-CONVERT  Supported, Enabled
AVX-VNNI-INT8  Supported, Enabled
BMI1  Supported
BMI2  Supported
Cyrix Extended MMX  Not Supported
Enhanced REP MOVSB/STOSB  Supported
Enqueue Stores  Not Supported
Float-16 Conversion Instructions  Supported, Enabled
FMA  Supported, Enabled
Galois Field New Instructions (GFNI)  Supported
IA-64  Not Supported
MMX  Supported
SHA Extensions  Supported
SHA512  Supported
SM2  Not Supported
SSE  Supported
SSE2  Supported
SSE3  Supported
Supplemental SSE3  Supported
SSE4.1  Supported
SSE4.2  Supported
SM3  Supported
SM4  Supported
Vector AES (VAES)  Supported, Enabled
Vector-Extension Packed Matrix Multiplication (VPMM)  Not Supported
VIA Alternate Instruction Set  Not Supported
ADCX / ADOX Instruction  Supported
CLDEMOTE Instruction  Not Supported
CLFLUSH Instruction  Supported
CLFLUSHOPT Instruction  Supported
CLWB Instruction  Supported
CLZERO Instruction  Not Supported
CMPccXADD Instruction  Supported
CMPXCHG8B Instruction  Supported
CMPXCHG16B Instruction  Supported
Conditional Move Instruction  Supported
Fast Short CMPSB & SCASB Instruction  Not Supported
Fast Short REP MOV Instruction  Supported
Fast Short REP STOSB (FSRS) Instruction  Not Supported
Fast Short REPE CMPSB (FSRC) Instruction  Not Supported
Fast Short STOSB Instruction  Supported
Fast Zero-Length MOVSB Instruction  Not Supported
HRESET Instruction  Supported
INVLPGB Instruction  Not Supported
INVPCID Instruction  Supported
LAHF / SAHF Instruction  Supported
LZCNT Instruction  Supported
MCOMMIT Instruction  Not Supported
MONITOR / MWAIT Instruction  Supported
MONITORX / MWAITX Instruction  Not Supported
MOVBE Instruction  Supported
MOVDIR64B Instruction  Supported
MOVDIRI Instruction  Supported
PCLMULQDQ Instruction  Supported
PCOMMIT Instruction  Not Supported
PCONFIG Instruction  Not Supported
POPCNT Instruction  Supported
PREFETCHIT0 / PREFETCHIT1 Instruction  Not Supported
PREFETCHWT1 Instruction  Not Supported
PTWRITE Instruction  Not Supported
RAO-INT Instruction  Not Supported
RDFSBASE / RDGSBASE / WRFSBASE / WRGSBASE Instruction  Supported
RDMSRLIST / WRMSRLIST Instruction  Not Supported
RDPRU Instruction  Not Supported
RDRAND Instruction  Supported
RDSEED Instruction  Supported
RDTSCP Instruction  Supported
SKINIT / STGI Instruction  Not Supported
SYSCALL / SYSRET Instruction  Supported
SYSENTER / SYSEXIT Instruction  Supported
Trailing Bit Manipulation Instructions  Not Supported
VIA FEMMS Instruction  Not Supported
VPCLMULQDQ Instruction  Supported
WBNOINVD Instruction  Supported
WRMSRNS Instruction  Not Supported
 
Security Features:
Advanced Cryptography Engine (ACE)  Not Supported
Advanced Cryptography Engine 2 (ACE2)  Not Supported
Control-flow Enforcement Technology - Indirect Branch Tracking (CET_IBT)  Supported
Control-flow Enforcement Technology - Shadow Stack (CET_SS)  Supported
Control-flow Enforcement Technology - Supervisor Shadow Stack (CET_SSS)  Supported
Data Execution Prevention (DEP, NX, EDB)  Supported
Enhanced Indirect Branch Restricted Speculation  Supported
Enhanced Predictive Store Forwarding (EPSF)  Not Supported
FRED Transitions  Not Supported
Hardware Random Number Generator (RNG)  Not Supported
Hardware Random Number Generator 2 (RNG2)  Not Supported
Indirect Branch Predictor Barrier (IBPB)  Supported
Indirect Branch Restricted Speculation (IBRS)  Supported
Key Locker  Not Supported
L1D Flush  Supported
Linear Address Masking (LAM)  Supported
Linear Address Space Separation (LASS)  Supported
LKGS  Not Supported
MD_CLEAR  Supported
Memory Protection Extensions (MPX)  Not Supported
PadLock Hash Engine (PHE)  Not Supported
PadLock Hash Engine 2 (PHE2)  Not Supported
PadLock Montgomery Multiplier (PMM)  Not Supported
PadLock Montgomery Multiplier 2 (PMM2)  Not Supported
Processor Serial Number (PSN)  Not Supported
Protection Keys for Supervisor-Mode Pages (PKS)  Supported, Disabled
Protection Keys for User-Mode Pages (PKU)  Supported, Disabled
Read Processor ID (RDPID)  Supported
Rogue Data Cache Load (RDCL)  Not Susceptible
Safer Mode Extensions (SMX)  Supported
Secure Memory Encryption (SME)  Not Supported
SGX Attestation Services (SGX-KEYS)  Not Supported
SGX Launch Configuration (SGX_LC)  Not Supported
Software Guard Extensions (SGX)  Not Supported
Single Thread Indirect Branch Predictors (STIBP)  Supported
Speculative Store Bypass Disable (SSBD)  Supported
SRBDS_CTRL  Not Supported
Static Lockstep Mode (SLSM)  Not Supported
Supervisor Mode Access Prevention (SMAP)  Supported
Supervisor Mode Execution Protection (SMEP)  Supported
Total Memory Encryption (TME)  Not Supported
Total Storage Encryption (TSE)  Not Supported
User-Mode Instruction Prevention (UMIP)  Supported
 
Power Management Features:
APM Power Reporting  Not Supported
Application Power Management (APM)  Not Supported
Automatic Clock Control  Supported
Configurable TDP (cTDP)  Not Supported
Connected Standby  Not Supported
Core C6 State (CC6)  Not Supported
Digital Thermometer  Supported
Dynamic FSB Frequency Switching  Not Supported
Enhanced Halt State (C1E)  Supported, Enabled
Enhanced SpeedStep Technology (EIST, ESS)  Supported, Enabled
Frequency ID Control  Not Supported
Hardware P-State Control  Not Supported
Hardware Thermal Control (HTC)  Not Supported
LongRun  Not Supported
LongRun Table Interface  Not Supported
Overstress  Not Supported
Package C6 State (PC6)  Not Supported
Parallax  Not Supported
PowerSaver 1.0  Not Supported
PowerSaver 2.0  Not Supported
PowerSaver 3.0  Not Supported
Processor Duty Cycle Control  Supported
Running Average Power Limit (RAPL)  Not Supported
Software Thermal Control  Not Supported
SpeedShift (SST, HWP)  Supported, Enabled (Autonomous Mode)
Temperature Sensing Diode  Not Supported
Thermal Monitor 1  Supported
Thermal Monitor 2  Supported
Thermal Monitor 3  Not Supported
Thermal Monitoring  Not Supported
Thermal Trip  Not Supported
Voltage ID Control  Not Supported
 
Virtualization Features:
AMD Virtual Interrupt Controller (AVIC)  Not Supported
Decode Assists  Not Supported
Encrypted Microcode Patch  Not Supported
Encrypted State (SEV-ES)  Not Supported
Extended Page Table (EPT)  Supported
Flush by ASID  Not Supported
Guest Mode Execute Trap Extension (GMET)  Not Supported
Hypervisor  Not Present
INVEPT Instruction  Supported
INVVPID Instruction  Supported
LBR Virtualization  Not Supported
Memory Bandwidth Enforcement (MBE)  Not Supported
Nested Paging (NPT, RVI)  Not Supported
NRIP Save (NRIPS)  Not Supported
PAUSE Filter Threshold  Not Supported
PAUSE Intercept Filter  Not Supported
Secure AVIC  Not Supported
Secure Encrypted Virtualization (SEV)  Not Supported
Secure Virtual Machine (SVM, Pacifica)  Not Supported
SVM Lock (SVML)  Not Supported
Virtual Transparent Encryption (VTE)  Not Supported
Virtualized GIF (vGIF)  Not Supported
Virtualized VMLOAD and VMSAVE  Not Supported
Virtualized X2APIC (X2AVIC)  Not Supported
Virtual Machine Extensions (VMX, Vanderpool)  Supported
Virtual Processor ID (VPID)  Supported
VMCB Clean Bits  Not Supported
 
CPUID Features:
1 GB Page Size  Supported
36-bit Page Size Extension  Supported
5-Level Paging  Not Supported
64-bit DS Area  Supported
64-bit SIPI  Not Supported
Adaptive Overclocking  Not Supported
Address Region Registers (ARR)  Not Supported
Asymmetrical RDT Allocation  Not Supported
Asymmetrical RDT Monitoring  Not Supported
Resource Director Technology Monitoring (RDT-M)  Not Supported
Code and Data Prioritization Technology (CDP)  Not Supported
Core Performance Boost (CPB)  Not Supported
Core Performance Counters  Not Supported
CPL Qualified Debug Store  Supported
Data Breakpoint Extension  Not Supported
Debug Trace Store  Supported
Debugging Extension  Supported
Deprecated FPU CS and FPU DS  Supported
Direct Cache Access  Not Supported
Dynamic Acceleration Technology (IDA)  Not Supported
Dynamic Configurable TDP (DcTDP)  Not Supported
Enhanced Hardware Feedback Interface (EHFI)  Supported
Extended APIC Register Space  Not Supported
Fast Save & Restore  Supported
FP512 Downgrade  Not Supported
Hardware Feedback Interface (HFI)  Supported
Hardware Lock Elision (HLE)  Not Supported
Hybrid Boost  Not Supported
Hybrid CPU  Supported
Hyper-Threading Technology (HTT)  Not Supported
Instruction Based Sampling  Not Supported
Invariant Time Stamp Counter  Supported
L1 Context ID  Not Supported
L2I Performance Counters  Not Supported
Lightweight Profiling  Not Supported
Local APIC On Chip  Supported
Machine Check Architecture (MCA)  Supported
Machine Check Exception (MCE)  Supported
Memory Configuration Registers (MCR)  Not Supported
Memory Protection Range Registers (MPRR)  Not Supported
Memory Type Range Registers (MTRR)  Supported
Model Specific Registers (MSR)  Supported
NB Performance Counters  Not Supported
Page Attribute Table (PAT)  Supported
Page Global Extension  Supported
Page Size Extension (PSE)  Supported
Pending Break Event (PBE)  Supported
Performance Time Stamp Counter (PTSC)  Not Supported
Physical Address Extension (PAE)  Supported
Process Context Identifiers (PCID)  Supported
Processor Feedback Interface  Not Supported
Processor Trace (PT)  Supported
Processor Trace Trigger Tracing (PTTT)  Not Supported
Resource Director Technology Allocation (RDT-A)  Supported
Resource Director Technology Monitoring (RDT-M)  Not Supported
Restricted Transactional Memory (RTM)  Not Supported
Self-Snoop  Supported
Time Stamp Counter (TSC)  Supported
Time Stamp Counter Adjust  Supported
TSX Suspend Load Address Tracking  Not Supported
Turbo Boost  Supported, Enabled
Turbo Boost Max 3.0  Not Supported
Upper Address Ignore (UAI)  Not Supported
Upper Address Ignore (UAI) V2  Not Supported
User Interrupts (UINTR)  Supported
Virtual Mode Extension  Supported
Watchdog Timer  Not Supported
x2APIC  Supported, Enabled
X86S  Not Supported
XGETBV / XSETBV OS Enabled  Supported
XSAVE / XRSTOR / XSETBV / XGETBV Extended States  Supported
XSAVEOPT  Supported
 
CPUID Registers (CPU #0):
CPUID 00000000  00000023-756E6547-6C65746E-49656E69 [GenuineIntel]
CPUID 00000001  000C0662-00800800-7FFAFBFF-BFEBFBFF
CPUID 00000002  00FEFF01-000000F0-00000000-00000000
CPUID 00000003  00000000-00000000-00000000-00000000
CPUID 00000004  FC004121-02C0003F-0000003F-00000000 [SL 00]
CPUID 00000004  FC004122-03C0003F-0000003F-00000000 [SL 01]
CPUID 00000004  FC01C143-02C0003F-00000FFF-00000000 [SL 02]
CPUID 00000004  FC1FC163-0240003F-00007FFF-00000004 [SL 03]
CPUID 00000005  00000040-00000040-00000003-10102020
CPUID 00000006  00DF8FF7-00000002-00000409-00000003
CPUID 00000007  00000002-239CA7EB-994007AC-FC18C430 [SL 00]
CPUID 00000007  44C009D7-00000001-00000000-00040430 [SL 01]
CPUID 00000007  00000000-00000000-00000000-000000BF [SL 02]
CPUID 00000008  00000000-00000000-00000000-00000000
CPUID 00000009  00000000-00000000-00000000-00000000
CPUID 0000000A  0D300806-00000280-00000007-00008603
CPUID 0000000B  00000001-00000001-00000100-00000000 [SL 00]
CPUID 0000000B  00000007-0000000A-00000201-00000000 [SL 01]
CPUID 0000000C  00000000-00000000-00000000-00000000
CPUID 0000000D  00000207-00000340-00000A88-00000000 [SL 00]
CPUID 0000000D  0000000F-000003D0-0001D900-00000000 [SL 01]
CPUID 0000000D  00000100-00000240-00000000-00000000 [SL 02]
CPUID 0000000D  00000080-00000000-00000001-00000000 [SL 08]
CPUID 0000000D  00000008-00000A80-00000000-00000000 [SL 09]
CPUID 0000000D  00000010-00000000-00000001-00000000 [SL 0B]
CPUID 0000000D  00000018-00000000-00000001-00000000 [SL 0C]
CPUID 0000000D  00000030-00000000-00000001-00000000 [SL 0E]
CPUID 0000000D  00000328-00000000-00000001-00000000 [SL 0F]
CPUID 0000000D  00000008-00000000-00000001-00000000 [SL 10]
CPUID 0000000E  00000000-00000000-00000000-00000000
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 00]
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000010  00000000-00000040-00000000-00000000 [SL 00]
CPUID 00000010  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000011  00000000-00000000-00000000-00000000
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000013  00000000-00000000-00000000-00000000
CPUID 00000014  00000001-0000015F-00000007-00000000 [SL 00]
CPUID 00000014  02490002-003F003F-00000000-00000000 [SL 01]
CPUID 00000015  00000002-00000082-0249F000-00000000 [65.00x / 38400000 / 2496.00]
CPUID 00000016  000009C4-00001324-00000064-00000000 [2500 / 4900 / 100]
CPUID 00000017  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000008-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000000-00080001-00000020-00004022 [SL 01]
CPUID 00000018  00000000-00080006-00000004-00004022 [SL 02]
CPUID 00000018  00000000-0010000F-00000001-00004125 [SL 03]
CPUID 00000018  00000000-00080001-00000010-00004024 [SL 04]
CPUID 00000018  00000000-00040006-00000008-00004024 [SL 05]
CPUID 00000018  00000000-00080008-00000001-00004124 [SL 06]
CPUID 00000018  00000000-00080007-00000080-00004043 [SL 07]
CPUID 00000018  00000000-00080009-00000080-00004043 [SL 08]
CPUID 00000019  00000000-00000000-00000000-00000000
CPUID 0000001A  40000003-00000000-00000000-00000000 [Core: Lion Cove]
CPUID 0000001B  00000000-00000000-00000000-00000000
CPUID 0000001C  4000000B-00000007-000F0007-00000000
CPUID 0000001D  00000000-00000000-00000000-00000000
CPUID 0000001E  00000000-00000000-00000000-00000000
CPUID 0000001F  00000001-00000001-00000100-00000000 [SL 00]
CPUID 0000001F  00000003-00000001-00000201-00000000 [SL 01]
CPUID 0000001F  00000007-0000000A-00000302-00000000 [SL 02]
CPUID 00000020  00000000-00000001-00000000-00000000
CPUID 00000021  00000000-00000000-00000000-00000000
CPUID 00000022  00000000-00000000-00000000-00000000
CPUID 00000023  0000000B-00000003-00000000-00000000
CPUID 80000000  80000008-00000000-00000000-00000000
CPUID 80000001  00000000-00000000-00000121-2C100800
CPUID 80000002  65746E49-2952286C-726F4320-4D542865 [Intel(R) Core(TM]
CPUID 80000003  6C552029-20617274-32322035-00005435 [) Ultra 5 225T]
CPUID 80000004  00000000-00000000-00000000-00000000 []
CPUID 80000005  00000000-00000000-00000000-00000000
CPUID 80000006  00000000-00000000-0C007040-00000000
CPUID 80000007  00000000-00000000-00000000-00000100
CPUID 80000008  0000302A-00000200-00000000-00000000
 
CPUID Registers (CPU #1):
CPUID 00000000  00000023-756E6547-6C65746E-49656E69 [GenuineIntel]
CPUID 00000001  000C0662-08800800-7FFAFBFF-BFEBFBFF
CPUID 00000002  00FEFF01-000000F0-00000000-00000000
CPUID 00000003  00000000-00000000-00000000-00000000
CPUID 00000004  FC004121-02C0003F-0000003F-00000000 [SL 00]
CPUID 00000004  FC004122-03C0003F-0000003F-00000000 [SL 01]
CPUID 00000004  FC01C143-02C0003F-00000FFF-00000000 [SL 02]
CPUID 00000004  FC1FC163-0240003F-00007FFF-00000004 [SL 03]
CPUID 00000005  00000040-00000040-00000003-10102020
CPUID 00000006  00DF8FF7-00000002-00000409-00010003
CPUID 00000007  00000002-239CA7EB-994007AC-FC18C430 [SL 00]
CPUID 00000007  44C009D7-00000001-00000000-00040430 [SL 01]
CPUID 00000007  00000000-00000000-00000000-000000BF [SL 02]
CPUID 00000008  00000000-00000000-00000000-00000000
CPUID 00000009  00000000-00000000-00000000-00000000
CPUID 0000000A  0D300806-00000280-00000007-00008603
CPUID 0000000B  00000001-00000001-00000100-00000008 [SL 00]
CPUID 0000000B  00000007-0000000A-00000201-00000008 [SL 01]
CPUID 0000000C  00000000-00000000-00000000-00000000
CPUID 0000000D  00000207-00000340-00000A88-00000000 [SL 00]
CPUID 0000000D  0000000F-000003D0-0001D900-00000000 [SL 01]
CPUID 0000000D  00000100-00000240-00000000-00000000 [SL 02]
CPUID 0000000D  00000080-00000000-00000001-00000000 [SL 08]
CPUID 0000000D  00000008-00000A80-00000000-00000000 [SL 09]
CPUID 0000000D  00000010-00000000-00000001-00000000 [SL 0B]
CPUID 0000000D  00000018-00000000-00000001-00000000 [SL 0C]
CPUID 0000000D  00000030-00000000-00000001-00000000 [SL 0E]
CPUID 0000000D  00000328-00000000-00000001-00000000 [SL 0F]
CPUID 0000000D  00000008-00000000-00000001-00000000 [SL 10]
CPUID 0000000E  00000000-00000000-00000000-00000000
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 00]
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000010  00000000-00000040-00000000-00000000 [SL 00]
CPUID 00000010  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000011  00000000-00000000-00000000-00000000
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000013  00000000-00000000-00000000-00000000
CPUID 00000014  00000001-0000015F-00000007-00000000 [SL 00]
CPUID 00000014  02490002-003F003F-00000000-00000000 [SL 01]
CPUID 00000015  00000002-00000082-0249F000-00000000 [65.00x / 38400000 / 2496.00]
CPUID 00000016  000009C4-00001324-00000064-00000000 [2500 / 4900 / 100]
CPUID 00000017  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000008-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000000-00080001-00000020-00004022 [SL 01]
CPUID 00000018  00000000-00080006-00000004-00004022 [SL 02]
CPUID 00000018  00000000-0010000F-00000001-00004125 [SL 03]
CPUID 00000018  00000000-00080001-00000010-00004024 [SL 04]
CPUID 00000018  00000000-00040006-00000008-00004024 [SL 05]
CPUID 00000018  00000000-00080008-00000001-00004124 [SL 06]
CPUID 00000018  00000000-00080007-00000080-00004043 [SL 07]
CPUID 00000018  00000000-00080009-00000080-00004043 [SL 08]
CPUID 00000019  00000000-00000000-00000000-00000000
CPUID 0000001A  40000003-00000000-00000000-00000000 [Core: Lion Cove]
CPUID 0000001B  00000000-00000000-00000000-00000000
CPUID 0000001C  4000000B-00000007-000F0007-00000000
CPUID 0000001D  00000000-00000000-00000000-00000000
CPUID 0000001E  00000000-00000000-00000000-00000000
CPUID 0000001F  00000001-00000001-00000100-00000008 [SL 00]
CPUID 0000001F  00000003-00000001-00000201-00000008 [SL 01]
CPUID 0000001F  00000007-0000000A-00000302-00000008 [SL 02]
CPUID 00000020  00000000-00000001-00000000-00000000
CPUID 00000021  00000000-00000000-00000000-00000000
CPUID 00000022  00000000-00000000-00000000-00000000
CPUID 00000023  0000000B-00000003-00000000-00000000
CPUID 80000000  80000008-00000000-00000000-00000000
CPUID 80000001  00000000-00000000-00000121-2C100800
CPUID 80000002  65746E49-2952286C-726F4320-4D542865 [Intel(R) Core(TM]
CPUID 80000003  6C552029-20617274-32322035-00005435 [) Ultra 5 225T]
CPUID 80000004  00000000-00000000-00000000-00000000 []
CPUID 80000005  00000000-00000000-00000000-00000000
CPUID 80000006  00000000-00000000-0C007040-00000000
CPUID 80000007  00000000-00000000-00000000-00000100
CPUID 80000008  0000302A-00000200-00000000-00000000
 
CPUID Registers (CPU #2):
CPUID 00000000  00000023-756E6547-6C65746E-49656E69 [GenuineIntel]
CPUID 00000001  000C0662-10800800-7FFAFBFF-BFEBFBFF
CPUID 00000002  00FEFF01-000000F0-00000000-00000000
CPUID 00000003  00000000-00000000-00000000-00000000
CPUID 00000004  FC000121-01C0003F-0000003F-00000000 [SL 00]
CPUID 00000004  FC000122-01C0003F-0000007F-00000000 [SL 01]
CPUID 00000004  FC01C143-03C0003F-00000FFF-00000000 [SL 02]
CPUID 00000004  FC1FC163-0240003F-00007FFF-00000004 [SL 03]
CPUID 00000005  00000040-00000040-00000003-10102020
CPUID 00000006  00DF8FF7-00000002-00000409-00060003
CPUID 00000007  00000002-239CA7EB-994007AC-FC18C430 [SL 00]
CPUID 00000007  44C009D7-00000001-00000000-00040430 [SL 01]
CPUID 00000007  00000000-00000000-00000000-000000BF [SL 02]
CPUID 00000008  00000000-00000000-00000000-00000000
CPUID 00000009  00000000-00000000-00000000-00000000
CPUID 0000000A  0D300806-00000280-00000007-00008603
CPUID 0000000B  00000001-00000001-00000100-00000010 [SL 00]
CPUID 0000000B  00000007-0000000A-00000201-00000010 [SL 01]
CPUID 0000000C  00000000-00000000-00000000-00000000
CPUID 0000000D  00000207-00000340-00000A88-00000000 [SL 00]
CPUID 0000000D  0000000F-000003D0-0001D900-00000000 [SL 01]
CPUID 0000000D  00000100-00000240-00000000-00000000 [SL 02]
CPUID 0000000D  00000080-00000000-00000001-00000000 [SL 08]
CPUID 0000000D  00000008-00000A80-00000000-00000000 [SL 09]
CPUID 0000000D  00000010-00000000-00000001-00000000 [SL 0B]
CPUID 0000000D  00000018-00000000-00000001-00000000 [SL 0C]
CPUID 0000000D  00000030-00000000-00000001-00000000 [SL 0E]
CPUID 0000000D  00000328-00000000-00000001-00000000 [SL 0F]
CPUID 0000000D  00000008-00000000-00000001-00000000 [SL 10]
CPUID 0000000E  00000000-00000000-00000000-00000000
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 00]
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000010  00000000-00000040-00000000-00000000 [SL 00]
CPUID 00000010  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000011  00000000-00000000-00000000-00000000
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000013  00000000-00000000-00000000-00000000
CPUID 00000014  00000001-0000015F-80000007-00000000 [SL 00]
CPUID 00000014  02490002-003F003F-00000000-00000000 [SL 01]
CPUID 00000015  00000002-00000082-0249F000-00000000 [65.00x / 38400000 / 2496.00]
CPUID 00000016  000009C4-00001130-00000064-00000000 [2500 / 4400 / 100]
CPUID 00000017  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000004-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000000-00300003-00000001-00000121 [SL 01]
CPUID 00000018  00000000-00040003-00000400-00000043 [SL 02]
CPUID 00000018  00000000-00800001-00000001-00000122 [SL 03]
CPUID 00000018  00000000-00080008-00000001-00000143 [SL 04]
CPUID 00000019  00000000-00000000-00000000-00000000
CPUID 0000001A  20000003-00000000-00000000-00000000 [Atom: Skymont]
CPUID 0000001B  00000000-00000000-00000000-00000000
CPUID 0000001C  C000000B-00000007-000F0007-00000000
CPUID 0000001D  00000000-00000000-00000000-00000000
CPUID 0000001E  00000000-00000000-00000000-00000000
CPUID 0000001F  00000001-00000001-00000100-00000010 [SL 00]
CPUID 0000001F  00000003-00000004-00000201-00000010 [SL 01]
CPUID 0000001F  00000007-0000000A-00000302-00000010 [SL 02]
CPUID 00000020  00000000-00000001-00000000-00000000
CPUID 00000021  00000000-00000000-00000000-00000000
CPUID 00000022  00000000-00000000-00000000-00000000
CPUID 00000023  0000000F-00000003-00000008-00000000
CPUID 80000000  80000008-00000000-00000000-00000000
CPUID 80000001  00000000-00000000-00000121-2C100800
CPUID 80000002  65746E49-2952286C-726F4320-4D542865 [Intel(R) Core(TM]
CPUID 80000003  6C552029-20617274-32322035-00005435 [) Ultra 5 225T]
CPUID 80000004  00000000-00000000-00000000-00000000 []
CPUID 80000005  00000000-00000000-00000000-00000000
CPUID 80000006  00000000-00000000-10008040-00000000
CPUID 80000007  00000000-00000000-00000000-00000100
CPUID 80000008  0000302A-00000200-00000000-00000000
 
CPUID Registers (CPU #3):
CPUID 00000000  00000023-756E6547-6C65746E-49656E69 [GenuineIntel]
CPUID 00000001  000C0662-12800800-7FFAFBFF-BFEBFBFF
CPUID 00000002  00FEFF01-000000F0-00000000-00000000
CPUID 00000003  00000000-00000000-00000000-00000000
CPUID 00000004  FC000121-01C0003F-0000003F-00000000 [SL 00]
CPUID 00000004  FC000122-01C0003F-0000007F-00000000 [SL 01]
CPUID 00000004  FC01C143-03C0003F-00000FFF-00000000 [SL 02]
CPUID 00000004  FC1FC163-0240003F-00007FFF-00000004 [SL 03]
CPUID 00000005  00000040-00000040-00000003-10102020
CPUID 00000006  00DF8FF7-00000002-00000409-00070003
CPUID 00000007  00000002-239CA7EB-994007AC-FC18C430 [SL 00]
CPUID 00000007  44C009D7-00000001-00000000-00040430 [SL 01]
CPUID 00000007  00000000-00000000-00000000-000000BF [SL 02]
CPUID 00000008  00000000-00000000-00000000-00000000
CPUID 00000009  00000000-00000000-00000000-00000000
CPUID 0000000A  0D300806-00000280-00000007-00008603
CPUID 0000000B  00000001-00000001-00000100-00000012 [SL 00]
CPUID 0000000B  00000007-0000000A-00000201-00000012 [SL 01]
CPUID 0000000C  00000000-00000000-00000000-00000000
CPUID 0000000D  00000207-00000340-00000A88-00000000 [SL 00]
CPUID 0000000D  0000000F-000003D0-0001D900-00000000 [SL 01]
CPUID 0000000D  00000100-00000240-00000000-00000000 [SL 02]
CPUID 0000000D  00000080-00000000-00000001-00000000 [SL 08]
CPUID 0000000D  00000008-00000A80-00000000-00000000 [SL 09]
CPUID 0000000D  00000010-00000000-00000001-00000000 [SL 0B]
CPUID 0000000D  00000018-00000000-00000001-00000000 [SL 0C]
CPUID 0000000D  00000030-00000000-00000001-00000000 [SL 0E]
CPUID 0000000D  00000328-00000000-00000001-00000000 [SL 0F]
CPUID 0000000D  00000008-00000000-00000001-00000000 [SL 10]
CPUID 0000000E  00000000-00000000-00000000-00000000
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 00]
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000010  00000000-00000040-00000000-00000000 [SL 00]
CPUID 00000010  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000011  00000000-00000000-00000000-00000000
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000013  00000000-00000000-00000000-00000000
CPUID 00000014  00000001-0000015F-80000007-00000000 [SL 00]
CPUID 00000014  02490002-003F003F-00000000-00000000 [SL 01]
CPUID 00000015  00000002-00000082-0249F000-00000000 [65.00x / 38400000 / 2496.00]
CPUID 00000016  000009C4-00001130-00000064-00000000 [2500 / 4400 / 100]
CPUID 00000017  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000004-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000000-00300003-00000001-00000121 [SL 01]
CPUID 00000018  00000000-00040003-00000400-00000043 [SL 02]
CPUID 00000018  00000000-00800001-00000001-00000122 [SL 03]
CPUID 00000018  00000000-00080008-00000001-00000143 [SL 04]
CPUID 00000019  00000000-00000000-00000000-00000000
CPUID 0000001A  20000003-00000000-00000000-00000000 [Atom: Skymont]
CPUID 0000001B  00000000-00000000-00000000-00000000
CPUID 0000001C  C000000B-00000007-000F0007-00000000
CPUID 0000001D  00000000-00000000-00000000-00000000
CPUID 0000001E  00000000-00000000-00000000-00000000
CPUID 0000001F  00000001-00000001-00000100-00000012 [SL 00]
CPUID 0000001F  00000003-00000004-00000201-00000012 [SL 01]
CPUID 0000001F  00000007-0000000A-00000302-00000012 [SL 02]
CPUID 00000020  00000000-00000001-00000000-00000000
CPUID 00000021  00000000-00000000-00000000-00000000
CPUID 00000022  00000000-00000000-00000000-00000000
CPUID 00000023  0000000F-00000003-00000008-00000000
CPUID 80000000  80000008-00000000-00000000-00000000
CPUID 80000001  00000000-00000000-00000121-2C100800
CPUID 80000002  65746E49-2952286C-726F4320-4D542865 [Intel(R) Core(TM]
CPUID 80000003  6C552029-20617274-32322035-00005435 [) Ultra 5 225T]
CPUID 80000004  00000000-00000000-00000000-00000000 []
CPUID 80000005  00000000-00000000-00000000-00000000
CPUID 80000006  00000000-00000000-10008040-00000000
CPUID 80000007  00000000-00000000-00000000-00000100
CPUID 80000008  0000302A-00000200-00000000-00000000
 
CPUID Registers (CPU #4):
CPUID 00000000  00000023-756E6547-6C65746E-49656E69 [GenuineIntel]
CPUID 00000001  000C0662-14800800-7FFAFBFF-BFEBFBFF
CPUID 00000002  00FEFF01-000000F0-00000000-00000000
CPUID 00000003  00000000-00000000-00000000-00000000
CPUID 00000004  FC000121-01C0003F-0000003F-00000000 [SL 00]
CPUID 00000004  FC000122-01C0003F-0000007F-00000000 [SL 01]
CPUID 00000004  FC01C143-03C0003F-00000FFF-00000000 [SL 02]
CPUID 00000004  FC1FC163-0240003F-00007FFF-00000004 [SL 03]
CPUID 00000005  00000040-00000040-00000003-10102020
CPUID 00000006  00DF8FF7-00000002-00000409-00080003
CPUID 00000007  00000002-239CA7EB-994007AC-FC18C430 [SL 00]
CPUID 00000007  44C009D7-00000001-00000000-00040430 [SL 01]
CPUID 00000007  00000000-00000000-00000000-000000BF [SL 02]
CPUID 00000008  00000000-00000000-00000000-00000000
CPUID 00000009  00000000-00000000-00000000-00000000
CPUID 0000000A  0D300806-00000280-00000007-00008603
CPUID 0000000B  00000001-00000001-00000100-00000014 [SL 00]
CPUID 0000000B  00000007-0000000A-00000201-00000014 [SL 01]
CPUID 0000000C  00000000-00000000-00000000-00000000
CPUID 0000000D  00000207-00000340-00000A88-00000000 [SL 00]
CPUID 0000000D  0000000F-000003D0-0001D900-00000000 [SL 01]
CPUID 0000000D  00000100-00000240-00000000-00000000 [SL 02]
CPUID 0000000D  00000080-00000000-00000001-00000000 [SL 08]
CPUID 0000000D  00000008-00000A80-00000000-00000000 [SL 09]
CPUID 0000000D  00000010-00000000-00000001-00000000 [SL 0B]
CPUID 0000000D  00000018-00000000-00000001-00000000 [SL 0C]
CPUID 0000000D  00000030-00000000-00000001-00000000 [SL 0E]
CPUID 0000000D  00000328-00000000-00000001-00000000 [SL 0F]
CPUID 0000000D  00000008-00000000-00000001-00000000 [SL 10]
CPUID 0000000E  00000000-00000000-00000000-00000000
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 00]
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000010  00000000-00000040-00000000-00000000 [SL 00]
CPUID 00000010  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000011  00000000-00000000-00000000-00000000
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000013  00000000-00000000-00000000-00000000
CPUID 00000014  00000001-0000015F-80000007-00000000 [SL 00]
CPUID 00000014  02490002-003F003F-00000000-00000000 [SL 01]
CPUID 00000015  00000002-00000082-0249F000-00000000 [65.00x / 38400000 / 2496.00]
CPUID 00000016  000009C4-00001130-00000064-00000000 [2500 / 4400 / 100]
CPUID 00000017  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000004-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000000-00300003-00000001-00000121 [SL 01]
CPUID 00000018  00000000-00040003-00000400-00000043 [SL 02]
CPUID 00000018  00000000-00800001-00000001-00000122 [SL 03]
CPUID 00000018  00000000-00080008-00000001-00000143 [SL 04]
CPUID 00000019  00000000-00000000-00000000-00000000
CPUID 0000001A  20000003-00000000-00000000-00000000 [Atom: Skymont]
CPUID 0000001B  00000000-00000000-00000000-00000000
CPUID 0000001C  C000000B-00000007-000F0007-00000000
CPUID 0000001D  00000000-00000000-00000000-00000000
CPUID 0000001E  00000000-00000000-00000000-00000000
CPUID 0000001F  00000001-00000001-00000100-00000014 [SL 00]
CPUID 0000001F  00000003-00000004-00000201-00000014 [SL 01]
CPUID 0000001F  00000007-0000000A-00000302-00000014 [SL 02]
CPUID 00000020  00000000-00000001-00000000-00000000
CPUID 00000021  00000000-00000000-00000000-00000000
CPUID 00000022  00000000-00000000-00000000-00000000
CPUID 00000023  0000000F-00000003-00000008-00000000
CPUID 80000000  80000008-00000000-00000000-00000000
CPUID 80000001  00000000-00000000-00000121-2C100800
CPUID 80000002  65746E49-2952286C-726F4320-4D542865 [Intel(R) Core(TM]
CPUID 80000003  6C552029-20617274-32322035-00005435 [) Ultra 5 225T]
CPUID 80000004  00000000-00000000-00000000-00000000 []
CPUID 80000005  00000000-00000000-00000000-00000000
CPUID 80000006  00000000-00000000-10008040-00000000
CPUID 80000007  00000000-00000000-00000000-00000100
CPUID 80000008  0000302A-00000200-00000000-00000000
 
CPUID Registers (CPU #5):
CPUID 00000000  00000023-756E6547-6C65746E-49656E69 [GenuineIntel]
CPUID 00000001  000C0662-16800800-7FFAFBFF-BFEBFBFF
CPUID 00000002  00FEFF01-000000F0-00000000-00000000
CPUID 00000003  00000000-00000000-00000000-00000000
CPUID 00000004  FC000121-01C0003F-0000003F-00000000 [SL 00]
CPUID 00000004  FC000122-01C0003F-0000007F-00000000 [SL 01]
CPUID 00000004  FC01C143-03C0003F-00000FFF-00000000 [SL 02]
CPUID 00000004  FC1FC163-0240003F-00007FFF-00000004 [SL 03]
CPUID 00000005  00000040-00000040-00000003-10102020
CPUID 00000006  00DF8FF7-00000002-00000409-00090003
CPUID 00000007  00000002-239CA7EB-994007AC-FC18C430 [SL 00]
CPUID 00000007  44C009D7-00000001-00000000-00040430 [SL 01]
CPUID 00000007  00000000-00000000-00000000-000000BF [SL 02]
CPUID 00000008  00000000-00000000-00000000-00000000
CPUID 00000009  00000000-00000000-00000000-00000000
CPUID 0000000A  0D300806-00000280-00000007-00008603
CPUID 0000000B  00000001-00000001-00000100-00000016 [SL 00]
CPUID 0000000B  00000007-0000000A-00000201-00000016 [SL 01]
CPUID 0000000C  00000000-00000000-00000000-00000000
CPUID 0000000D  00000207-00000340-00000A88-00000000 [SL 00]
CPUID 0000000D  0000000F-000003D0-0001D900-00000000 [SL 01]
CPUID 0000000D  00000100-00000240-00000000-00000000 [SL 02]
CPUID 0000000D  00000080-00000000-00000001-00000000 [SL 08]
CPUID 0000000D  00000008-00000A80-00000000-00000000 [SL 09]
CPUID 0000000D  00000010-00000000-00000001-00000000 [SL 0B]
CPUID 0000000D  00000018-00000000-00000001-00000000 [SL 0C]
CPUID 0000000D  00000030-00000000-00000001-00000000 [SL 0E]
CPUID 0000000D  00000328-00000000-00000001-00000000 [SL 0F]
CPUID 0000000D  00000008-00000000-00000001-00000000 [SL 10]
CPUID 0000000E  00000000-00000000-00000000-00000000
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 00]
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000010  00000000-00000040-00000000-00000000 [SL 00]
CPUID 00000010  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000011  00000000-00000000-00000000-00000000
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000013  00000000-00000000-00000000-00000000
CPUID 00000014  00000001-0000015F-80000007-00000000 [SL 00]
CPUID 00000014  02490002-003F003F-00000000-00000000 [SL 01]
CPUID 00000015  00000002-00000082-0249F000-00000000 [65.00x / 38400000 / 2496.00]
CPUID 00000016  000009C4-00001130-00000064-00000000 [2500 / 4400 / 100]
CPUID 00000017  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000004-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000000-00300003-00000001-00000121 [SL 01]
CPUID 00000018  00000000-00040003-00000400-00000043 [SL 02]
CPUID 00000018  00000000-00800001-00000001-00000122 [SL 03]
CPUID 00000018  00000000-00080008-00000001-00000143 [SL 04]
CPUID 00000019  00000000-00000000-00000000-00000000
CPUID 0000001A  20000003-00000000-00000000-00000000 [Atom: Skymont]
CPUID 0000001B  00000000-00000000-00000000-00000000
CPUID 0000001C  C000000B-00000007-000F0007-00000000
CPUID 0000001D  00000000-00000000-00000000-00000000
CPUID 0000001E  00000000-00000000-00000000-00000000
CPUID 0000001F  00000001-00000001-00000100-00000016 [SL 00]
CPUID 0000001F  00000003-00000004-00000201-00000016 [SL 01]
CPUID 0000001F  00000007-0000000A-00000302-00000016 [SL 02]
CPUID 00000020  00000000-00000001-00000000-00000000
CPUID 00000021  00000000-00000000-00000000-00000000
CPUID 00000022  00000000-00000000-00000000-00000000
CPUID 00000023  0000000F-00000003-00000008-00000000
CPUID 80000000  80000008-00000000-00000000-00000000
CPUID 80000001  00000000-00000000-00000121-2C100800
CPUID 80000002  65746E49-2952286C-726F4320-4D542865 [Intel(R) Core(TM]
CPUID 80000003  6C552029-20617274-32322035-00005435 [) Ultra 5 225T]
CPUID 80000004  00000000-00000000-00000000-00000000 []
CPUID 80000005  00000000-00000000-00000000-00000000
CPUID 80000006  00000000-00000000-10008040-00000000
CPUID 80000007  00000000-00000000-00000000-00000100
CPUID 80000008  0000302A-00000200-00000000-00000000
 
CPUID Registers (CPU #6):
CPUID 00000000  00000023-756E6547-6C65746E-49656E69 [GenuineIntel]
CPUID 00000001  000C0662-20800800-7FFAFBFF-BFEBFBFF
CPUID 00000002  00FEFF01-000000F0-00000000-00000000
CPUID 00000003  00000000-00000000-00000000-00000000
CPUID 00000004  FC004121-02C0003F-0000003F-00000000 [SL 00]
CPUID 00000004  FC004122-03C0003F-0000003F-00000000 [SL 01]
CPUID 00000004  FC01C143-02C0003F-00000FFF-00000000 [SL 02]
CPUID 00000004  FC1FC163-0240003F-00007FFF-00000004 [SL 03]
CPUID 00000005  00000040-00000040-00000003-10102020
CPUID 00000006  00DF8FF7-00000002-00000409-00020003
CPUID 00000007  00000002-239CA7EB-994007AC-FC18C430 [SL 00]
CPUID 00000007  44C009D7-00000001-00000000-00040430 [SL 01]
CPUID 00000007  00000000-00000000-00000000-000000BF [SL 02]
CPUID 00000008  00000000-00000000-00000000-00000000
CPUID 00000009  00000000-00000000-00000000-00000000
CPUID 0000000A  0D300806-00000280-00000007-00008603
CPUID 0000000B  00000001-00000001-00000100-00000020 [SL 00]
CPUID 0000000B  00000007-0000000A-00000201-00000020 [SL 01]
CPUID 0000000C  00000000-00000000-00000000-00000000
CPUID 0000000D  00000207-00000340-00000A88-00000000 [SL 00]
CPUID 0000000D  0000000F-000003D0-0001D900-00000000 [SL 01]
CPUID 0000000D  00000100-00000240-00000000-00000000 [SL 02]
CPUID 0000000D  00000080-00000000-00000001-00000000 [SL 08]
CPUID 0000000D  00000008-00000A80-00000000-00000000 [SL 09]
CPUID 0000000D  00000010-00000000-00000001-00000000 [SL 0B]
CPUID 0000000D  00000018-00000000-00000001-00000000 [SL 0C]
CPUID 0000000D  00000030-00000000-00000001-00000000 [SL 0E]
CPUID 0000000D  00000328-00000000-00000001-00000000 [SL 0F]
CPUID 0000000D  00000008-00000000-00000001-00000000 [SL 10]
CPUID 0000000E  00000000-00000000-00000000-00000000
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 00]
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000010  00000000-00000040-00000000-00000000 [SL 00]
CPUID 00000010  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000011  00000000-00000000-00000000-00000000
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000013  00000000-00000000-00000000-00000000
CPUID 00000014  00000001-0000015F-00000007-00000000 [SL 00]
CPUID 00000014  02490002-003F003F-00000000-00000000 [SL 01]
CPUID 00000015  00000002-00000082-0249F000-00000000 [65.00x / 38400000 / 2496.00]
CPUID 00000016  000009C4-00001324-00000064-00000000 [2500 / 4900 / 100]
CPUID 00000017  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000008-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000000-00080001-00000020-00004022 [SL 01]
CPUID 00000018  00000000-00080006-00000004-00004022 [SL 02]
CPUID 00000018  00000000-0010000F-00000001-00004125 [SL 03]
CPUID 00000018  00000000-00080001-00000010-00004024 [SL 04]
CPUID 00000018  00000000-00040006-00000008-00004024 [SL 05]
CPUID 00000018  00000000-00080008-00000001-00004124 [SL 06]
CPUID 00000018  00000000-00080007-00000080-00004043 [SL 07]
CPUID 00000018  00000000-00080009-00000080-00004043 [SL 08]
CPUID 00000019  00000000-00000000-00000000-00000000
CPUID 0000001A  40000003-00000000-00000000-00000000 [Core: Lion Cove]
CPUID 0000001B  00000000-00000000-00000000-00000000
CPUID 0000001C  4000000B-00000007-000F0007-00000000
CPUID 0000001D  00000000-00000000-00000000-00000000
CPUID 0000001E  00000000-00000000-00000000-00000000
CPUID 0000001F  00000001-00000001-00000100-00000020 [SL 00]
CPUID 0000001F  00000003-00000001-00000201-00000020 [SL 01]
CPUID 0000001F  00000007-0000000A-00000302-00000020 [SL 02]
CPUID 00000020  00000000-00000001-00000000-00000000
CPUID 00000021  00000000-00000000-00000000-00000000
CPUID 00000022  00000000-00000000-00000000-00000000
CPUID 00000023  0000000B-00000003-00000000-00000000
CPUID 80000000  80000008-00000000-00000000-00000000
CPUID 80000001  00000000-00000000-00000121-2C100800
CPUID 80000002  65746E49-2952286C-726F4320-4D542865 [Intel(R) Core(TM]
CPUID 80000003  6C552029-20617274-32322035-00005435 [) Ultra 5 225T]
CPUID 80000004  00000000-00000000-00000000-00000000 []
CPUID 80000005  00000000-00000000-00000000-00000000
CPUID 80000006  00000000-00000000-0C007040-00000000
CPUID 80000007  00000000-00000000-00000000-00000100
CPUID 80000008  0000302A-00000200-00000000-00000000
 
CPUID Registers (CPU #7):
CPUID 00000000  00000023-756E6547-6C65746E-49656E69 [GenuineIntel]
CPUID 00000001  000C0662-28800800-7FFAFBFF-BFEBFBFF
CPUID 00000002  00FEFF01-000000F0-00000000-00000000
CPUID 00000003  00000000-00000000-00000000-00000000
CPUID 00000004  FC004121-02C0003F-0000003F-00000000 [SL 00]
CPUID 00000004  FC004122-03C0003F-0000003F-00000000 [SL 01]
CPUID 00000004  FC01C143-02C0003F-00000FFF-00000000 [SL 02]
CPUID 00000004  FC1FC163-0240003F-00007FFF-00000004 [SL 03]
CPUID 00000005  00000040-00000040-00000003-10102020
CPUID 00000006  00DF8FF7-00000002-00000409-00030003
CPUID 00000007  00000002-239CA7EB-994007AC-FC18C430 [SL 00]
CPUID 00000007  44C009D7-00000001-00000000-00040430 [SL 01]
CPUID 00000007  00000000-00000000-00000000-000000BF [SL 02]
CPUID 00000008  00000000-00000000-00000000-00000000
CPUID 00000009  00000000-00000000-00000000-00000000
CPUID 0000000A  0D300806-00000280-00000007-00008603
CPUID 0000000B  00000001-00000001-00000100-00000028 [SL 00]
CPUID 0000000B  00000007-0000000A-00000201-00000028 [SL 01]
CPUID 0000000C  00000000-00000000-00000000-00000000
CPUID 0000000D  00000207-00000340-00000A88-00000000 [SL 00]
CPUID 0000000D  0000000F-000003D0-0001D900-00000000 [SL 01]
CPUID 0000000D  00000100-00000240-00000000-00000000 [SL 02]
CPUID 0000000D  00000080-00000000-00000001-00000000 [SL 08]
CPUID 0000000D  00000008-00000A80-00000000-00000000 [SL 09]
CPUID 0000000D  00000010-00000000-00000001-00000000 [SL 0B]
CPUID 0000000D  00000018-00000000-00000001-00000000 [SL 0C]
CPUID 0000000D  00000030-00000000-00000001-00000000 [SL 0E]
CPUID 0000000D  00000328-00000000-00000001-00000000 [SL 0F]
CPUID 0000000D  00000008-00000000-00000001-00000000 [SL 10]
CPUID 0000000E  00000000-00000000-00000000-00000000
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 00]
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000010  00000000-00000040-00000000-00000000 [SL 00]
CPUID 00000010  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000011  00000000-00000000-00000000-00000000
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000013  00000000-00000000-00000000-00000000
CPUID 00000014  00000001-0000015F-00000007-00000000 [SL 00]
CPUID 00000014  02490002-003F003F-00000000-00000000 [SL 01]
CPUID 00000015  00000002-00000082-0249F000-00000000 [65.00x / 38400000 / 2496.00]
CPUID 00000016  000009C4-00001324-00000064-00000000 [2500 / 4900 / 100]
CPUID 00000017  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000008-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000000-00080001-00000020-00004022 [SL 01]
CPUID 00000018  00000000-00080006-00000004-00004022 [SL 02]
CPUID 00000018  00000000-0010000F-00000001-00004125 [SL 03]
CPUID 00000018  00000000-00080001-00000010-00004024 [SL 04]
CPUID 00000018  00000000-00040006-00000008-00004024 [SL 05]
CPUID 00000018  00000000-00080008-00000001-00004124 [SL 06]
CPUID 00000018  00000000-00080007-00000080-00004043 [SL 07]
CPUID 00000018  00000000-00080009-00000080-00004043 [SL 08]
CPUID 00000019  00000000-00000000-00000000-00000000
CPUID 0000001A  40000003-00000000-00000000-00000000 [Core: Lion Cove]
CPUID 0000001B  00000000-00000000-00000000-00000000
CPUID 0000001C  4000000B-00000007-000F0007-00000000
CPUID 0000001D  00000000-00000000-00000000-00000000
CPUID 0000001E  00000000-00000000-00000000-00000000
CPUID 0000001F  00000001-00000001-00000100-00000028 [SL 00]
CPUID 0000001F  00000003-00000001-00000201-00000028 [SL 01]
CPUID 0000001F  00000007-0000000A-00000302-00000028 [SL 02]
CPUID 00000020  00000000-00000001-00000000-00000000
CPUID 00000021  00000000-00000000-00000000-00000000
CPUID 00000022  00000000-00000000-00000000-00000000
CPUID 00000023  0000000B-00000003-00000000-00000000
CPUID 80000000  80000008-00000000-00000000-00000000
CPUID 80000001  00000000-00000000-00000121-2C100800
CPUID 80000002  65746E49-2952286C-726F4320-4D542865 [Intel(R) Core(TM]
CPUID 80000003  6C552029-20617274-32322035-00005435 [) Ultra 5 225T]
CPUID 80000004  00000000-00000000-00000000-00000000 []
CPUID 80000005  00000000-00000000-00000000-00000000
CPUID 80000006  00000000-00000000-0C007040-00000000
CPUID 80000007  00000000-00000000-00000000-00000100
CPUID 80000008  0000302A-00000200-00000000-00000000
 
CPUID Registers (CPU #8):
CPUID 00000000  00000023-756E6547-6C65746E-49656E69 [GenuineIntel]
CPUID 00000001  000C0662-30800800-7FFAFBFF-BFEBFBFF
CPUID 00000002  00FEFF01-000000F0-00000000-00000000
CPUID 00000003  00000000-00000000-00000000-00000000
CPUID 00000004  FC004121-02C0003F-0000003F-00000000 [SL 00]
CPUID 00000004  FC004122-03C0003F-0000003F-00000000 [SL 01]
CPUID 00000004  FC01C143-02C0003F-00000FFF-00000000 [SL 02]
CPUID 00000004  FC1FC163-0240003F-00007FFF-00000004 [SL 03]
CPUID 00000005  00000040-00000040-00000003-10102020
CPUID 00000006  00DF8FF7-00000002-00000409-00040003
CPUID 00000007  00000002-239CA7EB-994007AC-FC18C430 [SL 00]
CPUID 00000007  44C009D7-00000001-00000000-00040430 [SL 01]
CPUID 00000007  00000000-00000000-00000000-000000BF [SL 02]
CPUID 00000008  00000000-00000000-00000000-00000000
CPUID 00000009  00000000-00000000-00000000-00000000
CPUID 0000000A  0D300806-00000280-00000007-00008603
CPUID 0000000B  00000001-00000001-00000100-00000030 [SL 00]
CPUID 0000000B  00000007-0000000A-00000201-00000030 [SL 01]
CPUID 0000000C  00000000-00000000-00000000-00000000
CPUID 0000000D  00000207-00000340-00000A88-00000000 [SL 00]
CPUID 0000000D  0000000F-000003D0-0001D900-00000000 [SL 01]
CPUID 0000000D  00000100-00000240-00000000-00000000 [SL 02]
CPUID 0000000D  00000080-00000000-00000001-00000000 [SL 08]
CPUID 0000000D  00000008-00000A80-00000000-00000000 [SL 09]
CPUID 0000000D  00000010-00000000-00000001-00000000 [SL 0B]
CPUID 0000000D  00000018-00000000-00000001-00000000 [SL 0C]
CPUID 0000000D  00000030-00000000-00000001-00000000 [SL 0E]
CPUID 0000000D  00000328-00000000-00000001-00000000 [SL 0F]
CPUID 0000000D  00000008-00000000-00000001-00000000 [SL 10]
CPUID 0000000E  00000000-00000000-00000000-00000000
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 00]
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000010  00000000-00000040-00000000-00000000 [SL 00]
CPUID 00000010  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000011  00000000-00000000-00000000-00000000
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000013  00000000-00000000-00000000-00000000
CPUID 00000014  00000001-0000015F-00000007-00000000 [SL 00]
CPUID 00000014  02490002-003F003F-00000000-00000000 [SL 01]
CPUID 00000015  00000002-00000082-0249F000-00000000 [65.00x / 38400000 / 2496.00]
CPUID 00000016  000009C4-00001324-00000064-00000000 [2500 / 4900 / 100]
CPUID 00000017  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000008-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000000-00080001-00000020-00004022 [SL 01]
CPUID 00000018  00000000-00080006-00000004-00004022 [SL 02]
CPUID 00000018  00000000-0010000F-00000001-00004125 [SL 03]
CPUID 00000018  00000000-00080001-00000010-00004024 [SL 04]
CPUID 00000018  00000000-00040006-00000008-00004024 [SL 05]
CPUID 00000018  00000000-00080008-00000001-00004124 [SL 06]
CPUID 00000018  00000000-00080007-00000080-00004043 [SL 07]
CPUID 00000018  00000000-00080009-00000080-00004043 [SL 08]
CPUID 00000019  00000000-00000000-00000000-00000000
CPUID 0000001A  40000003-00000000-00000000-00000000 [Core: Lion Cove]
CPUID 0000001B  00000000-00000000-00000000-00000000
CPUID 0000001C  4000000B-00000007-000F0007-00000000
CPUID 0000001D  00000000-00000000-00000000-00000000
CPUID 0000001E  00000000-00000000-00000000-00000000
CPUID 0000001F  00000001-00000001-00000100-00000030 [SL 00]
CPUID 0000001F  00000003-00000001-00000201-00000030 [SL 01]
CPUID 0000001F  00000007-0000000A-00000302-00000030 [SL 02]
CPUID 00000020  00000000-00000001-00000000-00000000
CPUID 00000021  00000000-00000000-00000000-00000000
CPUID 00000022  00000000-00000000-00000000-00000000
CPUID 00000023  0000000B-00000003-00000000-00000000
CPUID 80000000  80000008-00000000-00000000-00000000
CPUID 80000001  00000000-00000000-00000121-2C100800
CPUID 80000002  65746E49-2952286C-726F4320-4D542865 [Intel(R) Core(TM]
CPUID 80000003  6C552029-20617274-32322035-00005435 [) Ultra 5 225T]
CPUID 80000004  00000000-00000000-00000000-00000000 []
CPUID 80000005  00000000-00000000-00000000-00000000
CPUID 80000006  00000000-00000000-0C007040-00000000
CPUID 80000007  00000000-00000000-00000000-00000100
CPUID 80000008  0000302A-00000200-00000000-00000000
 
CPUID Registers (CPU #9):
CPUID 00000000  00000023-756E6547-6C65746E-49656E69 [GenuineIntel]
CPUID 00000001  000C0662-38800800-7FFAFBFF-BFEBFBFF
CPUID 00000002  00FEFF01-000000F0-00000000-00000000
CPUID 00000003  00000000-00000000-00000000-00000000
CPUID 00000004  FC004121-02C0003F-0000003F-00000000 [SL 00]
CPUID 00000004  FC004122-03C0003F-0000003F-00000000 [SL 01]
CPUID 00000004  FC01C143-02C0003F-00000FFF-00000000 [SL 02]
CPUID 00000004  FC1FC163-0240003F-00007FFF-00000004 [SL 03]
CPUID 00000005  00000040-00000040-00000003-10102020
CPUID 00000006  00DF8FF7-00000002-00000409-00050003
CPUID 00000007  00000002-239CA7EB-994007AC-FC18C430 [SL 00]
CPUID 00000007  44C009D7-00000001-00000000-00040430 [SL 01]
CPUID 00000007  00000000-00000000-00000000-000000BF [SL 02]
CPUID 00000008  00000000-00000000-00000000-00000000
CPUID 00000009  00000000-00000000-00000000-00000000
CPUID 0000000A  0D300806-00000280-00000007-00008603
CPUID 0000000B  00000001-00000001-00000100-00000038 [SL 00]
CPUID 0000000B  00000007-0000000A-00000201-00000038 [SL 01]
CPUID 0000000C  00000000-00000000-00000000-00000000
CPUID 0000000D  00000207-00000340-00000A88-00000000 [SL 00]
CPUID 0000000D  0000000F-000003D0-0001D900-00000000 [SL 01]
CPUID 0000000D  00000100-00000240-00000000-00000000 [SL 02]
CPUID 0000000D  00000080-00000000-00000001-00000000 [SL 08]
CPUID 0000000D  00000008-00000A80-00000000-00000000 [SL 09]
CPUID 0000000D  00000010-00000000-00000001-00000000 [SL 0B]
CPUID 0000000D  00000018-00000000-00000001-00000000 [SL 0C]
CPUID 0000000D  00000030-00000000-00000001-00000000 [SL 0E]
CPUID 0000000D  00000328-00000000-00000001-00000000 [SL 0F]
CPUID 0000000D  00000008-00000000-00000001-00000000 [SL 10]
CPUID 0000000E  00000000-00000000-00000000-00000000
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 00]
CPUID 0000000F  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000010  00000000-00000040-00000000-00000000 [SL 00]
CPUID 00000010  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000011  00000000-00000000-00000000-00000000
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000012  00000000-00000000-00000000-00000000 [SL 01]
CPUID 00000013  00000000-00000000-00000000-00000000
CPUID 00000014  00000001-0000015F-00000007-00000000 [SL 00]
CPUID 00000014  02490002-003F003F-00000000-00000000 [SL 01]
CPUID 00000015  00000002-00000082-0249F000-00000000 [65.00x / 38400000 / 2496.00]
CPUID 00000016  000009C4-00001324-00000064-00000000 [2500 / 4900 / 100]
CPUID 00000017  00000000-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000008-00000000-00000000-00000000 [SL 00]
CPUID 00000018  00000000-00080001-00000020-00004022 [SL 01]
CPUID 00000018  00000000-00080006-00000004-00004022 [SL 02]
CPUID 00000018  00000000-0010000F-00000001-00004125 [SL 03]
CPUID 00000018  00000000-00080001-00000010-00004024 [SL 04]
CPUID 00000018  00000000-00040006-00000008-00004024 [SL 05]
CPUID 00000018  00000000-00080008-00000001-00004124 [SL 06]
CPUID 00000018  00000000-00080007-00000080-00004043 [SL 07]
CPUID 00000018  00000000-00080009-00000080-00004043 [SL 08]
CPUID 00000019  00000000-00000000-00000000-00000000
CPUID 0000001A  40000003-00000000-00000000-00000000 [Core: Lion Cove]
CPUID 0000001B  00000000-00000000-00000000-00000000
CPUID 0000001C  4000000B-00000007-000F0007-00000000
CPUID 0000001D  00000000-00000000-00000000-00000000
CPUID 0000001E  00000000-00000000-00000000-00000000
CPUID 0000001F  00000001-00000001-00000100-00000038 [SL 00]
CPUID 0000001F  00000003-00000001-00000201-00000038 [SL 01]
CPUID 0000001F  00000007-0000000A-00000302-00000038 [SL 02]
CPUID 00000020  00000000-00000001-00000000-00000000
CPUID 00000021  00000000-00000000-00000000-00000000
CPUID 00000022  00000000-00000000-00000000-00000000
CPUID 00000023  0000000B-00000003-00000000-00000000
CPUID 80000000  80000008-00000000-00000000-00000000
CPUID 80000001  00000000-00000000-00000121-2C100800
CPUID 80000002  65746E49-2952286C-726F4320-4D542865 [Intel(R) Core(TM]
CPUID 80000003  6C552029-20617274-32322035-00005435 [) Ultra 5 225T]
CPUID 80000004  00000000-00000000-00000000-00000000 []
CPUID 80000005  00000000-00000000-00000000-00000000
CPUID 80000006  00000000-00000000-0C007040-00000000
CPUID 80000007  00000000-00000000-00000000-00000100
CPUID 80000008  0000302A-00000200-00000000-00000000
 
MSR Registers (CPU #0):
MSR 00000017  0004-0000-0000-0000 [PlatID = 1]
MSR 0000001B  0000-0000-FEE0-0D00
MSR 00000035  0000-0000-000A-000A
MSR 00000048  0000-0000-0000-0001
MSR 00000049  < FAILED >
MSR 0000008B  0000-0121-0000-0000
MSR 000000CE  0804-0838-F081-1900 [eD = 0]
MSR 000000E7  0000-000E-B100-2DFE [S200]
MSR 000000E7  0000-000E-B1E8-C23A [S200]
MSR 000000E7  0000-000E-B2E7-6650
MSR 000000E8  0000-0015-AA6D-BADC [S200]
MSR 000000E8  0000-0015-AAD7-1314 [S200]
MSR 000000E8  0000-0015-AAF6-6D36
MSR 0000010A  0000-0000-0DF9-FD6B
MSR 0000010B  < FAILED >
MSR 00000194  0000-0000-0010-0000
MSR 00000198  0000-1724-0000-1500 [S200]
MSR 00000198  0000-1724-0000-1200 [S200]
MSR 00000198  0000-1724-0000-1600
MSR 00000199  0000-0000-0000-3100
MSR 0000019A  0000-0000-0000-0000
MSR 0000019B  0000-0000-0000-0010
MSR 0000019C  0000-0000-882F-2800 [S200]
MSR 0000019C  0000-0000-882F-2800 [S200]
MSR 0000019C  0000-0000-882F-2800
MSR 0000019D  0000-0000-0000-0000
MSR 000001A0  0000-0000-0085-0089
MSR 000001A2  0000-0000-8069-1600
MSR 000001A4  0000-0000-0000-0000
MSR 000001AA  0000-0000-0000-30C2
MSR 000001AC  < FAILED >
MSR 000001AD  2F2F-2F2F-2F2F-3131
MSR 000001AE  0807-0605-0403-0201
MSR 000001AF  < FAILED >
MSR 000001B0  0000-0000-0000-0006
MSR 000001B1  0000-0000-882D-0800
MSR 000001B2  0000-0000-0200-0000
MSR 000001FC  0000-0000-00CC-005F
MSR 00000300  < FAILED >
MSR 0000030A  0000-0000-0000-0000 [S200]
MSR 0000030A  0000-0000-0000-0000 [S200]
MSR 0000030A  0000-0000-0000-0000
MSR 0000030B  0000-0000-0000-0000 [S200]
MSR 0000030B  0000-0000-0000-0000 [S200]
MSR 0000030B  0000-0000-0000-0000
MSR 00000480  03DA-0600-0000-0015
MSR 00000481  0000-00FF-0000-0016
MSR 00000482  FFFB-FFFE-0401-E172
MSR 00000483  FF7F-FFFF-0003-6DFF
MSR 00000484  007E-FFFF-0000-11FF
MSR 00000485  0000-0000-7004-C1E7
MSR 00000486  0000-0000-8000-0021
MSR 00000487  0000-0000-FFFF-FFFF
MSR 00000488  0000-0000-0000-2000
MSR 00000489  0000-0000-1BF7-6FFF
MSR 0000048A  0000-0000-0000-002E
MSR 0000048B  C75F-7FFF-0000-0000
MSR 0000048C  0000-0F01-06F3-4141
MSR 0000048D  0000-00FF-0000-0016
MSR 0000048E  FFFB-FFFE-0400-6172
MSR 0000048F  FF7F-FFFF-0003-6DFB
MSR 00000490  007E-FFFF-0000-11FB
MSR 00000601  0000-0000-0000-0278
MSR 00000602  < FAILED >
MSR 00000603  0036-0000-0036-3636
MSR 00000604  < FAILED >
MSR 00000606  0000-0000-000A-0E03
MSR 0000060A  0000-0000-0000-0000
MSR 0000060B  0000-0000-0000-0000
MSR 0000060C  0000-0000-0000-0000
MSR 0000060D  0000-0027-7E61-3843
MSR 00000610  0042-8250-00DD-8118
MSR 00000611  0000-0000-01CE-36B7 [S200]
MSR 00000611  0000-0000-01CE-9923 [S200]
MSR 00000611  0000-0000-01CE-FDC3
MSR 00000613  0000-0000-0000-0055
MSR 00000614  0012-0000-0000-0118
MSR 00000618  0000-0000-0000-0000
MSR 00000619  0000-0000-0000-0000 [S200]
MSR 00000619  0000-0000-0000-0000 [S200]
MSR 00000619  0000-0000-0000-0000
MSR 0000061B  0000-0000-0000-0000
MSR 0000061C  < FAILED >
MSR 0000061E  < FAILED >
MSR 00000620  0000-0000-0000-0825
MSR 00000621  0000-0000-1BB5-0012
MSR 00000638  0000-0000-0000-0000
MSR 00000639  0000-0000-00CB-4A0D [S200]
MSR 00000639  0000-0000-00CB-554A [S200]
MSR 00000639  0000-0000-00CB-5FD5
MSR 0000063A  0000-0000-0000-0000
MSR 0000063B  < FAILED >
MSR 00000640  0000-0000-0000-0000
MSR 00000641  0000-0000-0000-0018 [S200]
MSR 00000641  0000-0000-0000-0018 [S200]
MSR 00000641  0000-0000-0000-0018
MSR 00000642  0000-0000-0000-0010
MSR 00000648  0000-0000-0000-0019
MSR 00000649  0000-0000-0000-0000
MSR 0000064A  0000-0000-0000-0000
MSR 0000064B  0000-0000-8000-0000
MSR 0000064C  0000-0000-0000-0000
MSR 00000650  2C2C-2C2C-2C2C-2C2C
MSR 00000651  0807-0605-0403-0201
MSR 00000690  < FAILED >
MSR 000006B0  0000-0000-0100-0000
MSR 000006B1  0000-0000-0100-0000
MSR 00000770  0000-0000-0000-0001
MSR 00000771  0000-0000-0122-284F
MSR 00000772  0000-0000-8000-FF01
MSR 00000773  0000-0000-0000-0005
MSR 00000774  0000-019E-3F00-4F02
MSR 00000777  0000-0000-0000-0000
MSR 00000832  0000-0000-0002-00D1
MSR 00000838  0000-0000-0000-0209
MSR 00000839  0000-0000-0000-01C7
MSR 0000083E  0000-0000-0000-000A
 
MSR Registers (CPU #1):
MSR 00000017  0004-0000-0000-0000 [PlatID = 1]
MSR 0000001B  0000-0000-FEE0-0C00
MSR 00000035  0000-0000-000A-000A
MSR 00000048  0000-0000-0000-0001
MSR 00000049  < FAILED >
MSR 0000008B  0000-0121-0000-0000
MSR 000000CE  0804-0838-F081-1900 [eD = 0]
MSR 000000E7  0000-000A-FD69-1BAF
MSR 000000E8  0000-0010-F61C-D005
MSR 0000010A  0000-0000-0DF9-FD6B
MSR 0000010B  < FAILED >
MSR 00000194  0000-0000-0010-0000
MSR 00000198  0000-1762-0000-1500
MSR 00000199  0000-0000-0000-3100
MSR 0000019A  0000-0000-0000-0000
MSR 0000019B  0000-0000-0000-0010
MSR 0000019C  0000-0000-882F-3800
MSR 0000019D  0000-0000-0000-0000
MSR 000001A0  0000-0000-0085-0089
MSR 000001A2  0000-0000-8069-1600
MSR 000001A4  0000-0000-0000-0000
MSR 000001AA  0000-0000-0000-30C2
MSR 000001AC  < FAILED >
MSR 000001AD  2F2F-2F2F-2F2F-3131
MSR 000001AE  0807-0605-0403-0201
MSR 000001AF  < FAILED >
MSR 000001B0  0000-0000-0000-0006
MSR 000001B1  0000-0000-882D-0800
MSR 000001B2  0000-0000-0200-0000
MSR 000001FC  0000-0000-00CC-005F
MSR 00000300  < FAILED >
MSR 0000030A  0000-0000-0000-0000
MSR 0000030B  0000-0000-0000-0000
MSR 00000480  03DA-0600-0000-0015
MSR 00000481  0000-00FF-0000-0016
MSR 00000482  FFFB-FFFE-0401-E172
MSR 00000483  FF7F-FFFF-0003-6DFF
MSR 00000484  007E-FFFF-0000-11FF
MSR 00000485  0000-0000-7004-C1E7
MSR 00000486  0000-0000-8000-0021
MSR 00000487  0000-0000-FFFF-FFFF
MSR 00000488  0000-0000-0000-2000
MSR 00000489  0000-0000-1BF7-6FFF
MSR 0000048A  0000-0000-0000-002E
MSR 0000048B  C75F-7FFF-0000-0000
MSR 0000048C  0000-0F01-06F3-4141
MSR 0000048D  0000-00FF-0000-0016
MSR 0000048E  FFFB-FFFE-0400-6172
MSR 0000048F  FF7F-FFFF-0003-6DFB
MSR 00000490  007E-FFFF-0000-11FB
MSR 00000601  0000-0000-0000-0278
MSR 00000602  < FAILED >
MSR 00000603  0036-0000-0036-3636
MSR 00000604  < FAILED >
MSR 00000606  0000-0000-000A-0E03
MSR 0000060A  0000-0000-0000-0000
MSR 0000060B  0000-0000-0000-0000
MSR 0000060C  0000-0000-0000-0000
MSR 0000060D  0000-0028-4BA1-6026
MSR 00000610  0042-8250-00DD-8118
MSR 00000611  0000-0000-01D1-3F5F
MSR 00000613  0000-0000-0000-0055
MSR 00000614  0012-0000-0000-0118
MSR 00000618  0000-0000-0000-0000
MSR 00000619  0000-0000-0000-0000
MSR 0000061B  0000-0000-0000-0000
MSR 0000061C  < FAILED >
MSR 0000061E  < FAILED >
MSR 00000620  0000-0000-0000-0825
MSR 00000621  0000-0000-1BB5-0011
MSR 00000638  0000-0000-0000-0000
MSR 00000639  0000-0000-00CB-73AD
MSR 0000063A  0000-0000-0000-0000
MSR 0000063B  < FAILED >
MSR 00000640  0000-0000-0000-0000
MSR 00000641  0000-0000-0000-0018
MSR 00000642  0000-0000-0000-0010
MSR 00000648  0000-0000-0000-0019
MSR 00000649  0000-0000-0000-0000
MSR 0000064A  0000-0000-0000-0000
MSR 0000064B  0000-0000-8000-0000
MSR 0000064C  0000-0000-0000-0000
MSR 00000650  2C2C-2C2C-2C2C-2C2C
MSR 00000651  0807-0605-0403-0201
MSR 00000690  < FAILED >
MSR 000006B0  0000-0000-0100-0000
MSR 000006B1  0000-0000-0100-0000
MSR 00000770  0000-0000-0000-0001
MSR 00000771  0000-0000-0122-284F
MSR 00000772  0000-0000-8000-FF01
MSR 00000773  0000-0000-0000-0005
MSR 00000774  0000-019E-3F00-4F02
MSR 00000777  0000-0000-0000-0000
MSR 00000832  0000-0000-0002-00D1
MSR 00000838  0000-0000-0000-0209
MSR 00000839  0000-0000-0000-0157
MSR 0000083E  0000-0000-0000-000A
 
MSR Registers (CPU #2):
MSR 00000017  0004-0000-0000-0000 [PlatID = 1]
MSR 0000001B  0000-0000-FEE0-0C00
MSR 0000002A  0000-0000-0000-0000
MSR 00000035  0000-0000-000A-000A
MSR 00000048  0000-0000-0000-0001
MSR 00000049  < FAILED >
MSR 0000008B  0000-0121-0000-0000
MSR 000000CD  < FAILED >
MSR 000000CE  0804-0838-F081-1900 [eD = 0]
MSR 000000E7  0000-0003-0591-2F50
MSR 000000E8  0000-0003-BC39-95EA
MSR 000000EE  < FAILED >
MSR 0000010A  0000-0000-0DF9-FD6B
MSR 0000010B  < FAILED >
MSR 0000011E  < FAILED >
MSR 00000194  0000-0000-0010-0000
MSR 00000198  0000-17C3-0000-1300
MSR 00000199  0000-0000-0000-3100
MSR 0000019A  0000-0000-0000-0000
MSR 0000019B  0000-0000-0000-0010
MSR 0000019C  0000-0000-8831-2800
MSR 0000019D  0000-0000-0000-0000
MSR 000001A0  0000-0000-0085-0089
MSR 000001A2  0000-0000-8069-1600
MSR 000001A4  0000-0000-0000-0084
MSR 000001AA  0000-0000-0000-30C2
MSR 000001AC  < FAILED >
MSR 000001AD  2F2F-2F2F-2F2F-3131
MSR 000001AE  0807-0605-0403-0201
MSR 000001AF  < FAILED >
MSR 000001B0  0000-0000-0000-0006
MSR 000001B1  0000-0000-882F-0800
MSR 000001B2  0000-0000-0200-0000
MSR 000001FC  0000-0000-00CC-005F
MSR 00000300  < FAILED >
MSR 0000030A  0000-0000-0000-0000
MSR 0000030B  0000-0000-0000-0000
MSR 00000480  03DA-0600-0000-0015
MSR 00000481  0000-00FF-0000-0016
MSR 00000482  FFFB-FFFE-0401-E172
MSR 00000483  FF7F-FFFF-0003-6DFF
MSR 00000484  007E-FFFF-0000-11FF
MSR 00000485  0000-0000-7004-C1E7
MSR 00000486  0000-0000-8000-0021
MSR 00000487  0000-0000-FFFF-FFFF
MSR 00000488  0000-0000-0000-2000
MSR 00000489  0000-0000-1BF7-6FFF
MSR 0000048A  0000-0000-0000-002E
MSR 0000048B  C75F-7FFF-0000-0000
MSR 0000048C  0000-0F01-06F3-4141
MSR 0000048D  0000-00FF-0000-0016
MSR 0000048E  FFFB-FFFE-0400-6172
MSR 0000048F  FF7F-FFFF-0003-6DFB
MSR 00000490  007E-FFFF-0000-11FB
MSR 00000601  0000-0000-0000-0278
MSR 00000602  < FAILED >
MSR 00000603  0036-0000-0036-3636
MSR 00000604  < FAILED >
MSR 00000606  0000-0000-000A-0E03
MSR 0000060A  0000-0000-0000-0000
MSR 0000060B  0000-0000-0000-0000
MSR 0000060C  0000-0000-0000-0000
MSR 0000060D  0000-0028-4BA1-6026
MSR 00000610  0042-8250-00DD-8118
MSR 00000611  0000-0000-01D1-401E
MSR 00000613  0000-0000-0000-0055
MSR 00000614  0012-0000-0000-0118
MSR 00000618  0000-0000-0000-0000
MSR 00000619  0000-0000-0000-0000
MSR 0000061B  0000-0000-0000-0000
MSR 0000061C  < FAILED >
MSR 0000061E  < FAILED >
MSR 00000620  0000-0000-0000-0825
MSR 00000621  0000-0000-1BB5-0012
MSR 00000638  0000-0000-0000-0000
MSR 00000639  0000-0000-00CB-73EE
MSR 0000063A  0000-0000-0000-0000
MSR 0000063B  < FAILED >
MSR 00000640  0000-0000-0000-0000
MSR 00000641  0000-0000-0000-0018
MSR 00000642  0000-0000-0000-0010
MSR 00000648  0000-0000-0000-0019
MSR 00000649  0000-0000-0000-0000
MSR 0000064A  0000-0000-0000-0000
MSR 0000064B  0000-0000-8000-0000
MSR 0000064C  0000-0000-0000-0000
MSR 00000650  2C2C-2C2C-2C2C-2C2C
MSR 00000651  0807-0605-0403-0201
MSR 00000660  0000-000A-9E7C-EE14
MSR 00000661  < FAILED >
MSR 00000662  < FAILED >
MSR 00000663  < FAILED >
MSR 00000664  0000-0048-1408-AF3C
MSR 00000665  < FAILED >
MSR 00000666  < FAILED >
MSR 00000667  < FAILED >
MSR 00000668  < FAILED >
MSR 00000669  < FAILED >
MSR 0000066A  < FAILED >
MSR 0000066B  < FAILED >
MSR 0000066C  < FAILED >
MSR 0000066D  < FAILED >
MSR 0000066E  < FAILED >
MSR 0000066F  < FAILED >
MSR 00000670  < FAILED >
MSR 00000671  < FAILED >
MSR 00000672  < FAILED >
MSR 00000673  < FAILED >
MSR 00000674  < FAILED >
MSR 00000675  < FAILED >
MSR 00000676  < FAILED >
MSR 00000677  < FAILED >
MSR 00000690  < FAILED >
MSR 000006B0  0000-0000-0100-0000
MSR 000006B1  0000-0000-0100-0000
MSR 00000770  0000-0000-0000-0001
MSR 00000771  0000-0000-0115-1B3E
MSR 00000772  0000-0000-8000-FF01
MSR 00000773  0000-0000-0000-0005
MSR 00000774  0000-019E-3F00-3E01
MSR 00000777  0000-0000-0000-0004
MSR 00000832  0000-0000-0000-00D1
MSR 00000838  0000-0000-0000-0258
MSR 00000839  0000-0000-0000-01F7
MSR 0000083E  0000-0000-0000-000A
 
MSR Registers (CPU #3):
MSR 00000017  0004-0000-0000-0000 [PlatID = 1]
MSR 0000001B  0000-0000-FEE0-0C00
MSR 0000002A  0000-0000-0000-0000
MSR 00000035  0000-0000-000A-000A
MSR 00000048  0000-0000-0000-0001
MSR 00000049  < FAILED >
MSR 0000008B  0000-0121-0000-0000
MSR 000000CD  < FAILED >
MSR 000000CE  0804-0838-F081-1900 [eD = 0]
MSR 000000E7  0000-0003-A8AC-2474
MSR 000000E8  0000-0004-AAF0-D0C3
MSR 000000EE  < FAILED >
MSR 0000010A  0000-0000-0DF9-FD6B
MSR 0000010B  < FAILED >
MSR 0000011E  < FAILED >
MSR 00000194  0000-0000-0010-0000
MSR 00000198  0000-17C3-0000-1300
MSR 00000199  0000-0000-0000-3100
MSR 0000019A  0000-0000-0000-0000
MSR 0000019B  0000-0000-0000-0010
MSR 0000019C  0000-0000-8831-2800
MSR 0000019D  0000-0000-0000-0000
MSR 000001A0  0000-0000-0085-0089
MSR 000001A2  0000-0000-8069-1600
MSR 000001A4  0000-0000-0000-0084
MSR 000001AA  0000-0000-0000-30C2
MSR 000001AC  < FAILED >
MSR 000001AD  2F2F-2F2F-2F2F-3131
MSR 000001AE  0807-0605-0403-0201
MSR 000001AF  < FAILED >
MSR 000001B0  0000-0000-0000-0006
MSR 000001B1  0000-0000-882E-0800
MSR 000001B2  0000-0000-0200-0000
MSR 000001FC  0000-0000-00CC-005F
MSR 00000300  < FAILED >
MSR 0000030A  0000-0000-0000-0000
MSR 0000030B  0000-0000-0000-0000
MSR 00000480  03DA-0600-0000-0015
MSR 00000481  0000-00FF-0000-0016
MSR 00000482  FFFB-FFFE-0401-E172
MSR 00000483  FF7F-FFFF-0003-6DFF
MSR 00000484  007E-FFFF-0000-11FF
MSR 00000485  0000-0000-7004-C1E7
MSR 00000486  0000-0000-8000-0021
MSR 00000487  0000-0000-FFFF-FFFF
MSR 00000488  0000-0000-0000-2000
MSR 00000489  0000-0000-1BF7-6FFF
MSR 0000048A  0000-0000-0000-002E
MSR 0000048B  C75F-7FFF-0000-0000
MSR 0000048C  0000-0F01-06F3-4141
MSR 0000048D  0000-00FF-0000-0016
MSR 0000048E  FFFB-FFFE-0400-6172
MSR 0000048F  FF7F-FFFF-0003-6DFB
MSR 00000490  007E-FFFF-0000-11FB
MSR 00000601  0000-0000-0000-0278
MSR 00000602  < FAILED >
MSR 00000603  0036-0000-0036-3636
MSR 00000604  < FAILED >
MSR 00000606  0000-0000-000A-0E03
MSR 0000060A  0000-0000-0000-0000
MSR 0000060B  0000-0000-0000-0000
MSR 0000060C  0000-0000-0000-0000
MSR 0000060D  0000-0028-4BA1-6026
MSR 00000610  0042-8250-00DD-8118
MSR 00000611  0000-0000-01D1-401E
MSR 00000613  0000-0000-0000-0055
MSR 00000614  0012-0000-0000-0118
MSR 00000618  0000-0000-0000-0000
MSR 00000619  0000-0000-0000-0000
MSR 0000061B  0000-0000-0000-0000
MSR 0000061C  < FAILED >
MSR 0000061E  < FAILED >
MSR 00000620  0000-0000-0000-0825
MSR 00000621  0000-0000-1BB5-0012
MSR 00000638  0000-0000-0000-0000
MSR 00000639  0000-0000-00CB-7428
MSR 0000063A  0000-0000-0000-0000
MSR 0000063B  < FAILED >
MSR 00000640  0000-0000-0000-0000
MSR 00000641  0000-0000-0000-0018
MSR 00000642  0000-0000-0000-0010
MSR 00000648  0000-0000-0000-0019
MSR 00000649  0000-0000-0000-0000
MSR 0000064A  0000-0000-0000-0000
MSR 0000064B  0000-0000-8000-0000
MSR 0000064C  0000-0000-0000-0000
MSR 00000650  2C2C-2C2C-2C2C-2C2C
MSR 00000651  0807-0605-0403-0201
MSR 00000660  0000-000A-12C6-FB44
MSR 00000661  < FAILED >
MSR 00000662  < FAILED >
MSR 00000663  < FAILED >
MSR 00000664  0000-0048-1408-AF3C
MSR 00000665  < FAILED >
MSR 00000666  < FAILED >
MSR 00000667  < FAILED >
MSR 00000668  < FAILED >
MSR 00000669  < FAILED >
MSR 0000066A  < FAILED >
MSR 0000066B  < FAILED >
MSR 0000066C  < FAILED >
MSR 0000066D  < FAILED >
MSR 0000066E  < FAILED >
MSR 0000066F  < FAILED >
MSR 00000670  < FAILED >
MSR 00000671  < FAILED >
MSR 00000672  < FAILED >
MSR 00000673  < FAILED >
MSR 00000674  < FAILED >
MSR 00000675  < FAILED >
MSR 00000676  < FAILED >
MSR 00000677  < FAILED >
MSR 00000690  < FAILED >
MSR 000006B0  0000-0000-0100-0000
MSR 000006B1  0000-0000-0100-0000
MSR 00000770  0000-0000-0000-0001
MSR 00000771  0000-0000-0115-1B3E
MSR 00000772  0000-0000-8000-FF01
MSR 00000773  0000-0000-0000-0005
MSR 00000774  0000-019E-3F00-3E01
MSR 00000777  0000-0000-0000-0004
MSR 00000832  0000-0000-0000-00D1
MSR 00000838  0000-0000-0000-0258
MSR 00000839  0000-0000-0000-0203
MSR 0000083E  0000-0000-0000-000A
 
MSR Registers (CPU #4):
MSR 00000017  0004-0000-0000-0000 [PlatID = 1]
MSR 0000001B  0000-0000-FEE0-0C00
MSR 0000002A  0000-0000-0000-0000
MSR 00000035  0000-0000-000A-000A
MSR 00000048  0000-0000-0000-0001
MSR 00000049  < FAILED >
MSR 0000008B  0000-0121-0000-0000
MSR 000000CD  < FAILED >
MSR 000000CE  0804-0838-F081-1900 [eD = 0]
MSR 000000E7  0000-0003-59D5-DCC8
MSR 000000E8  0000-0004-5C0D-C688
MSR 000000EE  < FAILED >
MSR 0000010A  0000-0000-0DF9-FD6B
MSR 0000010B  < FAILED >
MSR 0000011E  < FAILED >
MSR 00000194  0000-0000-0010-0000
MSR 00000198  0000-17C3-0000-1300
MSR 00000199  0000-0000-0000-3100
MSR 0000019A  0000-0000-0000-0000
MSR 0000019B  0000-0000-0000-0010
MSR 0000019C  0000-0000-8831-2800
MSR 0000019D  0000-0000-0000-0000
MSR 000001A0  0000-0000-0085-0089
MSR 000001A2  0000-0000-8069-1600
MSR 000001A4  0000-0000-0000-0084
MSR 000001AA  0000-0000-0000-30C2
MSR 000001AC  < FAILED >
MSR 000001AD  2F2F-2F2F-2F2F-3131
MSR 000001AE  0807-0605-0403-0201
MSR 000001AF  < FAILED >
MSR 000001B0  0000-0000-0000-0006
MSR 000001B1  0000-0000-882F-0800
MSR 000001B2  0000-0000-0200-0000
MSR 000001FC  0000-0000-00CC-005F
MSR 00000300  < FAILED >
MSR 0000030A  0000-0000-0000-0000
MSR 0000030B  0000-0000-0000-0000
MSR 00000480  03DA-0600-0000-0015
MSR 00000481  0000-00FF-0000-0016
MSR 00000482  FFFB-FFFE-0401-E172
MSR 00000483  FF7F-FFFF-0003-6DFF
MSR 00000484  007E-FFFF-0000-11FF
MSR 00000485  0000-0000-7004-C1E7
MSR 00000486  0000-0000-8000-0021
MSR 00000487  0000-0000-FFFF-FFFF
MSR 00000488  0000-0000-0000-2000
MSR 00000489  0000-0000-1BF7-6FFF
MSR 0000048A  0000-0000-0000-002E
MSR 0000048B  C75F-7FFF-0000-0000
MSR 0000048C  0000-0F01-06F3-4141
MSR 0000048D  0000-00FF-0000-0016
MSR 0000048E  FFFB-FFFE-0400-6172
MSR 0000048F  FF7F-FFFF-0003-6DFB
MSR 00000490  007E-FFFF-0000-11FB
MSR 00000601  0000-0000-0000-0278
MSR 00000602  < FAILED >
MSR 00000603  0036-0000-0036-3636
MSR 00000604  < FAILED >
MSR 00000606  0000-0000-000A-0E03
MSR 0000060A  0000-0000-0000-0000
MSR 0000060B  0000-0000-0000-0000
MSR 0000060C  0000-0000-0000-0000
MSR 0000060D  0000-0028-4BA1-6026
MSR 00000610  0042-8250-00DD-8118
MSR 00000611  0000-0000-01D1-40C9
MSR 00000613  0000-0000-0000-0055
MSR 00000614  0012-0000-0000-0118
MSR 00000618  0000-0000-0000-0000
MSR 00000619  0000-0000-0000-0000
MSR 0000061B  0000-0000-0000-0000
MSR 0000061C  < FAILED >
MSR 0000061E  < FAILED >
MSR 00000620  0000-0000-0000-0825
MSR 00000621  0000-0000-1BB5-0012
MSR 00000638  0000-0000-0000-0000
MSR 00000639  0000-0000-00CB-7428
MSR 0000063A  0000-0000-0000-0000
MSR 0000063B  < FAILED >
MSR 00000640  0000-0000-0000-0000
MSR 00000641  0000-0000-0000-0018
MSR 00000642  0000-0000-0000-0010
MSR 00000648  0000-0000-0000-0019
MSR 00000649  0000-0000-0000-0000
MSR 0000064A  0000-0000-0000-0000
MSR 0000064B  0000-0000-8000-0000
MSR 0000064C  0000-0000-0000-0000
MSR 00000650  2C2C-2C2C-2C2C-2C2C
MSR 00000651  0807-0605-0403-0201
MSR 00000660  0000-0009-E178-7D92
MSR 00000661  < FAILED >
MSR 00000662  < FAILED >
MSR 00000663  < FAILED >
MSR 00000664  0000-0048-1408-AF3C
MSR 00000665  < FAILED >
MSR 00000666  < FAILED >
MSR 00000667  < FAILED >
MSR 00000668  < FAILED >
MSR 00000669  < FAILED >
MSR 0000066A  < FAILED >
MSR 0000066B  < FAILED >
MSR 0000066C  < FAILED >
MSR 0000066D  < FAILED >
MSR 0000066E  < FAILED >
MSR 0000066F  < FAILED >
MSR 00000670  < FAILED >
MSR 00000671  < FAILED >
MSR 00000672  < FAILED >
MSR 00000673  < FAILED >
MSR 00000674  < FAILED >
MSR 00000675  < FAILED >
MSR 00000676  < FAILED >
MSR 00000677  < FAILED >
MSR 00000690  < FAILED >
MSR 000006B0  0000-0000-0100-0000
MSR 000006B1  0000-0000-0100-0000
MSR 00000770  0000-0000-0000-0001
MSR 00000771  0000-0000-0115-1B3E
MSR 00000772  0000-0000-8000-FF01
MSR 00000773  0000-0000-0000-0005
MSR 00000774  0000-019E-3F00-3E01
MSR 00000777  0000-0000-0000-0004
MSR 00000832  0000-0000-0000-00D1
MSR 00000838  0000-0000-0000-0258
MSR 00000839  0000-0000-0000-0202
MSR 0000083E  0000-0000-0000-000A
 
MSR Registers (CPU #5):
MSR 00000017  0004-0000-0000-0000 [PlatID = 1]
MSR 0000001B  0000-0000-FEE0-0C00
MSR 0000002A  0000-0000-0000-0000
MSR 00000035  0000-0000-000A-000A
MSR 00000048  0000-0000-0000-0001
MSR 00000049  < FAILED >
MSR 0000008B  0000-0121-0000-0000
MSR 000000CD  < FAILED >
MSR 000000CE  0804-0838-F081-1900 [eD = 0]
MSR 000000E7  0000-0002-7C90-54EC
MSR 000000E8  0000-0003-1641-BF0B
MSR 000000EE  < FAILED >
MSR 0000010A  0000-0000-0DF9-FD6B
MSR 0000010B  < FAILED >
MSR 0000011E  < FAILED >
MSR 00000194  0000-0000-0010-0000
MSR 00000198  0000-17C3-0000-1300
MSR 00000199  0000-0000-0000-3100
MSR 0000019A  0000-0000-0000-0000
MSR 0000019B  0000-0000-0000-0010
MSR 0000019C  0000-0000-882F-2800
MSR 0000019D  0000-0000-0000-0000
MSR 000001A0  0000-0000-0085-0089
MSR 000001A2  0000-0000-8069-1600
MSR 000001A4  0000-0000-0000-0084
MSR 000001AA  0000-0000-0000-30C2
MSR 000001AC  < FAILED >
MSR 000001AD  2F2F-2F2F-2F2F-3131
MSR 000001AE  0807-0605-0403-0201
MSR 000001AF  < FAILED >
MSR 000001B0  0000-0000-0000-0006
MSR 000001B1  0000-0000-882F-0800
MSR 000001B2  0000-0000-0200-0000
MSR 000001FC  0000-0000-00CC-005F
MSR 00000300  < FAILED >
MSR 0000030A  0000-0000-0000-0000
MSR 0000030B  0000-0000-0000-0000
MSR 00000480  03DA-0600-0000-0015
MSR 00000481  0000-00FF-0000-0016
MSR 00000482  FFFB-FFFE-0401-E172
MSR 00000483  FF7F-FFFF-0003-6DFF
MSR 00000484  007E-FFFF-0000-11FF
MSR 00000485  0000-0000-7004-C1E7
MSR 00000486  0000-0000-8000-0021
MSR 00000487  0000-0000-FFFF-FFFF
MSR 00000488  0000-0000-0000-2000
MSR 00000489  0000-0000-1BF7-6FFF
MSR 0000048A  0000-0000-0000-002E
MSR 0000048B  C75F-7FFF-0000-0000
MSR 0000048C  0000-0F01-06F3-4141
MSR 0000048D  0000-00FF-0000-0016
MSR 0000048E  FFFB-FFFE-0400-6172
MSR 0000048F  FF7F-FFFF-0003-6DFB
MSR 00000490  007E-FFFF-0000-11FB
MSR 00000601  0000-0000-0000-0278
MSR 00000602  < FAILED >
MSR 00000603  0036-0000-0036-3636
MSR 00000604  < FAILED >
MSR 00000606  0000-0000-000A-0E03
MSR 0000060A  0000-0000-0000-0000
MSR 0000060B  0000-0000-0000-0000
MSR 0000060C  0000-0000-0000-0000
MSR 0000060D  0000-0028-4BA1-6026
MSR 00000610  0042-8250-00DD-8118
MSR 00000611  0000-0000-01D1-4174
MSR 00000613  0000-0000-0000-0055
MSR 00000614  0012-0000-0000-0118
MSR 00000618  0000-0000-0000-0000
MSR 00000619  0000-0000-0000-0000
MSR 0000061B  0000-0000-0000-0000
MSR 0000061C  < FAILED >
MSR 0000061E  < FAILED >
MSR 00000620  0000-0000-0000-0825
MSR 00000621  0000-0000-1BB5-0012
MSR 00000638  0000-0000-0000-0000
MSR 00000639  0000-0000-00CB-7461
MSR 0000063A  0000-0000-0000-0000
MSR 0000063B  < FAILED >
MSR 00000640  0000-0000-0000-0000
MSR 00000641  0000-0000-0000-0018
MSR 00000642  0000-0000-0000-0010
MSR 00000648  0000-0000-0000-0019
MSR 00000649  0000-0000-0000-0000
MSR 0000064A  0000-0000-0000-0000
MSR 0000064B  0000-0000-8000-0000
MSR 0000064C  0000-0000-0000-0000
MSR 00000650  2C2C-2C2C-2C2C-2C2C
MSR 00000651  0807-0605-0403-0201
MSR 00000660  0000-0009-E750-5299
MSR 00000661  < FAILED >
MSR 00000662  < FAILED >
MSR 00000663  < FAILED >
MSR 00000664  0000-0048-1408-AF3C
MSR 00000665  < FAILED >
MSR 00000666  < FAILED >
MSR 00000667  < FAILED >
MSR 00000668  < FAILED >
MSR 00000669  < FAILED >
MSR 0000066A  < FAILED >
MSR 0000066B  < FAILED >
MSR 0000066C  < FAILED >
MSR 0000066D  < FAILED >
MSR 0000066E  < FAILED >
MSR 0000066F  < FAILED >
MSR 00000670  < FAILED >
MSR 00000671  < FAILED >
MSR 00000672  < FAILED >
MSR 00000673  < FAILED >
MSR 00000674  < FAILED >
MSR 00000675  < FAILED >
MSR 00000676  < FAILED >
MSR 00000677  < FAILED >
MSR 00000690  < FAILED >
MSR 000006B0  0000-0000-0100-0000
MSR 000006B1  0000-0000-0100-0000
MSR 00000770  0000-0000-0000-0001
MSR 00000771  0000-0000-0115-1B3E
MSR 00000772  0000-0000-8000-FF01
MSR 00000773  0000-0000-0000-0005
MSR 00000774  0000-019E-3F00-3E01
MSR 00000777  0000-0000-0000-0004
MSR 00000832  0000-0000-0000-00D1
MSR 00000838  0000-0000-0000-0258
MSR 00000839  0000-0000-0000-0203
MSR 0000083E  0000-0000-0000-000A
 
MSR Registers (CPU #6):
MSR 00000017  0004-0000-0000-0000 [PlatID = 1]
MSR 0000001B  0000-0000-FEE0-0C00
MSR 00000035  0000-0000-000A-000A
MSR 00000048  0000-0000-0000-0001
MSR 00000049  < FAILED >
MSR 0000008B  0000-0121-0000-0000
MSR 000000CE  0804-0838-F081-1900 [eD = 0]
MSR 000000E7  0000-0009-4D8E-E350
MSR 000000E8  0000-000E-5CE9-BF26
MSR 0000010A  0000-0000-0DF9-FD6B
MSR 0000010B  < FAILED >
MSR 00000194  0000-0000-0010-0000
MSR 00000198  0000-1762-0000-1200
MSR 00000199  0000-0000-0000-3100
MSR 0000019A  0000-0000-0000-0000
MSR 0000019B  0000-0000-0000-0010
MSR 0000019C  0000-0000-8831-2800
MSR 0000019D  0000-0000-0000-0000
MSR 000001A0  0000-0000-0085-0089
MSR 000001A2  0000-0000-8069-1600
MSR 000001A4  0000-0000-0000-0000
MSR 000001AA  0000-0000-0000-30C2
MSR 000001AC  < FAILED >
MSR 000001AD  2F2F-2F2F-2F2F-3131
MSR 000001AE  0807-0605-0403-0201
MSR 000001AF  < FAILED >
MSR 000001B0  0000-0000-0000-0006
MSR 000001B1  0000-0000-882D-0800
MSR 000001B2  0000-0000-0200-0000
MSR 000001FC  0000-0000-00CC-005F
MSR 00000300  < FAILED >
MSR 0000030A  0000-0000-0000-0000
MSR 0000030B  0000-0000-0000-0000
MSR 00000480  03DA-0600-0000-0015
MSR 00000481  0000-00FF-0000-0016
MSR 00000482  FFFB-FFFE-0401-E172
MSR 00000483  FF7F-FFFF-0003-6DFF
MSR 00000484  007E-FFFF-0000-11FF
MSR 00000485  0000-0000-7004-C1E7
MSR 00000486  0000-0000-8000-0021
MSR 00000487  0000-0000-FFFF-FFFF
MSR 00000488  0000-0000-0000-2000
MSR 00000489  0000-0000-1BF7-6FFF
MSR 0000048A  0000-0000-0000-002E
MSR 0000048B  C75F-7FFF-0000-0000
MSR 0000048C  0000-0F01-06F3-4141
MSR 0000048D  0000-00FF-0000-0016
MSR 0000048E  FFFB-FFFE-0400-6172
MSR 0000048F  FF7F-FFFF-0003-6DFB
MSR 00000490  007E-FFFF-0000-11FB
MSR 00000601  0000-0000-0000-0278
MSR 00000602  < FAILED >
MSR 00000603  0036-0000-0036-3636
MSR 00000604  < FAILED >
MSR 00000606  0000-0000-000A-0E03
MSR 0000060A  0000-0000-0000-0000
MSR 0000060B  0000-0000-0000-0000
MSR 0000060C  0000-0000-0000-0000
MSR 0000060D  0000-0028-4BA1-6026
MSR 00000610  0042-8250-00DD-8118
MSR 00000611  0000-0000-01D1-4221
MSR 00000613  0000-0000-0000-0055
MSR 00000614  0012-0000-0000-0118
MSR 00000618  0000-0000-0000-0000
MSR 00000619  0000-0000-0000-0000
MSR 0000061B  0000-0000-0000-0000
MSR 0000061C  < FAILED >
MSR 0000061E  < FAILED >
MSR 00000620  0000-0000-0000-0825
MSR 00000621  0000-0000-1BB5-0012
MSR 00000638  0000-0000-0000-0000
MSR 00000639  0000-0000-00CB-749B
MSR 0000063A  0000-0000-0000-0000
MSR 0000063B  < FAILED >
MSR 00000640  0000-0000-0000-0000
MSR 00000641  0000-0000-0000-0018
MSR 00000642  0000-0000-0000-0010
MSR 00000648  0000-0000-0000-0019
MSR 00000649  0000-0000-0000-0000
MSR 0000064A  0000-0000-0000-0000
MSR 0000064B  0000-0000-8000-0000
MSR 0000064C  0000-0000-0000-0000
MSR 00000650  2C2C-2C2C-2C2C-2C2C
MSR 00000651  0807-0605-0403-0201
MSR 00000690  < FAILED >
MSR 000006B0  0000-0000-0100-0000
MSR 000006B1  0000-0000-0100-0000
MSR 00000770  0000-0000-0000-0001
MSR 00000771  0000-0000-0124-284F
MSR 00000772  0000-0000-8000-FF01
MSR 00000773  0000-0000-0000-0005
MSR 00000774  0000-019E-3F00-4F02
MSR 00000777  0000-0000-0000-0000
MSR 00000832  0000-0000-0002-00D1
MSR 00000838  0000-0000-0000-0209
MSR 00000839  0000-0000-0000-0155
MSR 0000083E  0000-0000-0000-000A
 
MSR Registers (CPU #7):
MSR 00000017  0004-0000-0000-0000 [PlatID = 1]
MSR 0000001B  0000-0000-FEE0-0C00
MSR 00000035  0000-0000-000A-000A
MSR 00000048  0000-0000-0000-0001
MSR 00000049  < FAILED >
MSR 0000008B  0000-0121-0000-0000
MSR 000000CE  0804-0838-F081-1900 [eD = 0]
MSR 000000E7  0000-0008-EF99-8967
MSR 000000E8  0000-000D-A1AD-6743
MSR 0000010A  0000-0000-0DF9-FD6B
MSR 0000010B  < FAILED >
MSR 00000194  0000-0000-0010-0000
MSR 00000198  0000-1762-0000-1200
MSR 00000199  0000-0000-0000-3100
MSR 0000019A  0000-0000-0000-0000
MSR 0000019B  0000-0000-0000-0010
MSR 0000019C  0000-0000-882F-2800
MSR 0000019D  0000-0000-0000-0000
MSR 000001A0  0000-0000-0085-0089
MSR 000001A2  0000-0000-8069-1600
MSR 000001A4  0000-0000-0000-0000
MSR 000001AA  0000-0000-0000-30C2
MSR 000001AC  < FAILED >
MSR 000001AD  2F2F-2F2F-2F2F-3131
MSR 000001AE  0807-0605-0403-0201
MSR 000001AF  < FAILED >
MSR 000001B0  0000-0000-0000-0006
MSR 000001B1  0000-0000-882E-0800
MSR 000001B2  0000-0000-0200-0000
MSR 000001FC  0000-0000-00CC-005F
MSR 00000300  < FAILED >
MSR 0000030A  0000-0000-0000-0000
MSR 0000030B  0000-0000-0000-0000
MSR 00000480  03DA-0600-0000-0015
MSR 00000481  0000-00FF-0000-0016
MSR 00000482  FFFB-FFFE-0401-E172
MSR 00000483  FF7F-FFFF-0003-6DFF
MSR 00000484  007E-FFFF-0000-11FF
MSR 00000485  0000-0000-7004-C1E7
MSR 00000486  0000-0000-8000-0021
MSR 00000487  0000-0000-FFFF-FFFF
MSR 00000488  0000-0000-0000-2000
MSR 00000489  0000-0000-1BF7-6FFF
MSR 0000048A  0000-0000-0000-002E
MSR 0000048B  C75F-7FFF-0000-0000
MSR 0000048C  0000-0F01-06F3-4141
MSR 0000048D  0000-00FF-0000-0016
MSR 0000048E  FFFB-FFFE-0400-6172
MSR 0000048F  FF7F-FFFF-0003-6DFB
MSR 00000490  007E-FFFF-0000-11FB
MSR 00000601  0000-0000-0000-0278
MSR 00000602  < FAILED >
MSR 00000603  0036-0000-0036-3636
MSR 00000604  < FAILED >
MSR 00000606  0000-0000-000A-0E03
MSR 0000060A  0000-0000-0000-0000
MSR 0000060B  0000-0000-0000-0000
MSR 0000060C  0000-0000-0000-0000
MSR 0000060D  0000-0028-4BA1-6026
MSR 00000610  0042-8250-00DD-8118
MSR 00000611  0000-0000-01D1-42CD
MSR 00000613  0000-0000-0000-0055
MSR 00000614  0012-0000-0000-0118
MSR 00000618  0000-0000-0000-0000
MSR 00000619  0000-0000-0000-0000
MSR 0000061B  0000-0000-0000-0000
MSR 0000061C  < FAILED >
MSR 0000061E  < FAILED >
MSR 00000620  0000-0000-0000-0825
MSR 00000621  0000-0000-1BB5-0012
MSR 00000638  0000-0000-0000-0000
MSR 00000639  0000-0000-00CB-74DA
MSR 0000063A  0000-0000-0000-0000
MSR 0000063B  < FAILED >
MSR 00000640  0000-0000-0000-0000
MSR 00000641  0000-0000-0000-0018
MSR 00000642  0000-0000-0000-0010
MSR 00000648  0000-0000-0000-0019
MSR 00000649  0000-0000-0000-0000
MSR 0000064A  0000-0000-0000-0000
MSR 0000064B  0000-0000-8000-0000
MSR 0000064C  0000-0000-0000-0000
MSR 00000650  2C2C-2C2C-2C2C-2C2C
MSR 00000651  0807-0605-0403-0201
MSR 00000690  < FAILED >
MSR 000006B0  0000-0000-0100-0000
MSR 000006B1  0000-0000-0100-0000
MSR 00000770  0000-0000-0000-0001
MSR 00000771  0000-0000-0124-284F
MSR 00000772  0000-0000-8000-FF01
MSR 00000773  0000-0000-0000-0005
MSR 00000774  0000-019E-3F00-4F02
MSR 00000777  0000-0000-0000-0000
MSR 00000832  0000-0000-0000-00D1
MSR 00000838  0000-0000-0000-0258
MSR 00000839  0000-0000-0000-022B
MSR 0000083E  0000-0000-0000-000A
 
MSR Registers (CPU #8):
MSR 00000017  0004-0000-0000-0000 [PlatID = 1]
MSR 0000001B  0000-0000-FEE0-0C00
MSR 00000035  0000-0000-000A-000A
MSR 00000048  0000-0000-0000-0001
MSR 00000049  < FAILED >
MSR 0000008B  0000-0121-0000-0000
MSR 000000CE  0804-0838-F081-1900 [eD = 0]
MSR 000000E7  0000-000A-6DC4-DC14
MSR 000000E8  0000-000F-AC47-884B
MSR 0000010A  0000-0000-0DF9-FD6B
MSR 0000010B  < FAILED >
MSR 00000194  0000-0000-0010-0000
MSR 00000198  0000-1724-0000-1500
MSR 00000199  0000-0000-0000-3100
MSR 0000019A  0000-0000-0000-0000
MSR 0000019B  0000-0000-0000-0010
MSR 0000019C  0000-0000-8831-2800
MSR 0000019D  0000-0000-0000-0000
MSR 000001A0  0000-0000-0085-0089
MSR 000001A2  0000-0000-8069-1600
MSR 000001A4  0000-0000-0000-0000
MSR 000001AA  0000-0000-0000-30C2
MSR 000001AC  < FAILED >
MSR 000001AD  2F2F-2F2F-2F2F-3131
MSR 000001AE  0807-0605-0403-0201
MSR 000001AF  < FAILED >
MSR 000001B0  0000-0000-0000-0006
MSR 000001B1  0000-0000-882E-0800
MSR 000001B2  0000-0000-0200-0000
MSR 000001FC  0000-0000-00CC-005F
MSR 00000300  < FAILED >
MSR 0000030A  0000-0000-0000-0000
MSR 0000030B  0000-0000-0000-0000
MSR 00000480  03DA-0600-0000-0015
MSR 00000481  0000-00FF-0000-0016
MSR 00000482  FFFB-FFFE-0401-E172
MSR 00000483  FF7F-FFFF-0003-6DFF
MSR 00000484  007E-FFFF-0000-11FF
MSR 00000485  0000-0000-7004-C1E7
MSR 00000486  0000-0000-8000-0021
MSR 00000487  0000-0000-FFFF-FFFF
MSR 00000488  0000-0000-0000-2000
MSR 00000489  0000-0000-1BF7-6FFF
MSR 0000048A  0000-0000-0000-002E
MSR 0000048B  C75F-7FFF-0000-0000
MSR 0000048C  0000-0F01-06F3-4141
MSR 0000048D  0000-00FF-0000-0016
MSR 0000048E  FFFB-FFFE-0400-6172
MSR 0000048F  FF7F-FFFF-0003-6DFB
MSR 00000490  007E-FFFF-0000-11FB
MSR 00000601  0000-0000-0000-0278
MSR 00000602  < FAILED >
MSR 00000603  0036-0000-0036-3636
MSR 00000604  < FAILED >
MSR 00000606  0000-0000-000A-0E03
MSR 0000060A  0000-0000-0000-0000
MSR 0000060B  0000-0000-0000-0000
MSR 0000060C  0000-0000-0000-0000
MSR 0000060D  0000-0028-4BA1-6026
MSR 00000610  0042-8250-00DD-8118
MSR 00000611  0000-0000-01D1-42CD
MSR 00000613  0000-0000-0000-0055
MSR 00000614  0012-0000-0000-0118
MSR 00000618  0000-0000-0000-0000
MSR 00000619  0000-0000-0000-0000
MSR 0000061B  0000-0000-0000-0000
MSR 0000061C  < FAILED >
MSR 0000061E  < FAILED >
MSR 00000620  0000-0000-0000-0825
MSR 00000621  0000-0000-1BB5-0012
MSR 00000638  0000-0000-0000-0000
MSR 00000639  0000-0000-00CB-74DA
MSR 0000063A  0000-0000-0000-0000
MSR 0000063B  < FAILED >
MSR 00000640  0000-0000-0000-0000
MSR 00000641  0000-0000-0000-0018
MSR 00000642  0000-0000-0000-0010
MSR 00000648  0000-0000-0000-0019
MSR 00000649  0000-0000-0000-0000
MSR 0000064A  0000-0000-0000-0000
MSR 0000064B  0000-0000-8000-0000
MSR 0000064C  0000-0000-0000-0000
MSR 00000650  2C2C-2C2C-2C2C-2C2C
MSR 00000651  0807-0605-0403-0201
MSR 00000690  < FAILED >
MSR 000006B0  0000-0000-0100-0000
MSR 000006B1  0000-0000-0100-0000
MSR 00000770  0000-0000-0000-0001
MSR 00000771  0000-0000-0122-284F
MSR 00000772  0000-0000-8000-FF01
MSR 00000773  0000-0000-0000-0005
MSR 00000774  0000-019E-3F00-4F02
MSR 00000777  0000-0000-0000-0000
MSR 00000832  0000-0000-0002-00D1
MSR 00000838  0000-0000-0000-0209
MSR 00000839  0000-0000-0000-015A
MSR 0000083E  0000-0000-0000-000A
 
MSR Registers (CPU #9):
MSR 00000017  0004-0000-0000-0000 [PlatID = 1]
MSR 0000001B  0000-0000-FEE0-0C00
MSR 00000035  0000-0000-000A-000A
MSR 00000048  0000-0000-0000-0001
MSR 00000049  < FAILED >
MSR 0000008B  0000-0121-0000-0000
MSR 000000CE  0804-0838-F081-1900 [eD = 0]
MSR 000000E7  0000-0008-7D9D-1E7D
MSR 000000E8  0000-000C-ABE4-1627
MSR 0000010A  0000-0000-0DF9-FD6B
MSR 0000010B  < FAILED >
MSR 00000194  0000-0000-0010-0000
MSR 00000198  0000-1724-0000-1500
MSR 00000199  0000-0000-0000-3100
MSR 0000019A  0000-0000-0000-0000
MSR 0000019B  0000-0000-0000-0010
MSR 0000019C  0000-0000-882F-2800
MSR 0000019D  0000-0000-0000-0000
MSR 000001A0  0000-0000-0085-0089
MSR 000001A2  0000-0000-8069-1600
MSR 000001A4  0000-0000-0000-0000
MSR 000001AA  0000-0000-0000-30C2
MSR 000001AC  < FAILED >
MSR 000001AD  2F2F-2F2F-2F2F-3131
MSR 000001AE  0807-0605-0403-0201
MSR 000001AF  < FAILED >
MSR 000001B0  0000-0000-0000-0006
MSR 000001B1  0000-0000-882E-0800
MSR 000001B2  0000-0000-0200-0000
MSR 000001FC  0000-0000-00CC-005F
MSR 00000300  < FAILED >
MSR 0000030A  0000-0000-0000-0000
MSR 0000030B  0000-0000-0000-0000
MSR 00000480  03DA-0600-0000-0015
MSR 00000481  0000-00FF-0000-0016
MSR 00000482  FFFB-FFFE-0401-E172
MSR 00000483  FF7F-FFFF-0003-6DFF
MSR 00000484  007E-FFFF-0000-11FF
MSR 00000485  0000-0000-7004-C1E7
MSR 00000486  0000-0000-8000-0021
MSR 00000487  0000-0000-FFFF-FFFF
MSR 00000488  0000-0000-0000-2000
MSR 00000489  0000-0000-1BF7-6FFF
MSR 0000048A  0000-0000-0000-002E
MSR 0000048B  C75F-7FFF-0000-0000
MSR 0000048C  0000-0F01-06F3-4141
MSR 0000048D  0000-00FF-0000-0016
MSR 0000048E  FFFB-FFFE-0400-6172
MSR 0000048F  FF7F-FFFF-0003-6DFB
MSR 00000490  007E-FFFF-0000-11FB
MSR 00000601  0000-0000-0000-0278
MSR 00000602  < FAILED >
MSR 00000603  0036-0000-0036-3636
MSR 00000604  < FAILED >
MSR 00000606  0000-0000-000A-0E03
MSR 0000060A  0000-0000-0000-0000
MSR 0000060B  0000-0000-0000-0000
MSR 0000060C  0000-0000-0000-0000
MSR 0000060D  0000-0028-4BA1-6026
MSR 00000610  0042-8250-00DD-8118
MSR 00000611  0000-0000-01D1-4383
MSR 00000613  0000-0000-0000-0055
MSR 00000614  0012-0000-0000-0118
MSR 00000618  0000-0000-0000-0000
MSR 00000619  0000-0000-0000-0000
MSR 0000061B  0000-0000-0000-0000
MSR 0000061C  < FAILED >
MSR 0000061E  < FAILED >
MSR 00000620  0000-0000-0000-0825
MSR 00000621  0000-0000-1BB5-0011
MSR 00000638  0000-0000-0000-0000
MSR 00000639  0000-0000-00CB-751F
MSR 0000063A  0000-0000-0000-0000
MSR 0000063B  < FAILED >
MSR 00000640  0000-0000-0000-0000
MSR 00000641  0000-0000-0000-0018
MSR 00000642  0000-0000-0000-0010
MSR 00000648  0000-0000-0000-0019
MSR 00000649  0000-0000-0000-0000
MSR 0000064A  0000-0000-0000-0000
MSR 0000064B  0000-0000-8000-0000
MSR 0000064C  0000-0000-0000-0000
MSR 00000650  2C2C-2C2C-2C2C-2C2C
MSR 00000651  0807-0605-0403-0201
MSR 00000690  < FAILED >
MSR 000006B0  0000-0000-0100-0000
MSR 000006B1  0000-0000-0100-0000
MSR 00000770  0000-0000-0000-0001
MSR 00000771  0000-0000-0122-284F
MSR 00000772  0000-0000-8000-FF01
MSR 00000773  0000-0000-0000-0005
MSR 00000774  0000-019E-3F00-4F02
MSR 00000777  0000-0000-0000-0000
MSR 00000832  0000-0000-0002-00D1
MSR 00000838  0000-0000-0000-0209
MSR 00000839  0000-0000-0000-014F
MSR 0000083E  0000-0000-0000-000A


Motherboard
 
Motherboard Properties:
Motherboard ID  <DMI>
Motherboard Name  HP ProDesk 4 Mini G1i Desktop AI PC
 
Front Side Bus Properties:
Bus Type  Intel QPI
Real Clock  100 MHz
Effective Clock  100 MHz
 
Memory Bus Properties:
Bus Type  Dual DDR5 SDRAM
Bus Width  128-bit
DRAM:FSB Ratio  28:1
Real Clock  2800 MHz (DDR)
Effective Clock  5600 MHz
Bandwidth  89600 MB/s
 
Chipset Bus Properties:
Bus Type  Intel Direct Media Interface v4.0


Memory
 
Physical Memory:
Total  32188 MB
Used  3353 MB
Free  28835 MB
Utilization  10 %
 
Virtual Memory:
Total  37308 MB
Used  2961 MB
Free  34347 MB
Utilization  8 %
 
Paging File:
Paging File  C:\pagefile.sys
Current Size  5120 MB
Current / Peak Usage  0 MB / 0 MB
Utilization  0 %
 
Physical Address Extension (PAE):
Supported by Operating System  Yes
Supported by CPU  Yes
Active  Yes


SPD
 
[ DIMM1: Nanya NT16GF64F88AX3S-Q5 ]
 
Memory Module Properties:
Module Name  Nanya NT16GF64F88AX3S-Q5
Serial Number  001F4AA2h (2722766592)
Manufacture Date  Week 36 / 2025
Module Size  16 GB (32 banks)
Module Type  SO-DIMM
Memory Type  DDR5 SDRAM
Memory Speed  DDR5-5600 (2800 MHz)
Module Width  64 bit
Module Voltage (VDD)  1.1 V
Module Voltage (VDDQ)  1.1 V
Module Voltage (VPP)  1.8 V
Error Detection Method  None
DRAM Manufacturer  Nanya
DRAM Stepping  10h
SDRAM Die Count  1
Supported CAS Latencies  50, 46, 42, 40, 36, 32, 30, 28, 26, 22
 
Memory Timings:
@ 2800 MHz  46-45-45-90 (CL-RCD-RP-RAS) / 135-824-447-364-84 (RC-RFC1-RFC2-RFCSB-WR)
@ 2633 MHz  42-42-42-84 (CL-RCD-RP-RAS) / 126-773-419-341-79 (RC-RFC1-RFC2-RFCSB-WR)
@ 2500 MHz  40-40-40-80 (CL-RCD-RP-RAS) / 120-736-399-325-75 (RC-RFC1-RFC2-RFCSB-WR)
@ 2267 MHz  36-36-36-72 (CL-RCD-RP-RAS) / 108-662-359-292-68 (RC-RFC1-RFC2-RFCSB-WR)
@ 2000 MHz  32-32-32-64 (CL-RCD-RP-RAS) / 96-589-320-260-60 (RC-RFC1-RFC2-RFCSB-WR)
@ 1867 MHz  30-30-30-60 (CL-RCD-RP-RAS) / 90-552-300-244-57 (RC-RFC1-RFC2-RFCSB-WR)
@ 1767 MHz  28-28-28-56 (CL-RCD-RP-RAS) / 84-515-280-227-53 (RC-RFC1-RFC2-RFCSB-WR)
@ 1633 MHz  26-26-26-52 (CL-RCD-RP-RAS) / 78-478-260-211-49 (RC-RFC1-RFC2-RFCSB-WR)
@ 1367 MHz  22-22-22-44 (CL-RCD-RP-RAS) / 66-405-220-179-42 (RC-RFC1-RFC2-RFCSB-WR)
 
Memory Module Features:
Asymmetrical Module  No
HeatSpreader  Not Present
 
Memory Module Manufacturer:
Company Name  Nanya Technology Corp.
Product Information  http://www.nanya.com/en/Product
 
[ DIMM5: Micron CT16G56C46S5.C8H ]
 
Memory Module Properties:
Module Name  Micron CT16G56C46S5.C8H
Serial Number  EBD4CC20h (550294763)
Manufacture Date  Week 43 / 2025
Module Size  16 GB (32 banks)
Module Type  SO-DIMM
Memory Type  DDR5 SDRAM
Memory Speed  DDR5-5600 (2800 MHz)
Module Width  64 bit
Module Voltage (VDD)  1.1 V
Module Voltage (VDDQ)  1.1 V
Module Voltage (VPP)  1.8 V
Error Detection Method  None
DRAM Manufacturer  Micron
DRAM Stepping  48h
SDRAM Die Count  1
Supported CAS Latencies  50, 46, 42, 40, 36, 32, 30, 28, 26, 22
 
Memory Timings:
@ 2800 MHz  46-45-45-90 (CL-RCD-RP-RAS) / 135-824-447-364-84 (RC-RFC1-RFC2-RFCSB-WR)
@ 2633 MHz  42-42-42-84 (CL-RCD-RP-RAS) / 126-773-419-341-79 (RC-RFC1-RFC2-RFCSB-WR)
@ 2500 MHz  40-40-40-80 (CL-RCD-RP-RAS) / 120-736-399-325-75 (RC-RFC1-RFC2-RFCSB-WR)
@ 2267 MHz  36-36-36-72 (CL-RCD-RP-RAS) / 108-662-359-292-68 (RC-RFC1-RFC2-RFCSB-WR)
@ 2000 MHz  32-32-32-64 (CL-RCD-RP-RAS) / 96-589-320-260-60 (RC-RFC1-RFC2-RFCSB-WR)
@ 1867 MHz  30-30-30-60 (CL-RCD-RP-RAS) / 90-552-300-244-57 (RC-RFC1-RFC2-RFCSB-WR)
@ 1767 MHz  28-28-28-56 (CL-RCD-RP-RAS) / 84-515-280-227-53 (RC-RFC1-RFC2-RFCSB-WR)
@ 1633 MHz  26-26-26-52 (CL-RCD-RP-RAS) / 78-478-260-211-49 (RC-RFC1-RFC2-RFCSB-WR)
@ 1367 MHz  22-22-22-44 (CL-RCD-RP-RAS) / 66-405-220-179-42 (RC-RFC1-RFC2-RFCSB-WR)
 
Memory Module Features:
Asymmetrical Module  No
HeatSpreader  Not Present
 
Memory Module Manufacturer:
Company Name  Micron Technology, Inc.
Product Information  https://www.micron.com/products/dram-modules


Chipset
 
[ North Bridge: Intel Arrow Lake-S IMC ]
 
North Bridge Properties:
North Bridge  Intel Arrow Lake-S IMC
Revision  01
VT-d  Supported
Extended APIC (x2APIC)  Supported
 
Memory Controller:
Type  Dual Channel (128-bit)
Active Mode  Dual Channel (128-bit)
 
Memory Timings:
CAS Latency (CL)  46T
RAS To CAS Delay (tRCD)  45T
RAS Precharge (tRP)  45T
RAS Active Time (tRAS)  90T
Row Refresh Cycle Time (tRFC)  447T
Command Rate (CR)  2T
RAS To RAS Delay (tRRD)  Same Bank Group: 14T, Diff. Bank Group: 8T
Write Recovery Time (tWR)  90T
Read To Read Delay (tRTR)  Different Rank: 16T, Same Bank Group: 14T, Diff. Bank Group: 8T
Read To Write Delay (tRTW)  Different Rank: 21T, Different DIMM: 21T, Same Bank Group: 21T, Diff. Bank Group: 21T
Write To Read Delay (tWTR)  Different Rank: 13T, Different DIMM: 13T, Same Bank Group: 80T, Diff. Bank Group: 59T
Write To Write Delay (tWTW)  Different Rank: 14T, Different DIMM: 14T, Same Bank Group: 56T, Diff. Bank Group: 8T
Read To Precharge Delay (tRTP)  21T
Write To Precharge Delay (tWTP)  138T
Four Activate Window Delay (tFAW)  32T
Write CAS Latency (tWCL)  44T
CKE Min. Pulse Width (tCKE)  21T
Refresh Period (tREF)  5460T
Burst Length (BL)  8
 
Error Correction:
ECC  Not Supported
ChipKill ECC  Not Supported
RAID  Not Supported
ECC Scrubbing  Not Supported
 
Memory Slots:
DRAM Slot #1  16 GB (DDR5 SDRAM)
DRAM Slot #2  16 GB (DDR5 SDRAM)
 
Integrated Graphics Controller:
Graphics Controller Type  Intel HD Graphics
Graphics Controller Status  Enabled
 
PCI Express Controller:
PCI-E 4.0 x4 port #12  In Use @ x4 (Standard NVM Express Controller [2646-502E] [NoDB])
 
Chipset Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/products/chipsets
Driver Download  https://www.intel.com/support/chipsets
BIOS Upgrades  http://www.aida64.com/goto/?p=biosupdates
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ South Bridge: Intel Arrow Point Q870 ]
 
South Bridge Properties:
South Bridge  Intel Arrow Point Q870
Revision / Stepping  10 / B0
Package Type  1037 Ball FC-BGA
Package Size  23.5 mm x 28 mm
Process Technology  14 nm
 
High Definition Audio:
Codec Name  Realtek ALC256
Codec ID  10EC0256h / 103C8D17h
Codec Revision  1000h
Codec Type  Audio
 
Chipset Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/products/chipsets
Driver Download  https://www.intel.com/support/chipsets
BIOS Upgrades  http://www.aida64.com/goto/?p=biosupdates
Driver Update  http://www.aida64.com/goto/?p=drvupdates


BIOS
 
BIOS Properties:
BIOS Type  HP UEFI
BIOS Version  X23 Ver. 02.04.10
SMBIOS Version  3.8
UEFI Boot  Yes
Secure Boot  Disabled
System BIOS Date  02/23/2026
Video BIOS Date  Unknown


ACPI
 
[ APIC: Multiple APIC Description Table ]
 
ACPI Table Properties:
ACPI Signature  APIC
Table Description  Multiple APIC Description Table
Memory Address  00000000-71FD6000h
Table Length  856 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
Local APIC Address  FEE00000h
 
Processor Local x2APIC:
x2APIC ID  00000000h
ACPI Processor UID  00000000h
Status  Enabled
 
Processor Local x2APIC:
x2APIC ID  00000008h
ACPI Processor UID  00000001h
Status  Enabled
 
Processor Local x2APIC:
x2APIC ID  00000020h
ACPI Processor UID  00000006h
Status  Enabled
 
Processor Local x2APIC:
x2APIC ID  00000028h
ACPI Processor UID  00000007h
Status  Enabled
 
Processor Local x2APIC:
x2APIC ID  00000030h
ACPI Processor UID  00000008h
Status  Enabled
 
Processor Local x2APIC:
x2APIC ID  00000038h
ACPI Processor UID  00000009h
Status  Enabled
 
Processor Local x2APIC:
x2APIC ID  00000010h
ACPI Processor UID  00000002h
Status  Enabled
 
Processor Local x2APIC:
x2APIC ID  00000012h
ACPI Processor UID  00000003h
Status  Enabled
 
Processor Local x2APIC:
x2APIC ID  00000014h
ACPI Processor UID  00000004h
Status  Enabled
 
Processor Local x2APIC:
x2APIC ID  00000016h
ACPI Processor UID  00000005h
Status  Enabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000000Ah
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000000Bh
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000000Ch
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000000Dh
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000000Eh
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000000Fh
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000010h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000011h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000012h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000013h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000014h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000015h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000016h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000017h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000018h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000019h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000001Ah
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000001Bh
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000001Ch
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000001Dh
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000001Eh
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000001Fh
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000020h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000021h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000022h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000023h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000024h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000025h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000026h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000027h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000028h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  00000029h
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000002Ah
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000002Bh
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000002Ch
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000002Dh
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000002Eh
Status  Disabled
 
Processor Local x2APIC:
x2APIC ID  FFFFFFFFh
ACPI Processor UID  0000002Fh
Status  Disabled
 
I/O APIC:
I/O APIC ID  02h
I/O APIC Address  FEC00000h
Global System Interrupt Base  00000000h
 
Interrupt Source Override:
Bus  ISA
Source  IRQ0
Global System Interrupt  00000002h
Polarity  Conforms to the specifications of the bus
Trigger Mode  Conforms to the specifications of the bus
 
Interrupt Source Override:
Bus  ISA
Source  IRQ9
Global System Interrupt  00000009h
Polarity  Active High
Trigger Mode  Level-Triggered
 
Local x2APIC NMI:
ACPI Processor UID  FFFFFFFFh
Local x2ACPI LINT#  01h
Polarity  Active High
Trigger Mode  Level-Triggered
 
[ ASF!: Alert Standard Format Table ]
 
ACPI Table Properties:
ACPI Signature  ASF!
Table Description  Alert Standard Format Table
Memory Address  00000000-71F5D000h
Table Length  116 bytes
OEM ID  HPQOEM
OEM Table ID  UYAMIHC
OEM Revision  00000002h
Creator Revision  01000013h
 
ASF_INFO:
Min Watchdog Reset Value  255 sec
Min ASF Sensor Interpoll Wait Time  1275 msec
System ID  0001h
IANA Manufacturer ID  00-00-00-0Bh
 
ASF_RCTL:
Number of Controls  4
Array Element Length  4
 
ASF_RMCP:
Remote Control Capabilities  20-70-00-00-00-03-F0h
RMCP Boot Options Completion Code  01h (No options to process)
RMCP IANA Enterprise ID  00-00-00-00h
RMCP Special Command  00h
RMCP Special Command Parameter  0000h
RMCP Boot Options  0000h
RMCP OEM Parameters  0000h
 
[ BGRT: Boot Graphics Resource Table ]
 
ACPI Table Properties:
ACPI Signature  BGRT
Table Description  Boot Graphics Resource Table
Memory Address  00000000-71F5C000h
Table Length  56 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
 
[ DMAR: DMA Remapping Table ]
 
ACPI Table Properties:
ACPI Signature  DMAR
Table Description  DMA Remapping Table
Memory Address  00000000-71F76000h
Table Length  152 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
 
[ DSDT: Differentiated System Description Table ]
 
ACPI Table Properties:
ACPI Signature  DSDT
Table Description  Differentiated System Description Table
Memory Address  00000000-71F83000h
Table Length  332974 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
 
nVIDIA SLI:
SLI Certification  Not Present
PCI 0-0-0-0 (Direct I/O)  8086-7D35 (Intel)
PCI 0-0-0-0 (HAL)  8086-7D35 (Intel)
 
Lucid Virtu:
Virtu Certification  Not Present
 
[ DTPR: DMA TXT Protected Range ]
 
ACPI Table Properties:
ACPI Signature  DTPR
Table Description  DMA TXT Protected Range
Memory Address  00000000-71FEB000h
Table Length  136 bytes
OEM Revision  00000000h
Creator Revision  00000000h
 
[ FACP: Fixed ACPI Description Table ]
 
ACPI Table Properties:
ACPI Signature  FACP
Table Description  Fixed ACPI Description Table
Memory Address  00000000-71FD8000h
Table Length  276 bytes
OEM ID  HPQOEM
OEM Table ID  SLIC-BPC
OEM Revision  00000002h
Creator Revision  01000013h
FACS Address  71E9B000h / 00000000-00000000h
DSDT Address  71F83000h / 00000000-71F83000h
SMI Command Port  00000000h
PM Timer  00001808h
 
[ FACS: Firmware ACPI Control Structure ]
 
ACPI Table Properties:
ACPI Signature  FACS
Table Description  Firmware ACPI Control Structure
Memory Address  71E9B000h
Table Length  64 bytes
Hardware Signature  46697779h
Waking Vector  00000000h
Global Lock  00000000h
 
[ FBPT: Firmware Basic Boot Performance Table ]
 
ACPI Table Properties:
ACPI Signature  FBPT
Table Description  Firmware Basic Boot Performance Table
Memory Address  00000000-6FC8C000h
Table Length  56 bytes
 
[ FPDT: Firmware Performance Data Table ]
 
ACPI Table Properties:
ACPI Signature  FPDT
Table Description  Firmware Performance Data Table
Memory Address  00000000-71F75000h
Table Length  68 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
FBPT Address  00000000-6FC8C000h
S3PT Address  00000000-71CC6000h
 
[ HPET: IA-PC High Precision Event Timer Table ]
 
ACPI Table Properties:
ACPI Signature  HPET
Table Description  IA-PC High Precision Event Timer Table
Memory Address  00000000-71FD7000h
Table Length  56 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
HPET Address  00000000-FED00000h
Vendor ID  8086h
Revision  01h
Number of Timers  3
Counter Size  64-bit
Minimum Clock Ticks  128
Page Protection  No Guarantee
OEM Attribute  0h
LegacyReplacement IRQ Routing  Supported
 
[ LPIT: Low Power Idle Table ]
 
ACPI Table Properties:
ACPI Signature  LPIT
Table Description  Low Power Idle Table
Memory Address  00000000-71F74000h
Table Length  204 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
 
Native C-State Instruction Entry Trigger:
Unique ID  0
Status  Enabled
Minimum Residency  30000 us
Worst Case Exit Latency  3000 us
Residency Counter MSR  00000632h
Residency Counter Frequency  TSC
 
Native C-State Instruction Entry Trigger:
Unique ID  1
Status  Enabled
Minimum Residency  30000 us
Worst Case Exit Latency  3000 us
Residency Counter Frequency  8197
 
Native C-State Instruction Entry Trigger:
Unique ID  2
Status  Disabled
Minimum Residency  30000 us
Worst Case Exit Latency  3000 us
Residency Counter Frequency  8197
 
[ MCFG: Memory Mapped Configuration Space Base Address Description Table ]
 
ACPI Table Properties:
ACPI Signature  MCFG
Table Description  Memory Mapped Configuration Space Base Address Description Table
Memory Address  00000000-71FD5000h
Table Length  60 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
Config Space Address  00000000-C0000000h
PCI Segment  0000h
Start Bus Number  00h
End Bus Number  FFh
 
[ MSDM: Microsoft Data Management Table ]
 
ACPI Table Properties:
ACPI Signature  MSDM
Table Description  Microsoft Data Management Table
Memory Address  00000000-71FFD000h
Table Length  85 bytes
OEM ID  HPQOEM
OEM Table ID  SLIC-BPC
OEM Revision  00000002h
Creator Revision  01000013h
SLS Version  1
SLS Data Type  1
SLS Data Length  29
SLS Data  2BG4Q-PNMMK-WBTRD-G9VTQ-T6PR8
 
[ NHLT: Non-HD Audio Endpoint Description Table ]
 
ACPI Table Properties:
ACPI Signature  NHLT
Table Description  Non-HD Audio Endpoint Description Table
Memory Address  00000000-71F77000h
Table Length  45 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
Endpoint Count  0
 
[ OEML: OEM Specific Information Table ]
 
ACPI Table Properties:
ACPI Signature  OEML
Table Description  OEM Specific Information Table
Memory Address  00000000-71FE7000h
Table Length  40 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
 
[ PHAT: Platform Health Assessment Table ]
 
ACPI Table Properties:
ACPI Signature  PHAT
Table Description  Platform Health Assessment Table
Memory Address  00000000-71F5B000h
Table Length  1090 bytes
OEM ID  HPQOEM
OEM Table ID  SLIC-BPC
OEM Revision  00000005h
Creator ID  MSFT
Creator Revision  0100000Dh
 
[ S3PT: S3 Performance Table ]
 
ACPI Table Properties:
ACPI Signature  S3PT
Table Description  S3 Performance Table
Memory Address  00000000-71CC6000h
Table Length  52 bytes
 
[ SLIC: Software Licensing Description Table ]
 
ACPI Table Properties:
ACPI Signature  SLIC
Table Description  Software Licensing Description Table
Memory Address  00000000-71FDA000h
Table Length  374 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
SLIC Version  v2.1
 
OEM Public Key:
Key Type  06h
Version  02h
Algorithm  00002400h
Magic  RSA1
Bit Length  1024
Exponent  65537
 
SLIC Marker:
Version  00020001h
OEM ID  HPQOEM
OEM Table ID  SLIC-BPC
Windows Flag  WINDOWS
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71F5E000h
Table Length  75 bytes
OEM ID  HP
OEM Table ID  CAPAHWID
OEM Revision  00001000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71F60000h
Table Length  50 bytes
OEM ID  HP
OEM Table ID  HPCONDEV
OEM Revision  00001000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71F61000h
Table Length  26226 bytes
OEM ID  HP
OEM Table ID  HPINT_WL
OEM Revision  00001000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71F68000h
Table Length  11502 bytes
OEM ID  Rtd3
OEM Table ID  MtlS_2DP
OEM Revision  00001000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71F6B000h
Table Length  11150 bytes
OEM ID  PchGpe
OEM Table ID  PchGpe
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71F6E000h
Table Length  10451 bytes
OEM ID  SocCmn
OEM Table ID  SocCmn
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71F71000h
Table Length  9840 bytes
OEM ID  SocGpe
OEM Table ID  SocGpe
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71F78000h
Table Length  12129 bytes
OEM ID  DptfTb
OEM Table ID  DptfTabl
OEM Revision  00001000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71F7B000h
Table Length  24130 bytes
OEM ID  HPQOEM
OEM Table ID  TbtTypeC
OEM Revision  00000000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71F81000h
Table Length  845 bytes
OEM ID  HPQOEM
OEM Table ID  MS-SSDT
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71F82000h
Table Length  4051 bytes
OEM ID  HPQOEM
OEM Table ID  HP_XHC_P
OEM Revision  00000000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FDB000h
Table Length  1673 bytes
OEM ID  HPQOEM
OEM Table ID  HPPATT
OEM Revision  00001000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FDC000h
Table Length  23742 bytes
OEM ID  INTEL
OEM Table ID  TcssSsdt
OEM Revision  00001000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FE2000h
Table Length  9045 bytes
OEM ID  INTEL
OEM Table ID  IgfxSsdt
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FE6000h
Table Length  1531 bytes
OEM ID  HPQOEM
OEM Table ID  Tpm2Tabl
OEM Revision  00001000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FE8000h
Table Length  991 bytes
OEM ID  Intel
OEM Table ID  UcsiAcpi
OEM Revision  00001000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FE9000h
Table Length  135 bytes
OEM ID  INTEL
OEM Table ID  PDatTabl
OEM Revision  00001000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FEA000h
Table Length  318 bytes
OEM ID  HP
OEM Table ID  ShmTable
OEM Revision  00000001h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FEC000h
Table Length  15304 bytes
OEM ID  CpuRef
OEM Table ID  CpuSsdt
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FF0000h
Table Length  4027 bytes
OEM ID  PmRef
OEM Table ID  ApCst
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FF1000h
Table Length  4937 bytes
OEM ID  PmRef
OEM Table ID  ApPsd
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FF3000h
Table Length  5664 bytes
OEM ID  PmRef
OEM Table ID  ApHwp
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FF5000h
Table Length  7087 bytes
OEM ID  PmRef
OEM Table ID  ApIst
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FF7000h
Table Length  916 bytes
OEM ID  PmRef
OEM Table ID  Cpu0Cst
OEM Revision  00003001h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FF8000h
Table Length  427 bytes
OEM ID  PmRef
OEM Table ID  Cpu0Psd
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FF9000h
Table Length  1202 bytes
OEM ID  PmRef
OEM Table ID  Cpu0Hwp
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FFA000h
Table Length  1376 bytes
OEM ID  PmRef
OEM Table ID  Cpu0Ist
OEM Revision  00003000h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FFB000h
Table Length  908 bytes
OEM ID  PmaxDv
OEM Table ID  Pmax_Dev
OEM Revision  00000001h
Creator ID  INTL
Creator Revision  20200717h
 
[ SSDT: Secondary System Description Table ]
 
ACPI Table Properties:
ACPI Signature  SSDT
Table Description  Secondary System Description Table
Memory Address  00000000-71FFC000h
Table Length  302 bytes
OEM ID  INTEL
OEM Table ID  TxtSsdt
OEM Revision  00001000h
Creator ID  INTL
Creator Revision  20200717h
 
[ TPM2: TPM 2.0 Hardware Interface Table ]
 
ACPI Table Properties:
ACPI Signature  TPM2
Table Description  TPM 2.0 Hardware Interface Table
Memory Address  00000000-71FE5000h
Table Length  76 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
 
[ WSMT: Windows SMM Security Mitigations Table ]
 
ACPI Table Properties:
ACPI Signature  WSMT
Table Description  Windows SMM Security Mitigations Table
Memory Address  00000000-71FD9000h
Table Length  40 bytes
OEM ID  HPQOEM
OEM Table ID  ARL
OEM Revision  00000002h
Creator Revision  01000013h
 
[ XSDT: Extended System Description Table ]
 
ACPI Table Properties:
ACPI Signature  XSDT
Table Description  Extended System Description Table
Memory Address  00000000-71F5F228h
Table Length  404 bytes
OEM ID  HPQOEM
OEM Table ID  SLIC-BPC
OEM Revision  00000002h
Creator Revision  01000013h
XSDT Entry #0  00000000-71FD8000h (FACP)
XSDT Entry #1  00000000-71FFC000h (SSDT)
XSDT Entry #2  00000000-71FFB000h (SSDT)
XSDT Entry #3  00000000-71FFA000h (SSDT)
XSDT Entry #4  00000000-71FF9000h (SSDT)
XSDT Entry #5  00000000-71FF8000h (SSDT)
XSDT Entry #6  00000000-71FF7000h (SSDT)
XSDT Entry #7  00000000-71FF5000h (SSDT)
XSDT Entry #8  00000000-71FF3000h (SSDT)
XSDT Entry #9  00000000-71FF1000h (SSDT)
XSDT Entry #10  00000000-71FF0000h (SSDT)
XSDT Entry #11  00000000-71FEC000h (SSDT)
XSDT Entry #12  00000000-71FEB000h (DTPR)
XSDT Entry #13  00000000-71FEA000h (SSDT)
XSDT Entry #14  00000000-71FE9000h (SSDT)
XSDT Entry #15  00000000-71FE8000h (SSDT)
XSDT Entry #16  00000000-71FE7000h (OEML)
XSDT Entry #17  00000000-71FE6000h (SSDT)
XSDT Entry #18  00000000-71FE5000h (TPM2)
XSDT Entry #19  00000000-71FE2000h (SSDT)
XSDT Entry #20  00000000-71FDC000h (SSDT)
XSDT Entry #21  00000000-71FDA000h (SLIC)
XSDT Entry #22  00000000-71FD9000h (WSMT)
XSDT Entry #23  00000000-71FD7000h (HPET)
XSDT Entry #24  00000000-71FD6000h (APIC)
XSDT Entry #25  00000000-71FD5000h (MCFG)
XSDT Entry #26  00000000-71F82000h (SSDT)
XSDT Entry #27  00000000-71F7B000h (SSDT)
XSDT Entry #28  00000000-71F78000h (SSDT)
XSDT Entry #29  00000000-71F77000h (NHLT)
XSDT Entry #30  00000000-71F76000h (DMAR)
XSDT Entry #31  00000000-71F75000h (FPDT)
XSDT Entry #32  00000000-71F81000h (SSDT)
XSDT Entry #33  00000000-71F74000h (LPIT)
XSDT Entry #34  00000000-71F71000h (SSDT)
XSDT Entry #35  00000000-71F6E000h (SSDT)
XSDT Entry #36  00000000-71F6B000h (SSDT)
XSDT Entry #37  00000000-71FFD000h (MSDM)
XSDT Entry #38  00000000-71F68000h (SSDT)
XSDT Entry #39  00000000-71F61000h (SSDT)
XSDT Entry #40  00000000-71F60000h (SSDT)
XSDT Entry #41  00000000-71FDB000h (SSDT)
XSDT Entry #42  00000000-71F5E000h (SSDT)
XSDT Entry #43  00000000-71F5C000h (BGRT)
XSDT Entry #44  00000000-71F5D000h (ASF!)
XSDT Entry #45  00000000-71F5B000h (PHAT)


Operating System
 
Operating System Properties:
OS Name  Microsoft Windows 11 Home
OS Language  English (United States)
OS Installer Language  English (United States)
OS Kernel Type  Multiprocessor Free (64-bit)
OS Version  10.0.26200.8037 (Win11 25H2 2025 Update)
OS Service Pack  -
OS Installation Date  7/14/2026
OS Root  C:\WINDOWS
 
License Information:
Registered Owner  Marius
Registered Organization  
Product ID  00342-22722-31529-AAOEM
Product Key  2BG4Q-PNMMK-WBTRD-G9VTQ-T6PR8
Product Activation (WPA)  Required
 
Current Session:
Computer Name  DESKTOP-M1V6K8T
User Name  Marius
Logon Domain  DESKTOP-M1V6K8T
UpTime  144 sec (0 days, 0 hours, 2 min, 24 sec)
 
Components Version:
Common Controls  6.16
Windows Mail  -
Windows Media Player  12.0.26100.1 (WinBuild.160101.0800)
Windows Messenger  -
MSN Messenger  -
Internet Information Services (IIS)  -
.NET Framework  4.8.9319.0 built by: NET481REL1LAST_25H2_B
Novell Client  -
DirectX  DirectX 12.0
OpenGL  10.0.26100.7920 (WinBuild.160101.0800)
ASPI  -
 
Operating System Features:
Debug Version  No
DBCS Version  No
Domain Controller  No
Security Present  No
Network Present  Yes
Remote Session  No
Safe Mode  No
Slow Processor  No
Terminal Services  Yes


Processes
 
Process Name  Process File Name  Type  Used Memory  Used Swap
AggregatorHost.exe  C:\WINDOWS\System32\AggregatorHost.exe  64-bit  11632 KB  2 KB
aida64.exe  C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe  64-bit  337 MB  300 KB
audiodg.exe  C:\WINDOWS\system32\AUDIODG.EXE  64-bit  15912 KB  6 KB
CrossDeviceResume.exe  C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\CrossDeviceResume.exe  64-bit  50192 KB  8 KB
csrss.exe  C:\WINDOWS\system32\csrss.exe  64-bit  7780 KB  2 KB
csrss.exe  C:\WINDOWS\system32\csrss.exe  64-bit  7612 KB  2 KB
ctfmon.exe  C:\WINDOWS\system32\ctfmon.exe  64-bit  27668 KB  6 KB
dllhost.exe  C:\WINDOWS\system32\DllHost.exe  64-bit  10340 KB  2 KB
dwm.exe  C:\WINDOWS\system32\dwm.exe  64-bit  108 MB  63 KB
explorer.exe  C:\WINDOWS\Explorer.EXE  64-bit  257 MB  91 KB
fontdrvhost.exe  C:\WINDOWS\system32\fontdrvhost.exe  64-bit  4896 KB  1 KB
fontdrvhost.exe  C:\WINDOWS\system32\fontdrvhost.exe  64-bit  8652 KB  3 KB
lsass.exe  C:\WINDOWS\system32\lsass.exe  64-bit  25752 KB  5 KB
Memory Compression    64-bit  0 KB  0 KB
MicrosoftEdgeUpdate.exe  C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe  64-bit  2632 KB  2 KB
MidiSrv.exe  C:\WINDOWS\system32\midisrv.exe  64-bit  33744 KB  10 KB
MoUsoCoreWorker.exe  C:\WINDOWS\uus\packages\preview\AMD64\MoUsoCoreWorker.exe  64-bit  31768 KB  5 KB
msedge.exe  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe  64-bit  9376 KB  2 KB
msedge.exe  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe  64-bit  113 MB  33 KB
msedge.exe  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe  64-bit  32276 KB  11 KB
msedge.exe  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe  64-bit  29084 KB  12 KB
msedge.exe  C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe  64-bit  17776 KB  8 KB
msedgewebview2.exe  C:\Program Files (x86)\Microsoft\EdgeWebView\Application\145.0.3800.97\msedgewebview2.exe  64-bit  45416 KB  16 KB
msedgewebview2.exe  C:\Program Files (x86)\Microsoft\EdgeWebView\Application\145.0.3800.97\msedgewebview2.exe  64-bit  122 MB  40 KB
msedgewebview2.exe  C:\Program Files (x86)\Microsoft\EdgeWebView\Application\145.0.3800.97\msedgewebview2.exe  64-bit  18956 KB  8 KB
msedgewebview2.exe  C:\Program Files (x86)\Microsoft\EdgeWebView\Application\145.0.3800.97\msedgewebview2.exe  64-bit  115 MB  37 KB
msedgewebview2.exe  C:\Program Files (x86)\Microsoft\EdgeWebView\Application\145.0.3800.97\msedgewebview2.exe  64-bit  9284 KB  2 KB
msedgewebview2.exe  C:\Program Files (x86)\Microsoft\EdgeWebView\Application\145.0.3800.97\msedgewebview2.exe  64-bit  19168 KB  8 KB
msedgewebview2.exe  C:\Program Files (x86)\Microsoft\EdgeWebView\Application\145.0.3800.97\msedgewebview2.exe  64-bit  46324 KB  17 KB
msedgewebview2.exe  C:\Program Files (x86)\Microsoft\EdgeWebView\Application\145.0.3800.97\msedgewebview2.exe  64-bit  33320 KB  11 KB
msedgewebview2.exe  C:\Program Files (x86)\Microsoft\EdgeWebView\Application\145.0.3800.97\msedgewebview2.exe  64-bit  97 MB  59 KB
msedgewebview2.exe  C:\Program Files (x86)\Microsoft\EdgeWebView\Application\145.0.3800.97\msedgewebview2.exe  64-bit  89572 KB  48 KB
msedgewebview2.exe  C:\Program Files (x86)\Microsoft\EdgeWebView\Application\145.0.3800.97\msedgewebview2.exe  64-bit  9600 KB  2 KB
msedgewebview2.exe  C:\Program Files (x86)\Microsoft\EdgeWebView\Application\145.0.3800.97\msedgewebview2.exe  64-bit  32980 KB  11 KB
MsMpEng.exe    64-bit  311 MB  308 KB
NisSrv.exe    64-bit  25048 KB  6 KB
Notepad.exe  C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_11.2501.31.0_x64__8wekyb3d8bbwe\Notepad\Notepad.exe  64-bit  89 MB  24 KB
OneDrive.exe  C:\Users\Marius\AppData\Local\Microsoft\OneDrive\OneDrive.exe  64-bit  115 MB  42 KB
Registry    64-bit  65624 KB  7 KB
RuntimeBroker.exe  C:\Windows\System32\RuntimeBroker.exe  64-bit  42660 KB  6 KB
RuntimeBroker.exe  C:\Windows\System32\RuntimeBroker.exe  64-bit  26364 KB  3 KB
SearchFilterHost.exe  C:\WINDOWS\System32\SearchFilterHost.exe  64-bit  16440 KB  2 KB
SearchHost.exe  C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe  64-bit  114 MB  32 KB
SearchIndexer.exe  C:\WINDOWS\system32\SearchIndexer.exe  64-bit  25556 KB  11 KB
SearchProtocolHost.exe  C:\WINDOWS\System32\SearchProtocolHost.exe  64-bit  19916 KB  3 KB
SecurityHealthService.exe  C:\WINDOWS\system32\SecurityHealthService.exe  64-bit  22296 KB  4 KB
SecurityHealthSystray.exe  C:\Windows\System32\SecurityHealthSystray.exe  64-bit  13252 KB  1 KB
services.exe  C:\WINDOWS\system32\services.exe  64-bit  11748 KB  4 KB
ShellExperienceHost.exe  C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe  64-bit  71556 KB  13 KB
ShellHost.exe  C:\Windows\System32\ShellHost.exe  64-bit  41928 KB  6 KB
sihost.exe  C:\WINDOWS\system32\sihost.exe  64-bit  48228 KB  6 KB
smartscreen.exe  C:\Windows\System32\smartscreen.exe  64-bit  12972 KB  2 KB
smss.exe  C:\WINDOWS\system32\smss.exe  64-bit  1680 KB  1 KB
spoolsv.exe  C:\WINDOWS\System32\spoolsv.exe  64-bit  21236 KB  5 KB
sppsvc.exe  C:\WINDOWS\system32\sppsvc.exe  64-bit  19732 KB  8 KB
StartMenuExperienceHost.exe  C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe  64-bit  128 MB  46 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  34832 KB  8 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  17964 KB  6 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  10652 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  28580 KB  4 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  12868 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  20728 KB  5 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  9584 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  9424 KB  3 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  10120 KB  1 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  11560 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  10768 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  46480 KB  34 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  10084 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  22668 KB  4 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  13288 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  15556 KB  2 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  17676 KB  4 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  10040 KB  1 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  17236 KB  6 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  7868 KB  1 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  9900 KB  1 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  21056 KB  3 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  12428 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  13152 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  8332 KB  1 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  28880 KB  22 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  12616 KB  2 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  7884 KB  1 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  18652 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  10908 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  11684 KB  2 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  25124 KB  3 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  11556 KB  1 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  11532 KB  2 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  18776 KB  3 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  11080 KB  2 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  12356 KB  2 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  19580 KB  3 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  9336 KB  1 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  24528 KB  10 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  10716 KB  2 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  18456 KB  7 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  15928 KB  3 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  23452 KB  9 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  7812 KB  1 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  49268 KB  15 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  21048 KB  3 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  14696 KB  4 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  12868 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  10724 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  41800 KB  8 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  27084 KB  3 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  20820 KB  4 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  17820 KB  3 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  186 MB  185 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  10324 KB  1 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  15016 KB  2 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  11436 KB  2 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  13176 KB  2 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  19448 KB  2 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  9572 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  30948 KB  8 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  30776 KB  4 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  15632 KB  3 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  28616 KB  3 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  18856 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  13956 KB  3 KB
svchost.exe  C:\WINDOWS\System32\svchost.exe  64-bit  27964 KB  10 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  14084 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  10628 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  22948 KB  4 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  9008 KB  2 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  34208 KB  21 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  16524 KB  3 KB
svchost.exe  C:\WINDOWS\system32\svchost.exe  64-bit  5908 KB  1 KB
System Idle Process      8 KB  0 KB
System    64-bit  168 KB  0 KB
taskhostw.exe  C:\WINDOWS\system32\taskhostw.exe  64-bit  17920 KB  4 KB
taskhostw.exe  C:\WINDOWS\system32\taskhostw.exe  64-bit  9152 KB  1 KB
Widgets.exe  C:\Program Files\WindowsApps\MicrosoftWindows.Client.WebExperience_525.31002.150.9_x64__cw5n1h2txyewy\Dashboard\Widgets.exe  64-bit  58956 KB  8 KB
wininit.exe  C:\WINDOWS\system32\wininit.exe  64-bit  9680 KB  1 KB
winlogon.exe  C:\WINDOWS\system32\winlogon.exe  64-bit  17196 KB  2 KB
WmiPrvSE.exe  C:\WINDOWS\system32\wbem\wmiprvse.exe  64-bit  19240 KB  6 KB
WmiPrvSE.exe  C:\WINDOWS\system32\wbem\wmiprvse.exe  64-bit  12200 KB  2 KB


System Drivers
 
Driver Name  Driver Description  File Name  Version  Type  State
1394ohci  1394 OHCI Compliant Host Controller  1394ohci.sys  10.0.26100.1150  Kernel Driver  Stopped
3ware  3ware  3ware.sys  5.1.0.51  Kernel Driver  Stopped
ACPI  Microsoft ACPI Driver  ACPI.sys  10.0.26100.7920  Kernel Driver  Running
AcpiAudioCompositorInbox  ACPI Audio Compositor Driver  AcpiAudioCompositor.sys  10.0.26100.5074  Kernel Driver  Stopped
AcpiDev  ACPI Devices driver  AcpiDev.sys  10.0.26100.6725  Kernel Driver  Stopped
acpiex  Microsoft ACPIEx Driver  acpiex.sys  10.0.26100.1150  Kernel Driver  Running
acpipagr  ACPI Processor Aggregator Driver  acpipagr.sys  10.0.26100.1150  Kernel Driver  Running
AcpiPmi  ACPI Power Meter Driver  acpipmi.sys  10.0.26100.1150  Kernel Driver  Stopped
acpitime  ACPI Wake Alarm Driver  acpitime.sys  10.0.26100.1150  Kernel Driver  Running
Acx01000  Acx01000  Acx01000.sys  10.0.26100.7920  Kernel Driver  Stopped
ADP80XX  ADP80XX  ADP80XX.SYS  1.3.0.10769  Kernel Driver  Stopped
AFD  Ancillary Function Driver for Winsock  afd.sys  10.0.26100.8036  Kernel Driver  Running
afunix  afunix  afunix.sys  10.0.26100.6725  Kernel Driver  Running
ahcache  Application Compatibility Cache  ahcache.sys  10.0.26100.7920  Kernel Driver  Running
AIDA64Driver  FinalWire AIDA64 Kernel Driver  kerneld-x64.sys  3.0.1021.0  Kernel Driver  Running
amdgpio2  AMD GPIO Client Driver  amdgpio2.sys  2.2.0.71  Kernel Driver  Stopped
amdi2c  AMD I2C Controller Service  amdi2c.sys  1.2.0.99  Kernel Driver  Stopped
AmdK8  AMD K8 Processor Driver  amdk8.sys  10.0.26100.7920  Kernel Driver  Stopped
AmdPPM  AMD Processor Driver  amdppm.sys  10.0.26100.7920  Kernel Driver  Stopped
amdsata  amdsata  amdsata.sys  1.1.3.277  Kernel Driver  Stopped
amdsbs  amdsbs  amdsbs.sys  3.7.1540.43  Kernel Driver  Stopped
amdwps  AMD Workload Profiling Scheduling Driver  amdwps.sys  10.0.26100.1150  Kernel Driver  Running
amdxata  amdxata  amdxata.sys  1.1.3.277  Kernel Driver  Stopped
AppID  AppID Driver  appid.sys  10.0.26100.7920  Kernel Driver  Running
AppleSSD  Apple Solid State Drive Device  AppleSSD.sys  6.1.7800.1  Kernel Driver  Stopped
applockerfltr  Smartlocker Filter Driver  applockerfltr.sys  10.0.26100.7920  Kernel Driver  Running
arcsas  Adaptec SAS/SATA-II RAID Storport's Miniport Driver  arcsas.sys  7.5.0.32048  Kernel Driver  Stopped
AsyncMac  RAS Asynchronous Media Driver  asyncmac.sys  10.0.26100.1150  Kernel Driver  Stopped
atapi  IDE Channel  atapi.sys  10.0.26100.7920  Kernel Driver  Stopped
b06bdrv  QLogic Network Adapter VBD  bxvbda.sys  7.12.31.105  Kernel Driver  Stopped
bam  Background Activity Moderator Driver  bam.sys  10.0.26100.7920  Kernel Driver  Running
BasicDisplay  BasicDisplay  BasicDisplay.sys  10.0.26100.4202  Kernel Driver  Running
BasicRender  BasicRender  BasicRender.sys  10.0.26100.7920  Kernel Driver  Running
bcmfn2  bcmfn2 Service  bcmfn2.sys  6.3.9600.17336  Kernel Driver  Stopped
Beep  Beep      Kernel Driver  Running
bfs  Brokering File System  bfs.sys  10.0.26100.8036  File System Driver  Running
bindflt  Windows Bind Filter Driver  bindflt.sys  10.0.26100.7705  File System Driver  Running
bowser  Browser  bowser.sys  10.0.26100.7920  File System Driver  Running
BthA2dp  Microsoft Bluetooth A2dp driver  BthA2dp.sys  10.0.26100.7920  Kernel Driver  Stopped
BthEnum  Bluetooth Enumerator Service  BthEnum.sys  10.0.26100.7920  Kernel Driver  Stopped
BthHFEnum  Microsoft Bluetooth Hands-Free Profile driver  bthhfenum.sys  10.0.26100.7920  Kernel Driver  Stopped
BthLEEnum  Bluetooth Low Energy Driver  Microsoft.Bluetooth.Legacy.LEEnumerator.sys  10.0.26100.7920  Kernel Driver  Stopped
BthMini  Bluetooth Radio Driver  BTHMINI.sys  10.0.26100.7920  Kernel Driver  Stopped
BTHMODEM  Bluetooth Modem Communications Driver  bthmodem.sys  10.0.26100.5074  Kernel Driver  Stopped
BTHPORT  Bluetooth Port Driver  BTHport.sys  10.0.26100.7920  Kernel Driver  Stopped
BTHUSB  Bluetooth Radio USB Driver  BTHUSB.sys  10.0.26100.7920  Kernel Driver  Stopped
bttflt  Microsoft Hyper-V VHDPMEM BTT Filter  bttflt.sys  10.0.26100.1150  Kernel Driver  Stopped
buttonconverter  Service for Portable Device Control devices  buttonconverter.sys  10.0.26100.4484  Kernel Driver  Stopped
CAD  Charge Arbitration Driver  CAD.sys  10.0.26100.7920  Kernel Driver  Stopped
CDD  Canonical Display Driver  cdd.dll  10.0.26100.7920  Kernel Driver  Running
cdfs  CD/DVD File System Reader  cdfs.sys  10.0.26100.1150  File System Driver  Stopped
cdrom  CD-ROM Driver  cdrom.sys  10.0.26100.1150  Kernel Driver  Running
cht4iscsi  cht4iscsi  cht4sx64.sys  6.11.4.100  Kernel Driver  Stopped
cht4vbd  Chelsio Virtual Bus Driver  cht4vx64.sys  6.11.4.100  Kernel Driver  Stopped
CimFS  CimFS      File System Driver  Running
circlass  Consumer IR Devices  circlass.sys  10.0.26100.1150  Kernel Driver  Stopped
CldFlt  Windows Cloud Files Filter Driver  cldflt.sys  10.0.26100.7920  File System Driver  Running
CLFS  Common Log (CLFS)  CLFS.sys  10.0.26100.7920  Kernel Driver  Running
CmBatt  Microsoft ACPI Control Method Battery Driver  CmBatt.sys  10.0.26100.7920  Kernel Driver  Stopped
CNG  CNG  cng.sys  10.0.26100.7920  Kernel Driver  Running
cnghwassist  CNG Hardware Assist algorithm provider  cnghwassist.sys  10.0.26100.1150  Kernel Driver  Stopped
CompositeBus  Composite Bus Enumerator Driver  CompositeBus.sys  10.0.26100.1150  Kernel Driver  Running
condrv  Console Driver  condrv.sys  10.0.26100.1150  Kernel Driver  Running
dam  Desktop Activity Moderator Driver  dam.sys  10.0.26100.7920  Kernel Driver  Running
devmap  Usermode Device Mapper Service  devmap.sys  10.0.26100.1150  Kernel Driver  Stopped
Dfsc  DFS Namespace Client Driver  dfsc.sys  10.0.26100.5074  File System Driver  Running
disk  Disk Driver  disk.sys  10.0.26100.7705  Kernel Driver  Running
DisplayMux  Microsoft DisplayMux  DisplayMux.sys  10.0.26100.1150  Kernel Driver  Stopped
dmvsc  dmvsc  dmvsc.sys  10.0.26100.5074  Kernel Driver  Stopped
drmkaud  Microsoft Trusted Audio Drivers  drmkaud.sys  10.0.26100.7920  Kernel Driver  Stopped
DXGKrnl  LDDM Graphics Subsystem  dxgkrnl.sys  10.0.26100.7920  Kernel Driver  Running
e1i68x64  Intel(R) PRO/1000 PCI Express Network Connection Driver I  e1i68x64.sys  12.19.1.32  Kernel Driver  Running
ebdrv  QLogic 10 Gigabit Ethernet Adapter VBD  evbda.sys  7.13.171.102  Kernel Driver  Stopped
ebdrv0  QLogic Legacy Ethernet Adapter VBD  evbd0a.sys  7.13.65.105  Kernel Driver  Stopped
EhStorClass  Enhanced Storage Filter Driver  EhStorClass.sys  10.0.26100.4484  Kernel Driver  Running
EhStorTcgDrv  Microsoft driver for storage devices supporting IEEE 1667 and TCG protocols  EhStorTcgDrv.sys  10.0.26100.1150  Kernel Driver  Stopped
ErrDev  Microsoft Hardware Error Device Driver  errdev.sys  10.0.26100.1150  Kernel Driver  Stopped
ExecutionContext  CPU Scheduler for High Performance I/O  ExecutionContext.sys  10.0.26100.7920  Kernel Driver  Stopped
exfat  exFAT File System Driver      File System Driver  Running
fastfat  FAT12/16/32 File System Driver      File System Driver  Running
fdc  Floppy Disk Controller Driver  fdc.sys  10.0.26100.1150  Kernel Driver  Stopped
FileCrypt  FileCrypt  filecrypt.sys  10.0.26100.1150  File System Driver  Running
FileInfo  File Information FS MiniFilter  fileinfo.sys  10.0.26100.1150  File System Driver  Running
Filetrace  Filetrace  filetrace.sys  10.0.26100.4202  File System Driver  Stopped
flpydisk  Floppy Disk Driver  flpydisk.sys  10.0.26100.7019  Kernel Driver  Stopped
FltMgr  FltMgr  fltmgr.sys  10.0.26100.7920  File System Driver  Running
FsDepends  File System Dependency Minifilter  FsDepends.sys  10.0.26100.1882  File System Driver  Stopped
fvevol  BitLocker Drive Encryption Filter Driver  fvevol.sys  10.0.26100.7920  Kernel Driver  Running
gencounter  Microsoft Hyper-V Generation Counter  vmgencounter.sys  10.0.26100.1150  Kernel Driver  Stopped
genericusbfn  Generic USB Function Class  genericusbfn.sys  10.0.26100.4202  Kernel Driver  Stopped
GenPass  Microsoft GenPass Driver  genpass.sys  10.0.26100.1150  Kernel Driver  Stopped
GPIOClx0101  Microsoft GPIO Class Extension Driver  msgpioclx.sys  10.0.26100.6725  Kernel Driver  Stopped
HdAudAddService  Microsoft 1.1 UAA Function Driver for High Definition Audio Service  HdAudio.sys  10.0.26100.8036  Kernel Driver  Running
HDAudBus  Microsoft UAA Bus Driver for High Definition Audio  HDAudBus.sys  10.0.26100.7920  Kernel Driver  Running
HidBatt  HID UPS Battery Driver  HidBatt.sys  10.0.26100.1150  Kernel Driver  Stopped
HidBth  Microsoft Bluetooth HID Miniport  hidbth.sys  10.0.26100.1150  Kernel Driver  Stopped
hidi2c  Microsoft I2C HID Miniport Driver  hidi2c.sys  10.0.26100.7920  Kernel Driver  Stopped
hidinterrupt  Common Driver for HID Buttons implemented with interrupts  hidinterrupt.sys  10.0.26100.1150  Kernel Driver  Stopped
HidIr  Microsoft Infrared HID Driver  hidir.sys  10.0.26100.1150  Kernel Driver  Stopped
hidspi  Microsoft SPI HID Miniport Driver  hidspi.sys  10.0.26100.7920  Kernel Driver  Stopped
HidSpiCx  HidSpi KMDF Class Extension  HidSpiCx.sys  10.0.26100.7920  Kernel Driver  Stopped
HidUsb  Microsoft HID Class Driver  hidusb.sys  10.0.26100.7920  Kernel Driver  Running
HpSAMD  HpSAMD  HpSAMD.sys  8.0.4.0  Kernel Driver  Stopped
Hsp  Microsoft Pluton Service  Hsp.sys  10.0.26100.3624  Kernel Driver  Stopped
HTTP  HTTP Service  HTTP.sys  10.0.26100.7920  Kernel Driver  Running
hvcrash  hvcrash  hvcrash.sys  10.0.26100.3912  Kernel Driver  Stopped
hvservice  Microsoft Hypervisor Service Driver  hvservice.sys  10.0.26100.7309  Kernel Driver  Stopped
HwNClx0101  Microsoft Hardware Notifications Class Extension Driver  mshwnclx.sys  10.0.26100.1150  Kernel Driver  Stopped
hwpolicy  Hardware Policy Driver  hwpolicy.sys  10.0.26100.4202  Kernel Driver  Stopped
hyperkbd  hyperkbd  hyperkbd.sys  10.0.26100.1150  Kernel Driver  Stopped
HyperVideo  HyperVideo  HyperVideo.sys  10.0.26100.1150  Kernel Driver  Stopped
I3CHost  I3C Host Controller Service  i3chost.sys  10.0.26100.7920  Kernel Driver  Stopped
i8042prt  i8042 Keyboard and PS/2 Mouse Port Driver  i8042prt.sys  10.0.26100.1882  Kernel Driver  Stopped
iagpio  Intel Serial IO GPIO Controller Driver  iagpio.sys  1.1.1.0  Kernel Driver  Stopped
iai2c  Intel(R) Serial IO I2C Host Controller  iai2c.sys  1.1.1.0  Kernel Driver  Stopped
iaLPSS2i_GPIO2_BXT_P  Intel(R) Serial IO GPIO Driver v2  iaLPSS2i_GPIO2_BXT_P.sys  30.100.1816.1  Kernel Driver  Stopped
iaLPSS2i_GPIO2_CNL  Intel(R) Serial IO GPIO Driver v2  iaLPSS2i_GPIO2_CNL.sys  30.100.1816.3  Kernel Driver  Stopped
iaLPSS2i_GPIO2_GLK  Intel(R) Serial IO GPIO Driver v2  iaLPSS2i_GPIO2_GLK.sys  30.100.1820.1  Kernel Driver  Stopped
iaLPSS2i_GPIO2  Intel(R) Serial IO GPIO Driver v2  iaLPSS2i_GPIO2.sys  30.100.1816.3  Kernel Driver  Stopped
iaLPSS2i_I2C_BXT_P  Intel(R) Serial IO I2C Driver v2  iaLPSS2i_I2C_BXT_P.sys  30.100.1816.1  Kernel Driver  Stopped
iaLPSS2i_I2C_CNL  Intel(R) Serial IO I2C Driver v2  iaLPSS2i_I2C_CNL.sys  30.100.1929.1  Kernel Driver  Stopped
iaLPSS2i_I2C_GLK  Intel(R) Serial IO I2C Driver v2  iaLPSS2i_I2C_GLK.sys  30.100.1820.1  Kernel Driver  Stopped
iaLPSS2i_I2C  Intel(R) Serial IO I2C Driver v2  iaLPSS2i_I2C.sys  30.100.1816.3  Kernel Driver  Stopped
iaLPSSi_GPIO  Intel(R) Serial IO GPIO Controller Driver  iaLPSSi_GPIO.sys  1.1.250.0  Kernel Driver  Stopped
iaLPSSi_I2C  Intel(R) Serial IO I2C Controller Driver  iaLPSSi_I2C.sys  1.1.253.0  Kernel Driver  Stopped
iaStorAVC  Intel Chipset SATA RAID Controller  iaStorAVC.sys  15.44.0.1015  Kernel Driver  Stopped
iaStorV  Intel RAID Controller Windows 7  iaStorV.sys  8.6.2.1019  Kernel Driver  Stopped
ibbus  Mellanox InfiniBand Bus/AL (Filter Driver)  ibbus.sys  5.50.14695.0  Kernel Driver  Stopped
IndirectKmd  Indirect Displays Kernel-Mode Driver  IndirectKmd.sys  10.0.26100.7920  Kernel Driver  Stopped
intelide  intelide  intelide.sys  10.0.26100.7920  Kernel Driver  Stopped
intelpep  Intel(R) Power Engine Plug-in Driver  intelpep.sys  10.0.26100.7920  Kernel Driver  Running
intelpmax  Intel(R) Dynamic Device Peak Power Manager Driver  intelpmax.sys  10.0.26100.1150  Kernel Driver  Stopped
IntelPMT  Intel(R) Platform Monitoring Technology Service  IntelPMT.sys  10.0.26100.3624  Kernel Driver  Running
intelppm  Intel Processor Driver  intelppm.sys  10.0.26100.7920  Kernel Driver  Running
iorate  Disk I/O Rate Filter Driver  iorate.sys  10.0.26100.1150  Kernel Driver  Running
IpFilterDriver  IP Traffic Filter Driver  ipfltdrv.sys  10.0.26100.7705  Kernel Driver  Stopped
IPMIDRV  IPMIDRV  IPMIDrv.sys  10.0.26100.7019  Kernel Driver  Stopped
IPNAT  IP Network Address Translator  ipnat.sys  10.0.26100.4202  Kernel Driver  Stopped
IPT  IPT  ipt.sys  10.0.26100.1150  Kernel Driver  Stopped
isapnp  isapnp  isapnp.sys  10.0.26100.1150  Kernel Driver  Stopped
iScsiPrt  iScsiPort Driver  msiscsi.sys  10.0.26100.4202  Kernel Driver  Stopped
ItSas35i  ItSas35i  ItSas35i.sys  2.61.29.80  Kernel Driver  Stopped
kbdclass  Keyboard Class Driver  kbdclass.sys  10.0.26100.1882  Kernel Driver  Running
kbdhid  Keyboard HID Driver  kbdhid.sys  10.0.26100.1882  Kernel Driver  Running
kdnic_legacy  Microsoft Kernel Debug Network Miniport (NDIS 6.20)  kdnic_legacy.sys  6.1.0.0  Kernel Driver  Stopped
kdnic  Microsoft Kernel Debug Network Miniport  kdnic.sys  6.2.1.0  Kernel Driver  Running
KSecDD  KSecDD  ksecdd.sys  10.0.26100.7920  Kernel Driver  Running
KSecPkg  KSecPkg  ksecpkg.sys  10.0.26100.8036  Kernel Driver  Running
KslD  KslD  KslD.sys  1.1.25081.3013  Kernel Driver  Running
ksthunk  Kernel Streaming Thunks  ksthunk.sys  10.0.26100.7920  Kernel Driver  Running
lltdio  Link-Layer Topology Discovery Mapper I/O Driver  lltdio.sys  10.0.26100.7920  Kernel Driver  Running
LSI_SAS  LSI_SAS  lsi_sas.sys  1.34.3.83  Kernel Driver  Stopped
LSI_SAS2i  LSI_SAS2i  lsi_sas2i.sys  2.0.79.82  Kernel Driver  Stopped
LSI_SAS3i  LSI_SAS3i  lsi_sas3i.sys  2.51.27.80  Kernel Driver  Stopped
luafv  UAC File Virtualization  luafv.sys  10.0.26100.7920  File System Driver  Running
mausbhost  MA-USB Host Controller Driver  mausbhost.sys  10.0.26100.7920  Kernel Driver  Stopped
mausbip  MA-USB IP Filter Driver  mausbip.sys  10.0.26100.7920  Kernel Driver  Stopped
MbbCx  MBB Network Adapter Class Extension  MbbCx.sys  10.0.26100.8036  Kernel Driver  Stopped
megasas2i  megasas2i  MegaSas2i.sys  6.714.22.0  Kernel Driver  Stopped
megasas35i  megasas35i  megasas35i.sys  7.717.2.0  Kernel Driver  Stopped
megasr  megasr  megasr.sys  15.2.2013.129  Kernel Driver  Stopped
Microsoft_Bluetooth_AvrcpTransport  Microsoft Bluetooth Avrcp Transport Driver  Microsoft.Bluetooth.AvrcpTransport.sys  10.0.26100.7705  Kernel Driver  Stopped
mlx4_bus  Mellanox ConnectX Bus Enumerator  mlx4_bus.sys  5.50.14695.0  Kernel Driver  Stopped
MMCSS  Multimedia Class Scheduler  mmcss.sys  10.0.26100.7309  Kernel Driver  Running
Modem  Modem  modem.sys  10.0.26100.4202  Kernel Driver  Stopped
monitor  Microsoft Monitor Class Function Driver Service  monitor.sys  10.0.26100.7309  Kernel Driver  Running
mouclass  Mouse Class Driver  mouclass.sys  10.0.26100.1150  Kernel Driver  Running
mouhid  Mouse HID Driver  mouhid.sys  10.0.26100.1150  Kernel Driver  Running
mountmgr  Mount Point Manager  mountmgr.sys  10.0.26100.5074  Kernel Driver  Running
mpi3drvi  mpi3drvi  mpi3drvi.sys  3.0.71.90  Kernel Driver  Stopped
mpsdrv  Windows Defender Firewall Authorization Driver  mpsdrv.sys  10.0.26100.1150  Kernel Driver  Running
MRxDAV  WebDav Client Redirector Driver  mrxdav.sys  10.0.26100.1150  File System Driver  Stopped
mrxsmb  SMB MiniRedirector Wrapper and Engine  mrxsmb.sys  10.0.26100.7920  File System Driver  Running
mrxsmb20  SMB 2.0 MiniRedirector  mrxsmb20.sys  10.0.26100.7920  File System Driver  Running
MsBridge  Microsoft MAC Bridge  bridge.sys  10.0.26100.2454  Kernel Driver  Stopped
Msfs  Msfs      File System Driver  Running
msgpiowin32  Common Driver for Buttons, DockMode and Laptop/Slate Indicator  msgpiowin32.sys  10.0.26100.1150  Kernel Driver  Stopped
mshidkmdf  Pass-through HID to KMDF Filter Driver  mshidkmdf.sys  10.0.26100.1150  Kernel Driver  Stopped
mshidumdf  Pass-through HID to UMDF Driver  mshidumdf.sys  10.0.26100.1150  Kernel Driver  Stopped
msisadrv  msisadrv  msisadrv.sys  10.0.26100.1150  Kernel Driver  Running
MSKSSRV  Microsoft Streaming Service Proxy  MSKSSRV.sys  10.0.26100.7920  Kernel Driver  Stopped
MsLldp  Microsoft Link-Layer Discovery Protocol  mslldp.sys  10.0.26100.1150  Kernel Driver  Running
MSPCLOCK  Microsoft Streaming Clock Proxy  MSPCLOCK.sys  10.0.26100.4202  Kernel Driver  Stopped
MSPQM  Microsoft Streaming Quality Manager Proxy  MSPQM.sys  10.0.26100.4202  Kernel Driver  Stopped
MsQuic  MsQuic  msquic.sys  2.5.5.0  Kernel Driver  Stopped
MsQuicPrev  MSQUIC  msquicprev.sys  2.4.11.0  Kernel Driver  Stopped
MsRPC  MsRPC      Kernel Driver  Stopped
mssmbios  Microsoft System Management BIOS Driver  mssmbios.sys  10.0.26100.1  Kernel Driver  Running
MSTEE  Microsoft Streaming Tee/Sink-to-Sink Converter  MSTEE.sys  10.0.26100.4202  Kernel Driver  Stopped
MTConfig  Microsoft Input Configuration Driver  MTConfig.sys  10.0.26100.1150  Kernel Driver  Stopped
Mup  Mup  mup.sys  10.0.26100.8036  File System Driver  Running
mvumis  mvumis  mvumis.sys  1.0.5.1016  Kernel Driver  Stopped
NativeWifiP  NativeWiFi Filter  nwifi.sys  10.0.26100.7920  Kernel Driver  Stopped
ndfltr  NetworkDirect Service  ndfltr.sys  5.50.14695.0  Kernel Driver  Stopped
NDIS  NDIS System Driver  ndis.sys  10.0.26100.8036  Kernel Driver  Running
NdisCap  Microsoft NDIS Capture  ndiscap.sys  10.0.26100.4484  Kernel Driver  Running
NdisImPlatform  Microsoft Network Adapter Multiplexor Protocol  NdisImPlatform.sys  10.0.26100.4202  Kernel Driver  Stopped
NdisTapi  Remote Access NDIS TAPI Driver  ndistapi.sys  10.0.26100.7920  Kernel Driver  Stopped
Ndisuio  NDIS Usermode I/O Protocol  ndisuio.sys  10.0.26100.1150  Kernel Driver  Stopped
NdisVirtualBus  Microsoft Virtual Network Adapter Enumerator  NdisVirtualBus.sys  10.0.26100.1150  Kernel Driver  Running
NdisWan  Remote Access NDIS WAN Driver  ndiswan.sys  10.0.26100.7920  Kernel Driver  Stopped
ndiswanlegacy  Remote Access LEGACY NDIS WAN Driver  ndiswan.sys  10.0.26100.7920  Kernel Driver  Stopped
NDKPerf  NDKPerf Driver  NDKPerf.sys    Kernel Driver  Stopped
NDKPing  NDKPing Driver  NDKPing.sys  10.0.26100.1150  Kernel Driver  Stopped
ndproxy  NDIS Proxy Driver  NDProxy.sys  10.0.26100.7920  Kernel Driver  Stopped
Ndu  Windows Network Data Usage Monitoring Driver  Ndu.sys  10.0.26100.7920  Kernel Driver  Running
NetAdapterCx  Network Adapter WDF Class Extension Library  netadaptercx.sys  10.0.26100.7920  Kernel Driver  Stopped
NetBIOS  NetBIOS Interface  netbios.sys  10.0.26100.1  File System Driver  Running
NetBT  NetBT  netbt.sys  10.0.26100.7309  Kernel Driver  Running
netvsc  netvsc  netvsc.sys  10.0.26100.7920  Kernel Driver  Stopped
NetworkPrivacyPolicy  Microsoft Network Privacy Policy Service  NetworkPrivacyPolicy.sys    Kernel Driver  Stopped
Npfs  Npfs      File System Driver  Running
npsvctrig  Named pipe service trigger provider  npsvctrig.sys  10.0.26100.1150  Kernel Driver  Running
nsiproxy  NSI Proxy Service Driver  nsiproxy.sys  10.0.26100.7920  Kernel Driver  Running
Ntfs  Ntfs      File System Driver  Running
Null  Null      Kernel Driver  Running
nvdimm  Microsoft NVDIMM device driver  nvdimm.sys  10.0.26100.4202  Kernel Driver  Stopped
nvmedisk  Microsoft NVMe disk driver  nvmedisk.sys  10.0.26100.7019  Kernel Driver  Running
nvraid  nvraid  nvraid.sys  10.6.0.23  Kernel Driver  Stopped
nvstor  nvstor  nvstor.sys  10.6.0.23  Kernel Driver  Stopped
P9Rdr  Plan 9 Redirector Driver  p9rdr.sys  10.0.26100.7824  Kernel Driver  Stopped
Parport  Parallel port driver  parport.sys  10.0.26100.1150  Kernel Driver  Stopped
partmgr  Partition driver  partmgr.sys  10.0.26100.7920  Kernel Driver  Running
pci  PCI Bus Driver  pci.sys  10.0.26100.7920  Kernel Driver  Running
pciide  pciide  pciide.sys  10.0.26100.7920  Kernel Driver  Stopped
pcmcia  pcmcia  pcmcia.sys  10.0.26100.1150  Kernel Driver  Stopped
pcw  Performance Counters for Windows Driver  pcw.sys  10.0.26100.8036  Kernel Driver  Running
pdc  pdc  pdc.sys  10.0.26100.7920  Kernel Driver  Running
PEAUTH  PEAUTH  peauth.sys  10.0.26100.7920  Kernel Driver  Running
percsas2i  percsas2i  percsas2i.sys  6.805.3.0  Kernel Driver  Stopped
percsas3i  percsas3i  percsas3i.sys  6.604.6.0  Kernel Driver  Stopped
PktMon  Packet Monitor Driver  PktMon.sys  10.0.26100.7920  Kernel Driver  Stopped
PktMonApi  Packet Monitor Export Driver  PktMonApi.sys  10.0.26100.7920  Kernel Driver  Stopped
PlutonHeci  Microsoft Pluton Security Service  pluton-heci.sys  10.0.26100.7920  Kernel Driver  Stopped
PlutonHsp2  Microsoft Pluton Service  PlutonHsp2.sys    Kernel Driver  Stopped
pmem  Microsoft persistent memory disk driver  pmem.sys  10.0.26100.3912  Kernel Driver  Stopped
PNPMEM  Microsoft Memory Module Driver  pnpmem.sys  10.0.26100.1150  Kernel Driver  Stopped
portcfg  portcfg  portcfg.sys  10.0.26100.1150  Kernel Driver  Stopped
PptpMiniport  WAN Miniport (PPTP)  raspptp.sys  10.0.26100.1882  Kernel Driver  Stopped
PRM  Microsoft PRM Driver  PRM.sys  10.0.26100.1150  Kernel Driver  Running
Processor  Processor Driver  processr.sys  10.0.26100.7920  Kernel Driver  Stopped
Psched  QoS Packet Scheduler  pacer.sys  10.0.26100.1150  Kernel Driver  Running
pvscsi  pvscsi Storage Controller Driver  pvscsii.sys  1.3.15.0  Kernel Driver  Stopped
QWAVEdrv  QWAVE driver  qwavedrv.sys  10.0.26100.7920  Kernel Driver  Stopped
Ramdisk  Windows RAM Disk Driver  ramdisk.sys  10.0.26100.7920  Kernel Driver  Stopped
RasAcd  Remote Access Auto Connection Driver  rasacd.sys  10.0.26100.7920  Kernel Driver  Stopped
RasAgileVpn  WAN Miniport (IKEv2)  AgileVpn.sys  10.0.26100.7920  Kernel Driver  Stopped
Rasl2tp  WAN Miniport (L2TP)  rasl2tp.sys  10.0.26100.5074  Kernel Driver  Stopped
RasPppoe  Remote Access PPPOE Driver  raspppoe.sys  10.0.26100.1882  Kernel Driver  Stopped
RasSstp  WAN Miniport (SSTP)  rassstp.sys  10.0.26100.1882  Kernel Driver  Stopped
rdbss  Redirected Buffering Sub System  rdbss.sys  10.0.26100.7920  File System Driver  Running
rdpbus  Remote Desktop Device Redirector Bus Driver  rdpbus.sys  10.0.26100.7920  Kernel Driver  Running
RDPDR  Remote Desktop Device Redirector Driver  rdpdr.sys  10.0.26100.7920  Kernel Driver  Stopped
rdyboost  ReadyBoost  rdyboost.sys  10.0.26100.7019  Kernel Driver  Running
ReFS  ReFS      File System Driver  Stopped
ReFSv1  ReFSv1      File System Driver  Stopped
RFCOMM  Bluetooth Device (RFCOMM Protocol TDI)  rfcomm.sys  10.0.26100.8036  Kernel Driver  Stopped
rhproxy  Resource Hub proxy driver  rhproxy.sys  10.0.26100.1150  Kernel Driver  Stopped
RoutePolicy  Microsoft Route Policy Service  RoutePolicy.sys  10.0.26100.7309  Kernel Driver  Stopped
rspndr  Link-Layer Topology Discovery Responder  rspndr.sys  10.0.26100.7920  Kernel Driver  Running
s3cap  s3cap  vms3cap.sys  10.0.26100.1150  Kernel Driver  Stopped
sbp2port  SBP-2 Transport/Protocol Bus Driver  sbp2port.sys  10.0.26100.1150  Kernel Driver  Stopped
scfilter  Smart card PnP Class Filter Driver  scfilter.sys  10.0.26100.8037  Kernel Driver  Stopped
scmbus  Microsoft Storage Class Memory Bus Driver  scmbus.sys  10.0.26100.6725  Kernel Driver  Stopped
sdbus  sdbus  sdbus.sys  10.0.26100.7920  Kernel Driver  Stopped
SdcaHidInbox  SoundWire HID Driver  SdcaHid.sys  10.0.26100.5074  Kernel Driver  Stopped
SdcaMfdInbox  SoundWire Audio Multifunction Driver  SdcaMfd.sys  10.0.26100.5074  Kernel Driver  Stopped
sdstor  SD Storage Port Driver  sdstor.sys  10.0.26100.7019  Kernel Driver  Stopped
SerCx  Serial UART Support Library  SerCx.sys  10.0.26100.1150  Kernel Driver  Stopped
SerCx2  Serial UART Support Library  SerCx2.sys  10.0.26100.1150  Kernel Driver  Stopped
Serenum  Serenum Filter Driver  serenum.sys  10.0.26100.1150  Kernel Driver  Stopped
Serial  Serial port driver  serial.sys  10.0.26100.1150  Kernel Driver  Stopped
sermouse  Serial Mouse Driver  sermouse.sys  10.0.26100.1150  Kernel Driver  Stopped
sfloppy  High-Capacity Floppy Disk Drive  sfloppy.sys  10.0.26100.7019  Kernel Driver  Stopped
SiSRaid2  SiSRaid2  SiSRaid2.sys  5.1.1039.2600  Kernel Driver  Stopped
SiSRaid4  SiSRaid4  sisraid4.sys  5.1.1039.3600  Kernel Driver  Stopped
SmartSAMD  SmartSAMD  SmartSAMD.sys  1.50.1.0  Kernel Driver  Stopped
spaceparser  spaceparser  spaceparser.sys  10.0.26100.4484  Kernel Driver  Stopped
spaceport  Storage Spaces Driver  spaceport.sys  10.0.26100.7920  Kernel Driver  Running
SpbCx  Simple Peripheral Bus Support Library  SpbCx.sys  10.0.26100.7920  Kernel Driver  Stopped
srv2  Server SMB 2.xxx Driver  srv2.sys  10.0.26100.8036  File System Driver  Running
srvnet  srvnet  srvnet.sys  10.0.26100.8036  File System Driver  Running
stexstor  stexstor  stexstor.sys  5.1.0.10  Kernel Driver  Stopped
storahci  Microsoft Standard SATA AHCI Driver  storahci.sys  10.0.26100.7920  Kernel Driver  Stopped
storflt  Microsoft Hyper-V Storage Accelerator  vmstorfl.sys  10.0.26100.1150  Kernel Driver  Stopped
stornvme  Microsoft Standard NVM Express Driver  stornvme.sys  10.0.26100.7920  Kernel Driver  Running
storqosflt  Storage QoS Filter Driver  storqosflt.sys  10.0.26100.7920  File System Driver  Running
storufs  Microsoft Universal Flash Storage (UFS) Driver  storufs.sys  10.0.26100.7920  Kernel Driver  Stopped
storvsc  storvsc  storvsc.sys  10.0.26100.7920  Kernel Driver  Stopped
swenum  Software Bus Driver  swenum.sys  10.0.26100.4202  Kernel Driver  Running
Tcpip  TCP/IP Protocol Driver  tcpip.sys  10.0.26100.7920  Kernel Driver  Running
Tcpip6  @todo.dll,-100;Microsoft IPv6 Protocol Driver  tcpip.sys  10.0.26100.7920  Kernel Driver  Stopped
tcpipreg  @%SystemRoot%\System32\drivers\tcpipreg.sys,-10110,  tcpipreg.sys  10.0.26100.7920  Kernel Driver  Running
tdx  NetIO Legacy TDI Support Driver  tdx.sys  10.0.26100.7920  Kernel Driver  Running
terminpt  Microsoft Remote Desktop Input Driver  terminpt.sys  10.0.26100.1150  Kernel Driver  Stopped
ThermalFilter  Microsoft Thermal Filter Driver  ThermalFilter.sys  10.0.26100.7920  Kernel Driver  Stopped
TPM  TPM  tpm.sys  10.0.26100.7920  Kernel Driver  Running
TsUsbFlt  Remote Desktop USB Hub Class Filter Driver  tsusbflt.sys  10.0.26100.2894  Kernel Driver  Stopped
TsUsbGD  Remote Desktop Generic USB Device  TsUsbGD.sys  10.0.26100.2894  Kernel Driver  Stopped
tunnel  Microsoft Tunnel Miniport Adapter Driver  tunnel.sys  10.0.26100.4202  Kernel Driver  Stopped
UASPStor  USB Attached SCSI (UAS) Driver  uaspstor.sys  10.0.26100.1882  Kernel Driver  Stopped
UcmCx0101  USB Connector Manager KMDF Class Extension  UcmCx.sys  10.0.26100.7920  Kernel Driver  Running
UcmTcpciCx0101  UCM-TCPCI KMDF Class Extension  UcmTcpciCx.sys  10.0.26100.7920  Kernel Driver  Stopped
UcmUcsiAcpiClient  UCM-UCSI ACPI Client  UcmUcsiAcpiClient.sys  10.0.26100.1882  Kernel Driver  Running
UcmUcsiCx0101  UCM-UCSI KMDF Class Extension  UcmUcsiCx.sys  10.0.26100.7920  Kernel Driver  Running
UCPD  UCPD  UCPD.sys  4.6.0.0  File System Driver  Running
Ucx01000  USB Host Support Library  ucx01000.sys  10.0.26100.7920  Kernel Driver  Running
UdeCx  USB Device Emulation Support Library  udecx.sys  10.0.26100.7309  Kernel Driver  Stopped
udfs  udfs  udfs.sys  10.0.26100.8036  File System Driver  Stopped
UEFI  Microsoft UEFI Driver  UEFI.sys  10.0.26100.7920  Kernel Driver  Running
Ufx01000  USB Function Class Extension  ufx01000.sys  10.0.26100.1150  Kernel Driver  Stopped
UfxChipidea  USB Chipidea Controller  UfxChipidea.sys  10.0.26100.1150  Kernel Driver  Stopped
ufxsynopsys  USB Synopsys Controller  ufxsynopsys.sys  10.0.26100.1150  Kernel Driver  Stopped
uiomap  Microsoft UIO Mapper Driver Service  uiomap.sys  10.0.26100.7705  Kernel Driver  Running
umbus  UMBus Enumerator Driver  umbus.sys  10.0.26100.1150  Kernel Driver  Running
UmPass  Microsoft UMPass Driver  umpass.sys  10.0.26100.1150  Kernel Driver  Stopped
UnionFS  UnionFS  UnionFS.sys  10.0.26100.7705  File System Driver  Running
UrsChipidea  Chipidea USB Role-Switch Driver  urschipidea.sys  10.0.26100.1150  Kernel Driver  Stopped
UrsCx01000  USB Role-Switch Support Library  urscx01000.sys  10.0.26100.1882  Kernel Driver  Stopped
UrsSynopsys  Synopsys USB Role-Switch Driver  urssynopsys.sys  10.0.26100.1882  Kernel Driver  Stopped
Usb4DeviceRouter  USB4 Device Router Service  Usb4DeviceRouter.sys  10.0.26100.7920  Kernel Driver  Stopped
Usb4HostRouter  USB4 Host Router Service  Usb4HostRouter.sys  10.0.26100.7920  Kernel Driver  Stopped
usbaudio  USB Audio Driver (WDM)  usbaudio.sys  10.0.26100.7920  Kernel Driver  Stopped
usbaudio2  USB Audio 2.0 Service  usbaudio2.sys  10.0.26100.1150  Kernel Driver  Stopped
usbccgp  Microsoft USB Generic Parent Driver  usbccgp.sys  10.0.26100.7920  Kernel Driver  Running
usbcir  eHome Infrared Receiver (USBCIR)  usbcir.sys  10.0.26100.1150  Kernel Driver  Stopped
usbehci  Microsoft USB 2.0 Enhanced Host Controller Miniport Driver  usbehci.sys  10.0.26100.7920  Kernel Driver  Stopped
usbhub  Microsoft USB Standard Hub Driver  usbhub.sys  10.0.26100.7920  Kernel Driver  Stopped
USBHUB3  SuperSpeed Hub  UsbHub3.sys  10.0.26100.7920  Kernel Driver  Running
usbohci  Microsoft USB Open Host Controller Miniport Driver  usbohci.sys  10.0.26100.7920  Kernel Driver  Stopped
usb-platformdetection  Usb Platform Detection Driver  usb-platformdetection.sys    Kernel Driver  Stopped
usbprint  Microsoft USB PRINTER Class  usbprint.sys  10.0.26100.7920  Kernel Driver  Stopped
usbser  Microsoft USB Serial Driver  usbser.sys  10.0.26100.2454  Kernel Driver  Stopped
USBSTOR  USB Mass Storage Driver  USBSTOR.SYS  10.0.26100.4768  Kernel Driver  Stopped
usbuhci  Microsoft USB Universal Host Controller Miniport Driver  usbuhci.sys  10.0.26100.7920  Kernel Driver  Stopped
USBXHCI  USB xHCI Compliant Host Controller  USBXHCI.SYS  10.0.26100.7920  Kernel Driver  Running
vdrvroot  Microsoft Virtual Drive Enumerator  vdrvroot.sys  10.0.26100.1591  Kernel Driver  Running
VerifierExt  Driver Verifier Extension  VerifierExt.sys  10.0.26100.7920  Kernel Driver  Stopped
vhdmp  vhdmp  vhdmp.sys  10.0.26100.7920  Kernel Driver  Stopped
vhf  Virtual HID Framework (VHF) Driver  vhf.sys  10.0.26100.7920  Kernel Driver  Stopped
Vid  Vid  Vid.sys  10.0.26100.7920  Kernel Driver  Running
VirtualRender  VirtualRender  vrd.sys  10.0.26100.1150  Kernel Driver  Stopped
vmbus  Virtual Machine Bus  vmbus.sys  10.0.26100.7920  Kernel Driver  Stopped
VMBusHID  VMBusHID  VMBusHID.sys  10.0.26100.1150  Kernel Driver  Stopped
vmgid  Microsoft Hyper-V Guest Infrastructure Driver  vmgid.sys  10.0.26100.1150  Kernel Driver  Stopped
volmgr  Volume Manager Driver  volmgr.sys  10.0.26100.7920  Kernel Driver  Running
volmgrx  Dynamic Volume Manager  volmgrx.sys  10.0.26100.1150  Kernel Driver  Running
volsnap  Volume Shadow Copy driver  volsnap.sys  10.0.26100.7920  Kernel Driver  Running
volume  Volume driver  volume.sys  10.0.26100.5074  Kernel Driver  Running
vpci  Microsoft Hyper-V Virtual PCI Bus  vpci.sys  10.0.26100.7920  Kernel Driver  Stopped
vsmraid  vsmraid  vsmraid.sys  7.0.9600.6352  Kernel Driver  Stopped
VSTXRAID  VIA StorX Storage RAID Controller Windows Driver  vstxraid.sys  8.0.9200.8110  Kernel Driver  Stopped
vwifibus  Virtual Wireless Bus Driver  vwifibus.sys  10.0.26100.1150  Kernel Driver  Stopped
vwififlt  Virtual WiFi Filter Driver  vwififlt.sys  10.0.26100.7309  Kernel Driver  Running
WacomPen  Wacom Serial Pen HID Driver  wacompen.sys  10.0.26100.1150  Kernel Driver  Stopped
wanarp  Remote Access IP ARP Driver  wanarp.sys  10.0.26100.7920  Kernel Driver  Running
wanarpv6  Remote Access IPv6 ARP Driver  wanarp.sys  10.0.26100.7920  Kernel Driver  Stopped
wcifs  Windows Container Isolation  wcifs.sys  10.0.26100.7920  File System Driver  Running
WdBoot  Microsoft Defender Antivirus Boot Driver  WdBoot.sys  4.18.25080.5  Kernel Driver  Stopped
Wdf01000  Kernel Mode Driver Frameworks service  Wdf01000.sys  1.35.26100.7920  Kernel Driver  Running
WdFilter  Microsoft Defender Antivirus Mini-Filter Driver  WdFilter.sys  4.18.25080.5  File System Driver  Running
wdiwifi  WDI Driver Framework  wdiwifi.sys  10.0.26100.7920  Kernel Driver  Stopped
WdmCompanionFilter  WdmCompanionFilter  WdmCompanionFilter.sys  10.0.26100.2454  Kernel Driver  Stopped
WdNisDrv  Microsoft Defender Antivirus Network Inspection System Driver  WdNisDrv.sys  4.18.25080.5  Kernel Driver  Running
WFPLWFS  Microsoft Windows Filtering Platform  wfplwfs.sys  10.0.26100.7920  Kernel Driver  Running
Wificx  Wifi Network Adapter Class Extension  WifiCx.sys  10.0.26100.7920  Kernel Driver  Stopped
WIMMount  WIMMount  wimmount.sys  10.0.26100.7920  File System Driver  Stopped
WinAccelCx0101  Microsoft Accelerator Class Extension Driver  WinAccelCx.sys  10.0.26100.1150  Kernel Driver  Stopped
WindowsTrustedRT  Windows Trusted Execution Environment Class Extension  WindowsTrustedRT.sys  10.0.26100.7171  Kernel Driver  Running
WindowsTrustedRTProxy  Microsoft Windows Trusted Runtime Secure Service  WindowsTrustedRTProxy.sys  10.0.26100.4484  Kernel Driver  Running
wini3ctarget  Generic driver for I3C Target Devices  wini3ctarget.sys  10.0.26100.7019  Kernel Driver  Stopped
WinMad  WinMad Service  winmad.sys  5.50.14695.0  Kernel Driver  Stopped
WinNat  Windows NAT Driver  winnat.sys  10.0.26100.7920  Kernel Driver  Stopped
WINUSB  WinUsb Driver  WinUSB.SYS  10.0.26100.1150  Kernel Driver  Stopped
WinVerbs  WinVerbs Service  winverbs.sys  5.50.14695.0  Kernel Driver  Stopped
WmiAcpi  Microsoft Windows Management Interface for ACPI  wmiacpi.sys  10.0.26100.1150  Kernel Driver  Running
Wof  Windows Overlay File System Filter Driver      File System Driver  Running
WpdUpFltr  WPD Upper Class Filter Driver  WpdUpFltr.sys  10.0.26100.1150  Kernel Driver  Stopped
ws2ifsl  Winsock IFS Driver  ws2ifsl.sys  10.0.26100.7920  Kernel Driver  Stopped
wtd  wtd  wtd.sys  10.0.26100.6725  Kernel Driver  Running
WudfPf  User Mode Driver Frameworks Platform Driver  WudfPf.sys  10.0.26100.7920  Kernel Driver  Stopped
WUDFRd  Windows Driver Foundation - User-mode Driver Framework Reflector  WUDFRd.sys  10.0.26100.7920  Kernel Driver  Stopped
WUDFWpdFs  WPD File System driver  WUDFRd.sys  10.0.26100.7920  Kernel Driver  Stopped
xboxgip  Xbox Game Input Protocol Driver  xboxgip.sys  10.0.26100.7920  Kernel Driver  Stopped
xinputhid  XINPUT HID Filter Driver  xinputhid.sys  10.0.26100.7920  Kernel Driver  Stopped


Services
 
Service Name  Service Description  File Name  Version  Type  State  Account
AarSvc_29b31  AarSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
ADPSvc  Aggregated Data Platform Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
ALG  Application Layer Gateway Service  alg.exe  10.0.26100.7920  Own Process  Stopped  NT AUTHORITY\LocalService
AppIDSvc  Application Identity  svchost.exe  10.0.26100.7705  Unknown  Running  NT Authority\LocalService
Appinfo  Application Information  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
AppReadiness  App Readiness  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
AppXSvc  AppX Deployment Service (AppXSVC)  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
ApxSvc  Windows Virtual Audio Device Proxy Service  svchost.exe  10.0.26100.7705  Own Process  Stopped  NT AUTHORITY\LocalService
AudioEndpointBuilder  Windows Audio Endpoint Builder  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
Audiosrv  Windows Audio  svchost.exe  10.0.26100.7705  Own Process  Running  NT AUTHORITY\LocalService
autotimesvc  Cellular Time  svchost.exe  10.0.26100.7705  Own Process  Stopped  NT AUTHORITY\LocalService
AxInstSV  ActiveX Installer (AxInstSV)  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
BcastDVRUserService_29b31  BcastDVRUserService_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
BDESVC  BitLocker Drive Encryption Service  svchost.exe  10.0.26100.7705  Unknown  Running  localSystem
BFE  Base Filtering Engine  svchost.exe  10.0.26100.7705  Share Process  Running  NT AUTHORITY\LocalService
BITS  Background Intelligent Transfer Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
BluetoothUserService_29b31  BluetoothUserService_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
BrokerInfrastructure  Background Tasks Infrastructure Service  svchost.exe  10.0.26100.7705  Share Process  Running  LocalSystem
BTAGService  Bluetooth Audio Gateway Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
BthAvctpSvc  AVCTP service  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
bthserv  Bluetooth Support Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
camsvc  Capability Access Manager Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
CaptureService_29b31  CaptureService_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
cbdhsvc_29b31  cbdhsvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Running  
CDPSvc  Connected Devices Platform Service  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\LocalService
CDPUserSvc_29b31  CDPUserSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Running  
CertPropSvc  Certificate Propagation  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
ClipSVC  Client License Service (ClipSVC)  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
CloudBackupRestoreSvc_29b31  CloudBackupRestoreSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
COMSysApp  COM+ System Application  dllhost.exe  10.0.26100.7705  Own Process  Stopped  LocalSystem
ConsentUxUserSvc_29b31  ConsentUxUserSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
CoreMessagingRegistrar  CoreMessaging  svchost.exe  10.0.26100.7705  Share Process  Running  NT AUTHORITY\LocalService
CredentialEnrollmentManagerUserSvc_29b31  CredentialEnrollmentManagerUserSvc_29b31  CredentialEnrollmentManager.exe  10.0.26100.7920  Unknown  Stopped  
CryptSvc  Cryptographic Services  svchost.exe  10.0.26100.7705  Own Process  Running  NT Authority\NetworkService
DcomLaunch  DCOM Server Process Launcher  svchost.exe  10.0.26100.7705  Share Process  Running  LocalSystem
dcsvc  Declared Configuration(DC) service  svchost.exe  10.0.26100.7705  Own Process  Stopped  LocalSystem
defragsvc  Optimize drives  svchost.exe  10.0.26100.7705  Own Process  Stopped  localSystem
DeviceAssociationBrokerSvc_29b31  DeviceAssociationBrokerSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
DeviceAssociationService  Device Association Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
DeviceInstall  Device Install Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
DevicePickerUserSvc_29b31  DevicePickerUserSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
DevicesFlowUserSvc_29b31  DevicesFlowUserSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
DevQueryBroker  DevQuery Background Discovery Broker  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
Dhcp  DHCP Client  svchost.exe  10.0.26100.7705  Unknown  Running  NT Authority\LocalService
diagsvc  Diagnostic Execution Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
DiagTrack  Connected User Experiences and Telemetry  svchost.exe  10.0.26100.7705  Own Process  Running  LocalSystem
DispBrokerDesktopSvc  Display Policy Service  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\LocalService
DisplayEnhancementService  Display Enhancement Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
DmEnrollmentSvc  Device Management Enrollment Service  svchost.exe  10.0.26100.7705  Own Process  Stopped  LocalSystem
dmwappushservice  Device Management Wireless Application Protocol (WAP) Push message Routing Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
Dnscache  DNS Client  svchost.exe  10.0.26100.7705  Own Process  Running  NT AUTHORITY\NetworkService
DoSvc  Delivery Optimization  svchost.exe  10.0.26100.7705  Own Process  Stopped  NT Authority\NetworkService
dot3svc  Wired AutoConfig  svchost.exe  10.0.26100.7705  Share Process  Stopped  localSystem
DPS  Diagnostic Policy Service  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\LocalService
DsmSvc  Device Setup Manager  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
DsSvc  Data Sharing Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
DusmSvc  Data Usage  svchost.exe  10.0.26100.7705  Own Process  Running  NT Authority\LocalService
EapHost  Extensible Authentication Protocol  svchost.exe  10.0.26100.7705  Own Process  Stopped  localSystem
edgeupdate  Microsoft Edge Update Service (edgeupdate)  MicrosoftEdgeUpdate.exe  1.3.223.11  Own Process  Stopped  LocalSystem
edgeupdatem  Microsoft Edge Update Service (edgeupdatem)  MicrosoftEdgeUpdate.exe  1.3.223.11  Own Process  Stopped  LocalSystem
EFS  Encrypting File System (EFS)  lsass.exe  10.0.26100.7920  Share Process  Stopped  LocalSystem
embeddedmode  Embedded Mode  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
EntAppSvc  Enterprise App Management Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
EventLog  Windows Event Log  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\LocalService
EventSystem  COM+ Event System  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\LocalService
fdPHost  Function Discovery Provider Host  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
FDResPub  Function Discovery Resource Publication  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
fhsvc  File History Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
FontCache  Windows Font Cache Service  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\LocalService
FrameServer  Windows Camera Frame Server  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
FrameServerMonitor  Windows Camera Frame Server Monitor  svchost.exe  10.0.26100.7705  Own Process  Stopped  LocalSystem
GameInputSvc  GameInput Service  GameInputSvc.exe  0.2309.26100.7920  Own Process  Stopped  LocalSystem
gpsvc  Group Policy Client  svchost.exe  10.0.26100.7705  Own Process  Running  LocalSystem
GraphicsPerfSvc  GraphicsPerfSvc  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
hidserv  Human Interface Device Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
hpatchmon  Hotpatch Monitoring Service  svchost.exe  10.0.26100.7705  Own Process  Stopped  LocalSystem
HvHost  HV Host Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
icssvc  Windows Mobile Hotspot Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT Authority\LocalService
IKEEXT  IKE and AuthIP IPsec Keying Modules  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
InstallService  Microsoft Store Install Service  svchost.exe  10.0.26100.7705  Own Process  Running  LocalSystem
InventorySvc  Inventory and Compatibility Appraisal service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
iphlpsvc  IP Helper  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
IpxlatCfgSvc  IP Translation Configuration Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
KeyIso  CNG Key Isolation  lsass.exe  10.0.26100.7920  Share Process  Running  LocalSystem
KtmRm  KtmRm for Distributed Transaction Coordinator  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\NetworkService
LanmanServer  Server  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
LanmanWorkstation  Workstation  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\NetworkService
lfsvc  Geolocation Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
LicenseManager  Windows License Manager Service  svchost.exe  10.0.26100.7705  Unknown  Running  NT Authority\LocalService
lltdsvc  Link-Layer Topology Discovery Mapper  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
lmhosts  TCP/IP NetBIOS Helper  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
LocalKdc  Kerberos Local Key Distribution Center  lsass.exe  10.0.26100.7920  Share Process  Stopped  LocalSystem
LSM  Local Session Manager  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
LxpSvc  Language Experience Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
MapsBroker  Downloaded Maps Manager  svchost.exe  10.0.26100.7705  Own Process  Stopped  NT AUTHORITY\NetworkService
McmSvc  Mobile Connectivity Management Service  svchost.exe  10.0.26100.7705  Own Process  Stopped  NT SERVICE\McmSvc
McpManagementService  McpManagementService  svchost.exe  10.0.26100.7705  Own Process  Stopped  LocalSystem
MessagingService_29b31  MessagingService_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
MicrosoftEdgeElevationService  Microsoft Edge Elevation Service (MicrosoftEdgeElevationService)  elevation_service.exe  145.0.3800.97  Own Process  Stopped  LocalSystem
midisrv  Windows MIDI Service  midisrv.exe  10.0.26100.7920  Own Process  Running  NT AUTHORITY\LocalService
mpssvc  Windows Defender Firewall  svchost.exe  10.0.26100.7705  Share Process  Running  NT Authority\LocalService
MSDTC  Distributed Transaction Coordinator  msdtc.exe  2001.12.10941.16384  Own Process  Stopped  NT AUTHORITY\NetworkService
MSiSCSI  Microsoft iSCSI Initiator Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
msiserver  Windows Installer  msiexec.exe  5.0.26100.5074  Own Process  Stopped  LocalSystem
NaturalAuthentication  Natural Authentication  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
NcaSvc  Network Connectivity Assistant  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
NcbService  Network Connection Broker  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
NcdAutoSetup  Network Connected Devices Auto-Setup  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
Netlogon  Netlogon  lsass.exe  10.0.26100.7920  Share Process  Stopped  LocalSystem
Netman  Network Connections  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
netprofm  Network List Service  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\NetworkService
NetSetupSvc  Network Setup Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
NetTcpPortSharing  Net.Tcp Port Sharing Service  SMSvcHost.exe  4.8.9221.0  Share Process  Stopped  NT AUTHORITY\LocalService
NgcCtnrSvc  Microsoft Passport Container  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
NgcSvc  Microsoft Passport  svchost.exe  10.0.26100.7705  Unknown  Stopped  LocalSystem
NlaSvc  Network Location Awareness  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\NetworkService
NPSMSvc_29b31  NPSMSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
nsi  Network Store Interface Service  svchost.exe  10.0.26100.7705  Unknown  Running  NT Authority\LocalService
OneSyncSvc_29b31  OneSyncSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Running  
P9RdrService_29b31  P9RdrService_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
PcaSvc  Program Compatibility Assistant Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
PenService_29b31  PenService_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
perceptionsimulation  Windows Perception Simulation Service  PerceptionSimulationService.exe  10.0.26100.7705  Own Process  Stopped  LocalSystem
PerfHost  Performance Counter DLL Host  perfhost.exe  10.0.26100.4202  Own Process  Stopped  NT AUTHORITY\LocalService
PhoneSvc  Phone Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT Authority\LocalService
PimIndexMaintenanceSvc_29b31  PimIndexMaintenanceSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
pla  Performance Logs & Alerts  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
PlugPlay  Plug and Play  svchost.exe  10.0.26100.7705  Share Process  Running  LocalSystem
PolicyAgent  IPsec Policy Agent  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT Authority\NetworkService
Power  Power  svchost.exe  10.0.26100.7705  Share Process  Running  LocalSystem
PrintDeviceConfigurationService  Print Device Configuration Service  svchost.exe  10.0.26100.7705  Unknown  Stopped  LocalSystem
PrintNotify  Printer Extensions and Notifications  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
PrintScanBrokerService  PrintScanBrokerService  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
PrintWorkflowUserSvc_29b31  PrintWorkflowUserSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
ProfSvc  User Profile Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
PushToInstall  Windows PushToInstall Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
QWAVE  Quality Windows Audio Video Experience  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
RasAuto  Remote Access Auto Connection Manager  svchost.exe  10.0.26100.7705  Share Process  Stopped  localSystem
RasMan  Remote Access Connection Manager  svchost.exe  10.0.26100.7705  Share Process  Stopped  localSystem
refsdedupsvc  ReFS Dedup Service  ReFsDedupSvc.exe  10.0.26100.7920  Own Process  Stopped  LocalSystem
RemoteAccess  Routing and Remote Access  svchost.exe  10.0.26100.7705  Share Process  Stopped  localSystem
RemoteRegistry  Remote Registry  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
RetailDemo  Retail Demo Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
RmSvc  Radio Management Service  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\LocalService
RpcEptMapper  RPC Endpoint Mapper  svchost.exe  10.0.26100.7705  Share Process  Running  NT AUTHORITY\NetworkService
RpcLocator  Remote Procedure Call (RPC) Locator  locator.exe  10.0.26100.1  Own Process  Stopped  NT AUTHORITY\NetworkService
RpcSs  Remote Procedure Call (RPC)  svchost.exe  10.0.26100.7705  Share Process  Running  NT AUTHORITY\NetworkService
SamSs  Security Accounts Manager  lsass.exe  10.0.26100.7920  Share Process  Running  LocalSystem
SCardSvr  Smart Card  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
ScDeviceEnum  Smart Card Device Enumeration Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
Schedule  Task Scheduler  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
SCPolicySvc  Smart Card Removal Policy  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
SDRSVC  Windows Backup  svchost.exe  10.0.26100.7705  Own Process  Stopped  localSystem
seclogon  Secondary Logon  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
SecurityHealthService  Windows Security Service  SecurityHealthService.exe  10.0.26100.7309  Own Process  Running  LocalSystem
SEMgrSvc  Payments and NFC/SE Manager  svchost.exe  10.0.26100.7705  Own Process  Stopped  NT AUTHORITY\LocalService
SENS  System Event Notification Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
SensorDataService  Sensor Data Service  SensorDataService.exe  10.0.26100.7920  Own Process  Stopped  LocalSystem
SensorService  Sensor Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
SensrSvc  Sensor Monitoring Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
SessionEnv  Remote Desktop Configuration  svchost.exe  10.0.26100.7705  Share Process  Stopped  localSystem
SharedAccess  Internet Connection Sharing (ICS)  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
ShellHWDetection  Shell Hardware Detection  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
shpamsvc  Shared PC Account Manager  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
smphost  Microsoft Storage Spaces SMP  svchost.exe  10.0.26100.7705  Own Process  Stopped  NT AUTHORITY\NetworkService
SmsRouter  Microsoft Windows SMS Router Service.  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT Authority\LocalService
SNMPTrap  SNMP Trap  snmptrap.exe  10.0.26100.7920  Own Process  Stopped  NT AUTHORITY\LocalService
Spooler  Print Spooler  spoolsv.exe  10.0.26100.7920  Own Process  Running  LocalSystem
sppsvc  Software Protection  sppsvc.exe  10.0.26100.8036  Own Process  Running  NT AUTHORITY\NetworkService
SSDPSRV  SSDP Discovery  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\LocalService
ssh-agent  OpenSSH Authentication Agent  ssh-agent.exe  9.5.5.1  Own Process  Stopped  LocalSystem
SstpSvc  Secure Socket Tunneling Protocol Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT Authority\LocalService
StateRepository  State Repository Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
StiSvc  Windows Image Acquisition (WIA)  svchost.exe  10.0.26100.7705  Own Process  Stopped  NT Authority\LocalService
StorSvc  Storage Service  svchost.exe  10.0.26100.7705  Own Process  Running  LocalSystem
svsvc  Spot Verifier  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
swprv  Microsoft Software Shadow Copy Provider  svchost.exe  10.0.26100.7705  Own Process  Stopped  LocalSystem
SysMain  SysMain  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
SystemEventsBroker  System Events Broker  svchost.exe  10.0.26100.7705  Share Process  Running  LocalSystem
TapiSrv  Telephony  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\NetworkService
TermService  Remote Desktop Services  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT Authority\NetworkService
TextInputManagementService  Text Input Management Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
Themes  Themes  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
TieringEngineService  Storage Tiers Management  TieringEngineService.exe  10.0.26100.5074  Own Process  Stopped  localSystem
TimeBrokerSvc  Time Broker  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\LocalService
TokenBroker  Web Account Manager  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
TrkWks  Distributed Link Tracking Client  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
TroubleshootingSvc  Recommended Troubleshooting Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
TrustedInstaller  Windows Modules Installer  TrustedInstaller.exe  10.0.26100.7920  Own Process  Stopped  localSystem
tzautoupdate  Auto Time Zone Updater  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
UdkUserSvc_29b31  UdkUserSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Running  
UmRdpService  Remote Desktop Services UserMode Port Redirector  svchost.exe  10.0.26100.7705  Share Process  Stopped  localSystem
UnistoreSvc_29b31  UnistoreSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
upnphost  UPnP Device Host  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
UserDataSvc_29b31  UserDataSvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Stopped  
UserManager  User Manager  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
UsoSvc  Update Orchestrator Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
VaultSvc  Credential Manager  lsass.exe  10.0.26100.7920  Share Process  Running  LocalSystem
vds  Virtual Disk  vds.exe  10.0.26100.7920  Own Process  Stopped  LocalSystem
vmicguestinterface  Hyper-V Guest Service Interface  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
vmicheartbeat  Hyper-V Heartbeat Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
vmickvpexchange  Hyper-V Data Exchange Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
vmicrdv  Hyper-V Remote Desktop Virtualization Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
vmicshutdown  Hyper-V Guest Shutdown Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
vmictimesync  Hyper-V Time Synchronization Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
vmicvmsession  Hyper-V PowerShell Direct Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
vmicvss  Hyper-V Volume Shadow Copy Requestor  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
VSS  Volume Shadow Copy  vssvc.exe  10.0.26100.7309  Own Process  Stopped  LocalSystem
W32Time  Windows Time  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
WaaSMedicSvc  WaaSMedicSvc  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
WalletService  WalletService  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
WarpJITSvc  Warp JIT Service  svchost.exe  10.0.26100.7705  Own Process  Stopped  NT Authority\LocalService
wbengine  Block Level Backup Engine Service  wbengine.exe  10.0.26100.7309  Own Process  Stopped  localSystem
WbioSrvc  Windows Biometric Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
Wcmsvc  Windows Connection Manager  svchost.exe  10.0.26100.7705  Own Process  Running  NT Authority\LocalService
wcncsvc  Windows Connect Now - Config Registrar  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
WdiServiceHost  Diagnostic Service Host  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
WdiSystemHost  Diagnostic System Host  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
WdNisSvc  Microsoft Defender Antivirus Network Inspection Service  NisSrv.exe  4.18.25080.5  Own Process  Running  NT AUTHORITY\LocalService
WebClient  WebClient  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
webthreatdefsvc  Web Threat Defense Service  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\LocalService
webthreatdefusersvc_29b31  webthreatdefusersvc_29b31  svchost.exe  10.0.26100.7705  Unknown  Running  
Wecsvc  Windows Event Collector  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\NetworkService
WEPHOSTSVC  Windows Encryption Provider Host Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
wercplsupport  Problem Reports Control Panel Support  svchost.exe  10.0.26100.7705  Share Process  Stopped  localSystem
WerSvc  Windows Error Reporting Service  svchost.exe  10.0.26100.7705  Own Process  Stopped  localSystem
WFDSConMgrSvc  Wi-Fi Direct Services Connection Manager Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
whesvc  Windows Health and Optimized Experiences  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
WiaRpc  Still Image Acquisition Events  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
WinDefend  Microsoft Defender Antivirus Service  MsMpEng.exe  4.18.25080.5  Own Process  Running  LocalSystem
WinHttpAutoProxySvc  WinHTTP Web Proxy Auto-Discovery Service  svchost.exe  10.0.26100.7705  Own Process  Running  NT AUTHORITY\LocalService
Winmgmt  Windows Management Instrumentation  svchost.exe  10.0.26100.7705  Unknown  Running  localSystem
WinRM  Windows Remote Management (WS-Management)  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\NetworkService
wisvc  Windows Insider Service  svchost.exe  10.0.26100.7705  Unknown  Stopped  LocalSystem
WlanSvc  WLAN AutoConfig  svchost.exe  10.0.26100.7705  Own Process  Stopped  LocalSystem
wlidsvc  Microsoft Account Sign-in Assistant  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
wlpasvc  Local Profile Assistant Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT Authority\LocalService
WManSvc  Windows Management Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
wmiApSrv  WMI Performance Adapter  WmiApSrv.exe  10.0.26100.7920  Own Process  Stopped  localSystem
WMPNetworkSvc  Windows Media Player Network Sharing Service  wmpnetwk.exe  12.0.26100.7019  Own Process  Stopped  NT AUTHORITY\NetworkService
workfolderssvc  Work Folders  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
WpcMonSvc  Parental Controls  svchost.exe  10.0.26100.7705  Own Process  Stopped  LocalSystem
WPDBusEnum  Portable Device Enumerator Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
WpnService  Windows Push Notifications System Service  svchost.exe  10.0.26100.7705  Unknown  Running  LocalSystem
WpnUserService_29b31  WpnUserService_29b31  svchost.exe  10.0.26100.7705  Unknown  Running  
WSAIFabricSvc  WSAIFabricSvc  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\LocalService
wscsvc  Security Center  svchost.exe  10.0.26100.7705  Unknown  Running  NT AUTHORITY\LocalService
WSearch  Windows Search  SearchIndexer.exe  7.0.26100.7920  Own Process  Running  LocalSystem
wuauserv  Windows Update  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
wuqisvc  Microsoft Usage and Quality Insights  svchost.exe  10.0.26100.7705  Share Process  Stopped  NT AUTHORITY\LocalService
WwanSvc  WWAN AutoConfig  svchost.exe  10.0.26100.7705  Share Process  Stopped  localSystem
XblAuthManager  Xbox Live Auth Manager  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
XblGameSave  Xbox Live Game Save  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
XboxGipSvc  Xbox Accessory Management Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem
XboxNetApiSvc  Xbox Live Networking Service  svchost.exe  10.0.26100.7705  Share Process  Stopped  LocalSystem


AX Files
 
AX File  Version  Description
bdaplgin.ax  10.0.26100.1882  Microsoft BDA Device Control Plug-in for MPEG2 based networks.
g711codc.ax  10.0.26100.3194  Intel G711 CODEC
ksproxy.ax  10.0.26100.7309  WDM Streaming ActiveMovie Proxy
kstvtune.ax  10.0.26100.1882  WDM Streaming TvTuner
kswdmcap.ax  10.0.26100.1882  WDM Streaming Video Capture
ksxbar.ax  10.0.26100.1150  WDM Streaming Crossbar
mpeg2data.ax  10.0.26100.4202  Microsoft MPEG-2 Section and Table Acquisition Module
mpg2splt.ax  10.0.26100.3624  DirectShow MPEG-2 Splitter.
msdvbnp.ax  10.0.26100.4202  Microsoft Network Provider for MPEG2 based networks.
msnp.ax  10.0.26100.5074  Microsoft Network Provider for MPEG2 based networks.
psisrndr.ax  10.0.26100.4202  Microsoft Transport Information Filter for MPEG2 based networks.
vbicodec.ax  10.0.26100.5074  Microsoft VBI Codec
vbisurf.ax  10.0.26100.1150  VBI Surface Allocator Filter
vidcap.ax  10.0.26100.1150  Video Capture Interface Server
wstpager.ax  10.0.26100.1150  Microsoft Teletext Server


DLL Files
 
DLL File  Version  Description
0ae3b998-9a38-4b72-a4c4-06849441518d_servicing-stack.dll  10.0.26100.7705  ApiSet Schema Extension DLL
3bc29097-7317-41d3-93b9-38a48f99d48a_mssrch.dll  10.0.26100.7920  ApiSet Schema Extension DLL
4545ffe2-0dc4-4df4-9d02-299ef204635e_hvsocket.dll  10.0.26100.7705  ApiSet Schema Extension DLL
69fe178f-26e7-43a9-aa7d-2b616b672dde_eventlogservice.dll  10.0.26100.7705  ApiSet Schema Extension DLL
6bea57fb-8dfb-4177-9ae8-42e8b3529933_runtimedeviceinstall.dll  10.0.26100.7920  ApiSet Schema Extension DLL
aadauthhelper.dll  10.0.26100.7920  Microsoft® Microsoft Entra Auth Helper
aadcloudap.dll  10.0.26100.8036  Microsoft Entra Cloud AP Plugin
aadjcsp.dll  10.0.26100.7309  AADJCSP
aadtb.dll  10.0.26100.7920  Microsoft Entra WAM Helper Library
aadwamextension.dll  10.0.26100.7920  Microsoft Entra WAM extension DLL
aarsvc.dll  10.0.26100.7309  Agent Activation Runtime Service
aboutsettingshandlers.dll  10.0.26100.7920  System Settings About Handlers Implementation
abovelockapphost.dll  10.0.26100.7824  AboveLockAppHost
accessibilitycpl.dll  10.0.26100.8036  Ease of access control panel
accountaccessor.dll  10.0.26100.7309  Sync data model to access accounts
accounthealth.dll  10.0.26100.7705  AccountHealth
accountsrt.dll  10.0.26100.7309  Accounts RT utilities for mail, contacts, calendar
acgenral.dll  10.0.26100.7920  Windows Compatibility DLL
aclayers.dll  10.0.26100.7705  Windows Compatibility DLL
acledit.dll  10.0.26100.1  Access Control List Editor
aclui.dll  10.0.26100.7920  Security Descriptor Editor
acmigration.dll  10.0.26100.7920  Compatibility Upgrade Migration Host
acpbackgroundmanagerpolicy.dll  10.0.26100.7705  <d> ACP Background Manager Policy DLL
acppage.dll  10.0.26100.7920  Compatibility Tab Shell Extension Library
acproxy.dll  10.0.26100.1  Autochk Proxy DLL
acspecfc.dll  10.0.26100.7309  Windows Compatibility DLL
actioncenter.dll  10.0.26100.7309  Security and Maintenance
actioncentercpl.dll  10.0.26100.7309  Security and Maintenance Control Panel
actionqueue.dll  10.0.26100.7309  Unattend Action Queue Generator / Executor
activationclient.dll  10.0.26100.7309  Activation Client
activationmanager.dll  10.0.26100.7920  Activation Manager
activeds.dll  10.0.26100.7019  ADs Router Layer DLL
activesynccsp.dll  10.0.26100.7309  ActiveSync CSP DLL
activesyncprovider.dll  10.0.26100.7309  The engine that syncs ActiveSync accounts
actxprxy.dll  10.0.26100.7705  ActiveX Interface Marshaling Library
acwinrt.dll  10.0.26100.1150  Windows Compatibility DLL
acxtrnal.dll  10.0.26100.2454  Windows Compatibility DLL
adaptivecards.dll  10.0.26100.7309  Windows Adaptive Cards API Server
addressparser.dll  10.0.26100.1882  ADDRESSPARSER
adhapi.dll  10.0.26100.7705  AD harvest sites and subnets API
adhsvc.dll  10.0.26100.5074  AD Harvest Sites and Subnets Service
adprovider.dll  10.0.26100.7309  adprovider DLL
adpsvc.dll  10.0.26100.7920  ADPSvc
adsldp.dll  10.0.26100.7019  ADs LDAP Provider DLL
adsldpc.dll  10.0.26100.1882  ADs LDAP Provider C DLL
adsmsext.dll  10.0.26100.1150  ADs LDAP Provider DLL
adsnt.dll  10.0.26100.7019  ADs Windows NT Provider DLL
adtschema.dll  10.0.26100.6725  Security Audit Schema DLL
advancedemojids.dll  10.0.26100.7309  "AdvancedEmojiDS.DYNLINK"
advapi32.dll  10.0.26100.7920  Advanced Windows 32 Base API
advapi32res.dll  10.0.26100.4202  Advanced Windows 32 Base API
advpack.dll  11.0.26100.7309  ADVPACK
aeevts.dll  10.0.26100.7920  Application Experience Event Resources
aeinv.dll  10.0.26100.7920  Application Inventory Component
aemarebackup.dll  10.0.26100.7920  Inventory Backup
aepic.dll  10.0.26100.7920  Application Experience Program Cache
agentactivationruntime.dll  10.0.26100.7309  Agent Activation Runtime Common DLL
agentactivationruntimewindows.dll  10.0.26100.7705  Agent Activation Runtime Windows DLL
aidd.dll    
amsi.dll  10.0.26100.7309  Anti-Malware Scan Interface
amsiproxy.dll  10.0.26100.1  Anti-Malware Scan Interface proxy
amstream.dll  10.0.26100.5074  DirectShow Runtime.
apds.dll  10.0.26100.5074  Microsoft® Help Data Services Module
aphostclient.dll  10.0.26100.7309  Accounts Host Service RPC Client
aphostres.dll  10.0.26100.1  Accounts Host Resources
aphostservice.dll  10.0.26100.7920  Accounts Host Service
apisampling.dll  10.0.26100.7920  API Sampling
apisethost.appexecutionalias.dll  10.0.26100.7920  ApiSetHost.AppExecutionAlias
apisetschema.dll  10.0.26100.7705  ApiSet Schema DLL
apmon.dll  10.0.26100.7920  Adaptive Port Monitor
apmonui.dll  10.0.26100.7309  Adaptive Port Monitor UI
appcontracts.dll  10.0.26100.7309  Windows AppContracts API Server
appextension.dll  10.0.26100.7920  PackageExtension and AppExtension APIs
appfootprint.dll    
apphelp.dll  10.0.26100.7920  Application Compatibility Client Library
apphlpdm.dll  10.0.26100.5074  Application Compatibility Help Module
appidapi.dll  10.0.26100.3037  Application Identity APIs Dll
appidsvc.dll  10.0.26100.3037  Application Identity Service
appinfo.dll  10.0.26100.7920  Application Information Service
appinfoext.dll  10.0.26100.7309  appinfoext
appinstallerprompt.desktop.dll  10.0.26100.7309  AppInstaller Prompt Desktop
applicationcontrolcsp.dll  10.0.26100.7309  ApplicationControl Configuration Service Provider
applicationframe.dll  10.0.26100.7920  Application Frame
applicationtargetedfeaturedatabase.dll  10.0.26100.7920  ApplicationTargetedFeatureDatabase
applistbackuplauncher.dll  10.0.26100.7824  AppListBackupLauncher
applockercsp.dll  10.0.26100.7309  AppLockerCSP
appmon.dll  10.0.26100.7309  App Printer
appointmentactivation.dll  10.0.26100.7309  DLL for AppointmentActivation
appointmentapis.dll  10.0.26100.7309  DLL for CalendarRT
appraiser.dll  10.0.26100.7920  Compatibility Appraiser
appreadiness.dll  10.0.26100.7920  AppReadiness
apprepapi.dll  10.0.26100.4484  Application Reputation APIs Dll
appresolver.dll  10.0.26100.7920  App Resolver
appsruprov.dll  10.0.26100.7309  Application System Resource Usage Monitor (SRUM) provider
appxalluserstore.dll  10.0.26100.7920  AppX All User Store DLL
appxapplicabilityblob.dll  10.0.26100.7705  Appx Applicability Blob DLL
appxapplicabilityengine.dll  10.0.26100.7705  AppX Applicability Engine
appxdeploymentclient.dll  10.0.26100.7920  AppX Deployment Client DLL
appxdeploymentextensions.desktop.dll  10.0.26100.7920  AppX Deployment Extensions Desktop DLL
appxdeploymentextensions.onecore.dll  10.0.26100.7920  AppX Deployment Extensions OneCore DLL
appxdeploymentserver.dll  10.0.26100.8036  AppX Deployment Server DLL
appxpackaging.dll  10.0.26100.8036  Native Code Appx Packaging Library
appxsip.dll  10.0.26100.7920  Appx Subject Interface Package
appxstreamingdatasourceps.dll  10.0.26100.1150  APPX Streaming Data Source COM Proxy/Stub DLL
appxsysprep.dll  10.0.26100.7920  AppX Sysprep Provider
apx01000.dll  10.0.26100.7920  Audio Proxy DLL
apxsvc.dll  10.0.26100.7309  Windows Virtual Audio Device Proxy Service
archiveint.dll  3.8.4.0  Windows-internal libarchive library
asferror.dll  12.0.26100.1  ASF Error Definitions
aspnet_counters.dll  4.8.9221.0  Microsoft ASP.NET Performance Counter Shim DLL
assignedaccessruntime.dll  10.0.26100.7309  AssignedAccessRuntime
asycfilt.dll  10.0.26100.1  ASYCFILT.DLL
atl.dll  3.5.2284.0  ATL Module for Windows XP (Unicode)
atlthunk.dll  10.0.26100.1  atlthunk.dll
atmlib.dll  5.1.2.254  Windows NT OpenType/Type 1 API Library.
audioendpointbuilder.dll  10.0.26100.8036  Windows Audio Endpoint Builder
audioeng.dll  10.0.26100.8036  Audio Engine
audiohandlers.dll  10.0.26100.7920  Audio Settings Handlers Implementation
audiokse.dll  10.0.26100.8036  Audio Ks Endpoint
audioresourceregistrar.dll  10.0.26100.8036  AudioResourceRegistrar DLL
audioses.dll  10.0.26100.7920  Audio Session
audiosrv.dll  10.0.26100.8036  Windows Audio Service
audiosrvpolicymanager.dll  10.0.26100.7920  Windows Audio Service Policy Manager
auditcse.dll  10.0.26100.7019  Windows Audit Settings CSE
auditpolcore.dll  10.0.26100.7309  Audit Policy Program
authbroker.dll  10.0.26100.7309  Web Authentication WinRT API
authbrokerui.dll  10.0.26100.7705  AuthBroker UI
authext.dll  10.0.26100.7309  Authentication Extensions
authfwcfg.dll  10.0.26100.7019  Windows Defender Firewall with Advanced Security Configuration Helper
authfwgp.dll  10.0.26100.1150  Windows Defender Firewall with Advanced Security Group Policy Editor Extension
authfwsnapin.dll  10.0.26100.7920  Microsoft.WindowsFirewall.SnapIn
authfwwizfwk.dll  10.0.26100.1  Wizard Framework
authhostproxy.dll  10.0.26100.7019  Web Authentication Host Proxy
authui.dll  10.0.26100.7920  Windows Authentication UI
authz.dll  10.0.26100.7920  Authorization Framework
automaticappsigninpolicy.dll  10.0.26100.7309  Automatic App Sign In policy
autopilot.dll  10.0.26100.7705  AutoPilot
autopilotdiag.dll  10.0.26100.1150  ETW for Autopilot Diagnostics
autoplay.dll  10.0.26100.7920  AutoPlay Control Panel
autotimesvc.dll  10.0.26100.7309  AutoTime Service
avicap32.dll  10.0.26100.1150  AVI Capture window class
avifil32.dll  10.0.26100.7309  Microsoft AVI File support library
avrt.dll  10.0.26100.7309  Multimedia Realtime Runtime
axinstsv.dll  10.0.26100.7920  ActiveX Installer Service
azroles.dll  10.0.26100.1882  azroles Module
azroleui.dll  10.0.26100.1150  Authorization Manager
azsqlext.dll  10.0.26100.1150  AzMan Sql Audit Extended Stored Procedures Dll
backgroundmediapolicy.dll  10.0.26100.7309  <d> Background Media Policy DLL
bamsettingsclient.dll  10.0.26100.1882  Background Activity Moderator Settings Client
barcodeprovisioningplugin.dll  10.0.26100.7309  Barcode Provisioning Plugin
basecsp.dll  10.0.26100.8037  Microsoft Base Smart Card Crypto Provider
basesrv.dll  10.0.26100.7920  Windows NT BASE API Server DLL
batmeter.dll  10.0.26100.7705  Battery Meter Helper DLL
bcastdvr.proxy.dll  10.0.26100.1150  Broadcast DVR Proxy
bcastdvrbroker.dll  10.0.26100.7309  Windows Runtime BcastDVRBroker DLL
bcastdvrclient.dll  10.0.26100.7309  Windows Runtime BcastDVRClient DLL
bcastdvrcommon.dll  10.0.26100.7309  Windows Runtime BcastDVRCommon DLL
bcastdvruserservice.dll  10.0.26100.8036  Broadcast DVR User Service
bcd.dll  10.0.26100.4202  BCD DLL
bcdprov.dll  10.0.26100.1  Boot Configuration Data WMI Provider
bcdsrv.dll  10.0.26100.1  Boot Configuration Data COM Server
bcp47langs.dll  10.0.26100.7309  BCP47 Language Classes
bcp47mrm.dll  10.0.26100.7309  BCP47 Language Classes for Resource Management
bcrypt.dll  10.0.26100.7623  Windows Cryptographic Primitives Library
bcryptprimitives.dll  10.0.26100.7623  Windows Cryptographic Primitives Library
bdehdcfglib.dll  10.0.26100.1  Windows BitLocker Drive Preparation Tool
bderepair.dll  10.0.26100.4768  BitLocker Drive Encryption: Drive Repair Tool
bdesvc.dll  10.0.26100.7920  BDE Service
bdeui.dll  10.0.26100.7920  Windows BitLocker Drive Encryption User Interface
bfe.dll  10.0.26100.7920  Base Filtering Engine
bi.dll  10.0.26100.1  Background Broker Infrastructure Client Library
bidispl.dll  10.0.26100.7309  Bidispl DLL
bindfltapi.dll  10.0.26100.7309  BindFlt user mode API
bingasds.dll  10.0.26100.7309  Microsoft Bing Auto Suggestion Datasource Dll
bingfilterds.dll  10.0.26100.7309  "BingFilterDS.DYNLINK"
bingmaps.dll  10.0.26100.7705  Bing Map Control
bingonlineservices.dll  10.0.26100.7309  Bing online services
biocredprov.dll  10.0.26100.7920  WinBio Credential Provider
bisrv.dll  10.0.26100.7920  Background Tasks Infrastructure Service
bitlockercsp.dll  10.0.26100.7920  BitLockerCSP
bitsigd.dll  7.8.26100.1150  Background Intelligent Transfer Service IGD Support
bitsperf.dll  7.8.26100.6725  Perfmon Counter Access
bitsproxy.dll  7.8.26100.5074  Background Intelligent Transfer Service Proxy
biwinrt.dll  10.0.26100.7705  Windows Background Broker Infrastructure
blb_ps.dll  10.0.26100.1  Microsoft® Block Level Backup proxy/stub
blbevents.dll  10.0.26100.1  Blb Publisher
blbres.dll  10.0.26100.1  Microsoft® Block Level Backup Engine Service Resources
bluetoothapis.dll  10.0.26100.7920  Bluetooth Usermode Api host
bluetoothdesktophandlers.dll  10.0.26100.7920  Bluetooth Desktop Handlers
bluetoothopppushclient.dll    
bnmanager.dll  10.0.26100.7920  Battery Notification Manager
bootcriticalupdateplugin.dll  1.0.0.1  BootCriticalUpdate Plugin for WinRE boot failure scenario
bootmenuux.dll  10.0.26100.7920  BootMenuUX
bootstr.dll  10.0.26100.1  Boot String Resource Library
bootsvc.dll  10.0.26100.7920  BOOTSVC DLL
bootux.dll  10.0.26100.7920  bootux
bootvid.dll  10.0.26100.4202  VGA Boot Driver
bridgeres.dll  10.0.26100.2454  Bridge Resources
brokerfiledialog.dll  10.0.26100.7309  brokerfiledialog
brokerlib.dll  10.0.26100.1150  Broker Base Library
browcli.dll  10.0.26100.1150  Browser Service Client DLL
browserbroker.dll  11.0.26100.7309  BrowserBroker
browseui.dll  10.0.26100.1  Shell Browser UI Library
btagservice.dll  10.0.26100.7920  Bluetooth Audio Gateway Service
bthavctpsvc.dll  10.0.26100.7920  Bluetooth AVCTP Service DLL
bthavrcp.dll  10.0.26100.7920  Bluetooth AVRCP Service DLL
bthavrcpappsvc.dll  10.0.26100.4061  Bluetooth AVRCP Application Bridge Service DLL
bthci.dll  10.0.26100.7309  Bluetooth Class Installer
bthmtpcontexthandler.dll  10.0.26100.1150  Bluetooth MTP Context Menu Handler
bthpanapi.dll  10.0.26100.7309  bthpanapi
bthpancontexthandler.dll  10.0.26100.7309  Bluetooth PAN Context-Menu Handler
bthradiomedia.dll  10.0.26100.7309  Bluetooth Radio Media Provider
bthserv.dll  10.0.26100.7920  Bluetooth Support Service
bthtelemetry.dll  10.0.26100.7920  Bluetooth Telemetry Agent
btpanui.dll  10.0.26100.1882  Bluetooth PAN User Interface
bwcontexthandler.dll  1.0.0.1  ContextH Application
c_g18030.dll  10.0.26100.7623  GB18030 DBCS-Unicode Conversion DLL
c_gsm7.dll  10.0.26100.7623  GSM 7bit Code Page Translation DLL for SMS
c_is2022.dll  10.0.26100.7623  ISO-2022 Code Page Translation DLL
c_iscii.dll  10.0.26100.1  ISCII Code Page Translation DLL
cabapi.dll  10.0.26100.7309  Mobile Cabinet Library
cabinet.dll  5.0.1.1  Microsoft® Cabinet File API
cabview.dll  10.0.26100.7309  Cabinet File Viewer Shell Extension
callbuttons.dll  10.0.26100.7309  Windows Runtime CallButtonsServer DLL
callbuttons.proxystub.dll  10.0.26100.4202  Windows Runtime CallButtonsServer ProxyStub DLL
callhistoryclient.dll  10.0.26100.5074  Client DLL for accessing CallHistory information
cameracaptureui.dll  10.0.26100.7309  Microsoft® Windows® Operating System
camext.dll    
capabilityaccesshandlers.dll  10.0.26100.7920  Capability Access Manager - Handlers' Shared DLL
capabilityaccessmanager.desktop.storage.dll  10.0.26100.7920  CapabilityAccessManager.Desktop.Storage
capabilityaccessmanager.dll  10.0.26100.7920  Capability Access Manager Service
capabilityaccessmanagerclient.dll  10.0.26100.7920  Capability Access Manager Client
capauthz.dll  10.0.26100.7309  Capability Authorization APIs
capiprovider.dll  10.0.26100.7309  capiprovider DLL
capisp.dll  10.0.26100.1  Sysprep cleanup dll for CAPI
captureservice.dll  10.0.26100.7920  Microsoft Windows Capture User Service
castingshellext.dll  10.0.26100.1150  Casting Shell Extensions
castlaunch.dll  10.0.26100.7309  Casting protocol app manager and launcher
catsrv.dll  2001.12.10941.16384  COM+ Configuration Catalog Server
catsrvps.dll  2001.12.10941.16384  COM+ Configuration Catalog Server Proxy/Stub
catsrvut.dll  2001.12.10941.16384  COM+ Configuration Catalog Server Utilities
cbdhsvc.dll  10.0.26100.7309  Microsoft (R) Clipboard History
cca.dll  10.0.26100.1882  CCA DirectShow Filter.
cdd.dll  10.0.26100.7920  Canonical Display Driver
cdosys.dll  6.6.26100.5074  Microsoft CDO for Windows Library
cdp.dll  10.0.26100.7920  Microsoft (R) CDP Client API
cdprt.dll  10.0.26100.7920  Microsoft (R) CDP Client WinRT API
cdpsvc.dll  10.0.26100.8036  Microsoft (R) CDP Service
cdpusersvc.dll  10.0.26100.7920  Microsoft (R) CDP User Components
cellulardatacapabilityhandler.dll  10.0.26100.7309  Windows cellularData Capability Handler
cemapi.dll  10.0.26100.7309  CEMAPI
certca.dll  10.0.26100.7920  Microsoft® Active Directory Certificate Services CA
certcli.dll  10.0.26100.7920  Microsoft® Active Directory Certificate Services Client
certcredprovider.dll  10.0.26100.4484  Cert Credential Provider
certenc.dll  10.0.26100.7920  Active Directory Certificate Services Encoding
certenroll.dll  10.0.26100.7920  Microsoft® Active Directory Certificate Services Enrollment Client
certenrollui.dll  10.0.26100.7920  X509 Certificate Enrollment UI
certmgr.dll  10.0.26100.5074  Certificates snap-in
certpkicmdlet.dll  10.0.26100.7019  Microsoft® PKI Client Cmdlets
certpoleng.dll  10.0.26100.7920  Certificate Policy Engine
certprop.dll  10.0.26100.8037  Microsoft Smartcard Certificate Propagation Service
cewmdm.dll  12.0.26100.7309  Windows CE WMDM Service Provider
cfgbkend.dll  10.0.26100.5074  Configuration Backend Interface
cfgmgr32.dll  10.0.26100.7309  Configuration Manager DLL
cfgspcellular.dll  10.0.26100.7309  Configuration Service Provider CMCellularEntries
cfgsppolicy.dll  10.0.26100.7309  Configuration Service Provider CMPolicy
cflapi.dll  10.0.26100.7309  CXH from LogonUI API
cfmifs.dll  10.0.26100.5074  FmIfs Engine
cfmifsproxy.dll  10.0.26100.4484  Microsoft® FmIfs Proxy Library
chakra.dll  11.0.26100.7920  Microsoft ® Chakra (Private)
chakradiag.dll  11.0.26100.7920  Microsoft ® Chakra Diagnostics (Private)
chakrathunk.dll  10.0.26100.7920  chakrathunk.dll
chartv.dll  10.0.26100.1  Chart View
chatapis.dll  10.0.26100.7309  DLL for ChatRT
chsstrokeds.dll  10.0.26100.7309  "ChsStrokeDS.DYNLINK"
chtbopomofods.dll  10.0.26100.7309  "ChtBopomofoDS.DYNLINK"
chtcangjieds.dll  10.0.26100.7309  "ChtCangjieDS.DYNLINK"
chthkstrokeds.dll  10.0.26100.7309  "ChtHkStrokeDS.DYNLINK"
chtquickds.dll  10.0.26100.7309  "ChtQuickDS.DYNLINK"
chxapds.dll  10.0.26100.7309  "ChxAPDS.DYNLINK"
chxdecoder.dll  10.0.26100.7309  "ChxDecoder.DYNLINK"
chxhapds.dll  10.0.26100.7309  "ChxHAPDS.DYNLINK"
chxinputrouter.dll  10.0.26100.7309  "ChxInputRouter.DYNLINK"
chxranker.dll  10.0.26100.7309  "ChxRanker.DYNLINK"
chxreadingstringime.dll  10.0.26100.1150  CHxReadingStringIME
ci.dll  10.0.26100.8036  Code Integrity Module
cic.dll  10.0.26100.5074  CIC - MMC controls for Taskpad
cimfs.dll  10.0.26100.7920  CimFS user mode API
circoinst.dll  10.0.26100.1150  USB Consumer IR Driver coinstaller for eHome
clbcatq.dll  2001.12.10941.16384  COM+ Configuration Catalog
cldapi.dll  10.0.26100.7920  Cloud API user mode API
cleanpccsp.dll  10.0.26100.7309  CleanPCCSP
clfsw32.dll  10.0.26100.7920  Common Log Marshalling Win32 DLL
cliconfg.dll  10.0.26100.1150  SQL Client Configuration Utility DLL
clipboardserver.dll  10.0.26100.7623  Modern Clipboard API Server
clipc.dll  10.0.26100.1882  Client Licensing Platform Client
clipsvc.dll  10.0.26100.8036  Client License Service
clipwinrt.dll  10.0.26100.7920  ClipWinRT
cloudap.dll  10.0.26100.8036  Cloud AP Security Package
clouddesktopcsp.dll  10.0.26100.7705  CloudDesktopCSP
clouddomainjoinaug.dll  10.0.26100.7309  CloudDomainJoinAuthenticUserGesture
clouddomainjoindatamodelserver.dll  10.0.26100.7920  CloudDomainJoinDataModelServer
cloudexperiencehost.dll  10.0.26100.7920  CloudExperienceHost
cloudexperiencehostbroker.dll  10.0.26100.7920  CloudExperienceHostBroker
cloudexperiencehostcommon.dll  10.0.26100.7920  CloudExperienceHostCommon
cloudexperiencehostredirection.dll    
cloudexperiencehostuser.dll  10.0.26100.7920  CloudExperienceHost User Operations
cloudidwxhextension.dll    
cloudrecoverydownloadtool.dll  0.2.708.0  Microsoft Cloud Recovery Download Tool
cloudrestorelauncher.dll  10.0.26100.7920  CloudRestoreLauncher Task
clrhost.dll  10.0.26100.1  In Proc server for managed servers in the Windows Runtime
clusapi.dll  10.0.26100.7920  Cluster API Library
cmcfg32.dll  7.2.26100.1150  Microsoft Connection Manager Configuration Dll
cmdext.dll  10.0.26100.7309  cmd.exe Extension DLL
cmdial32.dll  7.2.26100.1  Microsoft Connection Manager
cmgrcspps.dll  10.0.26100.4202  cmgrcspps
cmifw.dll  10.0.26100.8036  Windows Defender Firewall rule configuration plug-in
cmintegrator.dll  10.0.26100.7920  cmintegrator.dll
cmlua.dll  7.2.26100.1  Connection Manager Admin API Helper
cmpbk32.dll  7.2.26100.1  Microsoft Connection Manager Phonebook
cmstplua.dll  7.2.26100.1  Connection Manager Admin API Helper for Setup
cmutil.dll  7.2.26100.1150  Microsoft Connection Manager Utility Lib
cngcredui.dll  10.0.26100.7019  Microsoft CNG CredUI Provider
cngprovider.dll  10.0.26100.7309  cngprovider DLL
cnvfat.dll  10.0.26100.7623  FAT File System Conversion Utility DLL
codeintegrityaggregator.dll  10.0.26100.7920  Code Integrity Aggregator
cofiredm.dll  10.0.26100.1882  Corrupted File Recovery Diagnostic Module
colbact.dll  2001.12.10941.16384  COM+
colorcnv.dll  10.0.26100.7309  Windows Media Color Conversion
colorui.dll  10.0.26100.7705  Microsoft Color Control Panel
combase.dll  10.0.26100.7920  Microsoft COM for Windows
comcat.dll  10.0.26100.1  Microsoft Component Category Manager Library
comctl32.dll  5.82.26100.8037  User Experience Controls Library
comdlg32.dll  10.0.26100.7920  Common Dialogs DLL
coml2.dll  10.0.26100.7705  Microsoft COM for Windows
compataggregator.dll    
composableshellproxystub.dll  10.0.26100.3624  Composable Shell Shared Proxy Stub
composerframework.dll  10.0.26100.7309  Composer framework for Composable Shell
comppkgsup.dll  10.0.26100.7920  Component Package Support DLL
compstui.dll  10.0.26100.5074  Common Property Sheet User Interface DLL
computecore.dll  10.0.26100.7920  Hyper-V Host Compute Service Core Client Library
computelibeventlog.dll  10.0.26100.4202  Hyper-V Host Compute Service Client Library Event Log Resource Dll
computenetwork.dll  10.0.26100.7309  Hyper-V Host Networking Service Client Library
computestorage.dll  10.0.26100.7920  Hyper-V Host Compute Service Storage Client Library
comrepl.dll  2001.12.10941.16384  COM+
comres.dll  2001.12.10941.16384  COM+ Resources
comsnap.dll  2001.12.10941.16384  COM+ Explorer MMC Snapin
comsvcs.dll  2001.12.10941.16384  COM+ Services
comuid.dll  2001.12.10941.16384  COM+ Explorer UI
configmanager2.dll  10.0.26100.7920  ConfigManager
configureexpandedstorage.dll  10.0.26100.7309  ConfigureExpandedStorage
connect.dll  10.0.26100.7309  Get Connected Wizards
connectedaccountstate.dll  10.0.26100.7309  ConnectedAccountState.dll
connectionattributionapi.dll  10.0.26100.7309  Microsoft Trust for Connected Experiences Connection Attribution API DLL
consentexperiencecommon.dll  10.0.26100.7920  In-Proc WinRT server for Windows.Internal.PlatformExtensions.ConsentExperienceCommon
consentux.dll  10.0.26100.7920  Device Broker Consent Prompt
consentuxclient.dll  10.0.26100.7920  Implementation of client-side Consent UX API
console.dll  10.0.26100.7309  Control Panel Console Applet
consolelogon.dll  10.0.26100.7309  Console Logon User Experience
constraintindex.search.dll  10.0.26100.7920  Constraint Index Search
contactactivation.dll  10.0.26100.7309  DLL for ContactActivation
contactapis.dll  10.0.26100.7309  DLL for ContactsRT
contactharvesterds.dll  10.0.26100.7309  Microsoft Contact Harvester Datasource Dll
container.dll  10.0.26100.7309  Windows Containers
containerdevicemanagement.dll  10.0.26100.7309  Container Device Management library
contentdeliverymanager.utilities.dll  10.0.26100.7920  ContentDeliveryManager.Utilities
controlcenter.dll    
coreaudiopolicymanagerext.dll  10.0.26100.1150  "coreaudiopolicymanagerext.DYNLINK"
coredpus.dll  10.0.26100.7309  coredpus
coreglobconfig.dll  10.0.26100.7309  Core Globalization Configuration
coremas.dll    
coremessaging.dll  10.0.26100.7920  Microsoft CoreMessaging Dll
coremmres.dll  10.0.26100.1  General Core Multimedia Resources
coreprivacysettingsstore.dll  10.0.26100.7309  CorePrivacySettingsStore
coreshell.dll  10.0.26100.7824  CoreShell
coreshellapi.dll  10.0.26100.7824  CoreShellAPI
coreshellextframework.dll  10.0.26100.7309  Core Shell SI Host Extension Framework for Composable Shell
coreuicomponents.dll  10.0.26100.7627  Microsoft Core UI Components Dll
correngine.dll  10.0.26100.7920  Correlation Engine
courtesyengine.dll  10.0.26100.7309  Microsoft Feedback Courtesy Engine DLL Server
cpfilters.dll  10.0.26100.7920   PTFilter & Encypter/Decrypter Tagger Filters.
creddialogbroker.dll  10.0.26100.7920  Credential Dialog Broker
credentialenrollmentmanagerforuser.dll  10.0.26100.7309  Credential Enrollment Manager ForUser API
credprov2fahelper.dll  10.0.26100.7309  Credential Provider 2FA Helper
credprovcommoncore.dll  10.0.26100.7705  Microsoft (R) Credential Provider Common Core
credprovdatamodel.dll  10.0.26100.7920  Cred Prov Data Model
credprovhelper.dll  10.0.26100.7920  Credential Provider Helper
credprovhost.dll  10.0.26100.7920  Credential Provider Framework Host
credprovs.dll  10.0.26100.7920  Credential Providers
credprovslegacy.dll  10.0.26100.7920  Credential Providers Legacy
credssp.dll  10.0.26100.4652  Credential Delegation Security Package
credui.dll  10.0.26100.7309  Credential Manager User Interface
crypt32.dll  10.0.26100.7309  Crypto API32
cryptbase.dll  10.0.26100.7623  Base cryptographic API DLL
cryptcatsvc.dll  10.0.26100.7920  Cryptographic Catalog Services
cryptdlg.dll  10.0.26100.1882  Microsoft Common Certificate Dialogs
cryptdll.dll  10.0.26100.5074  Cryptography Manager
cryptext.dll  10.0.26100.5074  Crypto Shell Extensions
cryptnet.dll  10.0.26100.7309  Crypto Network Related API
cryptngc.dll  10.0.26100.7920  Microsoft Passport API
cryptoss.dll  10.0.26100.7309  Crypto Open Source
cryptowinrt.dll  10.0.26100.7920  Crypto WinRT Library
cryptsp.dll  10.0.26100.7705  Cryptographic Service Provider API
cryptsvc.dll  10.0.26100.7309  Cryptographic Services
crypttpmeksvc.dll  10.0.26100.1150  Cryptographic TPM Endorsement Key Services
cryptui.dll  10.0.26100.7309  Microsoft Trust UI Provider
cryptuiwizard.dll  10.0.26100.1150  Microsoft Trust UI Provider
cryptxml.dll  10.0.26100.7019  XML DigSig API
cscapi.dll  10.0.26100.1  Offline Files Win32 API
cscdll.dll  10.0.26100.1  Offline Files Temporary Shim
cspcellularsettings.dll  10.0.26100.7309  Configuration Service Provider CellSettings
csplte.dll  10.0.26100.7309  Configuration Service Provider LTE
cspproxy.dll  10.0.26100.5074  CM_ProxyEntries Configuration Service Provider
csrsrv.dll  10.0.26100.7920  Client Server Runtime Process
csystemeventsbrokerclient.dll  10.0.26100.1150  Classic System Events Broker Client Library
cxcredprov.dll  10.0.26100.7920  Cloud Experience Credential Provider
cxhprovisioningserver.dll  10.0.26100.7920  CXHProvisioningServer
d2d1.dll  10.0.26100.7920  Microsoft D2D Library
d3d10.dll  10.0.26100.1150  Direct3D 10 Runtime
d3d10_1.dll  10.0.26100.1882  Direct3D 10.1 Runtime
d3d10_1core.dll  10.0.26100.1882  Direct3D 10.1 Runtime
d3d10core.dll  10.0.26100.1882  Direct3D 10 Runtime
d3d10level9.dll  10.0.26100.7309  Direct3D 10 to Direct3D9 Translation Runtime
d3d10warp.dll  10.0.26100.7309  Direct3D Rasterizer
d3d11.dll  10.0.26100.7920  Direct3D 11 Runtime
d3d11on12.dll  10.0.26100.7920  Direct3D 11On12 Runtime
d3d12.dll  10.0.26100.7920  Direct3D 12 Runtime
d3d12core.dll  10.0.26100.7920  Direct3D 12 Core Runtime
d3d8thk.dll  10.0.26100.7920  Microsoft Direct3D OS Thunk Layer
d3d9.dll  10.0.26100.7920  Direct3D 9 Runtime
d3d9on12.dll  10.0.26100.7920  Direct3D9 DDI to Direct3D12 API Mapping Layer
d3dcompiler_47.dll  10.0.26100.8036  Direct3D HLSL Compiler
d3dscache.dll  10.0.26100.7309  Microsoft (R) D3D Shader Caching Library
dab.dll  10.0.26100.7019  Desktop Activity Broker DLL
dabapi.dll  10.0.26100.1  Desktop Activity Broker API
dafaspinfraprovider.dll  10.0.26100.7309  Windows AspInfra DAF Plugin
dafbth.dll  10.0.26100.7920  Bluetooth Device Association Framework Provider
dafdnssd.dll  10.0.26100.7920  DAF DnsSd Provider
dafdockingprovider.dll  10.0.26100.7309  Windows Wireless Docking DAF Plugin
dafescl.dll  10.0.26100.7920  ESCL DAF Provider
dafgip.dll  10.0.26100.7309  DAF GIP Provider
dafipp.dll  10.0.26100.7920  IPP DAF Provider
dafmcp.dll  10.0.26100.7920  MCP DAF Provider
dafpos.dll  10.0.26100.7309  Point Of Service DAF Provider
dafprintprovider.dll  10.0.26100.7309  DAF Print Provider DLL
dafupnp.dll  10.0.26100.7309  DAF UPnP Provider
dafwcn.dll  10.0.26100.7705  Windows Connect Now DAF Plugin
dafwfdprovider.dll  10.0.26100.7920  Windows Wi-Fi Direct DAF Plugin
dafwiprov.dll  10.0.26100.7309  DAF Printer WiFi Provisioning Provider
dafwsd.dll  10.0.26100.7309  DAF WSD Provider
damediamanager.dll  10.0.26100.7309  Windows DA Media Manager DLL
daotpcredentialprovider.dll  10.0.26100.5074  DirectAccess One-Time Password Credential Provider
das.dll  10.0.26100.8036  Device Association Service
dataclen.dll  10.0.26100.7309  Disk Space Cleaner for Windows
dataexchange.dll  10.0.26100.7705  Data exchange
davclnt.dll  10.0.26100.1  Web DAV Client DLL
davhlpr.dll  10.0.26100.1  DAV Helper DLL
davsyncprovider.dll  10.0.26100.7309  DAV sync engine for contacts, calendar
daxexec.dll  10.0.26100.7920  daxexec
dbgcore.dll  10.0.26100.7920  Windows Core Debugging Helpers
dbgeng.dll  10.0.26100.1  Windows Symbolic Debugger Engine
dbghelp.dll  10.0.26100.5074  Windows Image Helper
dbgmodel.dll  10.0.26100.1  Windows Debugger Data Model
dbnetlib.dll  10.0.26100.1150  Winsock Oriented Net DLL for SQL Clients
dbnmpntw.dll  10.0.26100.1  Named Pipes Net DLL for SQL Clients
dciman32.dll  10.0.26100.7705  DCI Manager
dcntel.dll  10.0.26100.7920  dcntel
dcomp.dll  10.0.26100.7920  Microsoft DirectComposition Library
dcsvc.dll  10.0.26100.7920  dcsvc
ddaclsys.dll  10.0.26100.1  SysPrep module for Resetting Data Drive ACL
ddcclaimsapi.dll  10.0.26100.1150  DdcClaimsApi
ddccomimplementationsdesktop.dll  10.0.26100.7309  DdcComImplementationsDesktop
ddds.dll  10.0.26100.7309  Microsoft Dynamic Datasource Dll
ddisplay.dll  10.0.26100.7920  DirectDisplay
ddoiproxy.dll  10.0.26100.1  DDOI Interface Proxy
ddores.dll  10.0.26100.1  Device Category information and resources
ddraw.dll  10.0.26100.7705  Microsoft DirectDraw
ddrawex.dll  10.0.26100.4652  Direct Draw Ex
declaredconfiguration.dll  10.0.26100.7309  declaredconfiguration
defaultdevicemanager.dll  10.0.26100.1150  Default Device Manager
defaultprinterprovider.dll  10.0.26100.1  Microsoft Windows Default Printer Provider
defragproxy.dll  10.0.26100.7705  Microsoft® Drive Optimizer Proxy Library
defragres.dll  10.0.26100.7705  Microsoft\Drive Optimizer Resources
defragsvc.dll  10.0.26100.7705  Microsoft\Drive Optimizer
delegatorprovider.dll  10.0.26100.7920  WMI PassThru Provider for Storage Management
deploymentcsps.dll  10.0.26100.5074  Deployment CSP DLL
deskadp.dll  10.0.26100.4484  Advanced display adapter properties
deskmon.dll  10.0.26100.1150  Advanced display monitor properties
desktopshellappstatecontract.dll  10.0.26100.7309  Desktop Switcher Data Model
desktopshellext.dll  10.0.26100.7920  DesktopHost Extensions
desktopswitcherdatamodel.dll  10.0.26100.7824  Desktop Switcher Data Model
devdispitemprovider.dll  10.0.26100.7920  DeviceItem inproc devquery subsystem
developeroptionssettingshandlers.dll  10.0.26100.7920  DeveloperOptions Handlers Implementation
devenum.dll  10.0.26100.7309  Device enumeration.
deviceaccess.dll  10.0.26100.7920  Device Broker And Policy COM Server
deviceassociation.dll  10.0.26100.8036  Device Association Client DLL
devicecenter.dll  10.0.26100.7920  Device Center
devicecompanionappinstall.dll  10.0.26100.5074  Device Companion App Installation Client
devicecredential.dll  10.0.26100.7309  Microsoft Companion Authenticator Client
devicedirectoryclient.dll  10.0.26100.7309  DeviceDirectoryClient Task
devicedisplaystatusmanager.dll  10.0.26100.1  Device Display Status Manager
devicedriverretrievalclient.dll  10.0.26100.7705  Device Driver Retrieval Client
deviceelementsource.dll  10.0.26100.7920  DeviceElementSource
deviceflows.datamodel.dll  10.0.26100.7920  DeviceFlows DataModel
devicemetadataretrievalclient.dll  10.0.26100.4202  Windows MRC
devicengccredprov.dll  10.0.26100.7920  Microsoft Companion Authenticator Credential Provider
devicepairing.dll  10.0.26100.7309  Shell extensions for Device Pairing
devicepairingexperiencemem.dll  10.0.26100.7309  Device Pairing Experience contract implementation
devicepairingfolder.dll  10.0.26100.7920  Device Pairing Folder
devicepairingproxy.dll  10.0.26100.3624  Device Pairing Proxy Dll
devicereactivation.dll  10.0.26100.7920  DeviceReactivation
deviceregistration.dll  10.0.26100.3323  Device Registration DLL
devicesetupmanager.dll  10.0.26100.7920  Device Setup Manager
devicesetupmanagerapi.dll  10.0.26100.7920  Device Setup Manager Client API
devicesetupstatusprovider.dll  10.0.26100.7920  Device Setup Status Provider Dll
devicesflowbroker.dll  10.0.26100.7920  DevicesFlow Broker
devicesoftwareinstallationclient.dll  10.0.26100.7705  Device Software Installation Client
deviceupdateagent.dll  10.0.26100.7309  Device Update Agent
deviceuxres.dll  10.0.26100.1  Windows Device User Experience Resource File
devinv.dll  10.0.26100.7920  Device Inventory Library
devmgr.dll  10.0.26100.7309  Device Manager MMC Snapin
devobj.dll  10.0.26100.1150  Device Information Set DLL
devpropmgr.dll  10.0.26100.7309  Microsoft Windows Device Property Manager
devquerybroker.dll  10.0.26100.7309  DevQuery Background Discovery Broker
devrtl.dll  10.0.26100.1882  Device Management Run Time Library
dfdts.dll  10.0.26100.1150  Windows Disk Failure Diagnostic Module
dfscli.dll  10.0.26100.1150  Windows NT Distributed File System Client DLL
dfshim.dll  10.0.26100.1882  ClickOnce Application Deployment Support Library
dfsshlex.dll  10.0.26100.1150  Distributed File System shell extension
dhcpcmonitor.dll  10.0.26100.7920  DHCP Client Monitor Dll
dhcpcore.dll  10.0.26100.7920  DHCP Client Service
dhcpcore6.dll  10.0.26100.7920  DHCPv6 Client
dhcpcsvc.dll  10.0.26100.7920  DHCP Client Service
dhcpcsvc6.dll  10.0.26100.7920  DHCPv6 Client
dhcpsapi.dll  10.0.26100.1150  DHCP Server API Stub DLL
diagcpl.dll  10.0.26100.7309  Troubleshooting Control Panel
diagnosticdataquery.dll  10.0.26100.7920  Microsoft Windows Diagnostic data Helper API
diagnosticdatasettings.dll  10.0.26100.7019  Microsoft Windows Diagnostic Data Settings
diagnosticinvoker.dll  10.0.26100.7309  Microsoft Windows operating system.
diagnosticlogcsp.dll  10.0.26100.7309  DiagnosticLogCSP
diagperf.dll  10.0.26100.7309  Microsoft Performance Diagnostics
diagsvc.dll  10.0.26100.7309  Microsoft Windows operating system
diagtrack.dll  10.0.26100.7920  Microsoft Windows Diagnostics Tracking
dialclient.dll  10.0.26100.7309  DIAL DLL
dialserver.dll  10.0.26100.7309  DIAL Server DLL
dictationmanager.dll  10.0.0.1  Dictation Manager
difxapi.dll  2.1.0.0  Driver Install Frameworks for API library module
dimsjob.dll  10.0.26100.7309  DIMS Job DLL
dimsroam.dll  10.0.26100.7309  Key Roaming DIMS Provider DLL
dinput.dll  10.0.26100.1591  Microsoft DirectInput
dinput8.dll  10.0.26100.1591  Microsoft DirectInput
direct2ddesktop.dll  10.0.26100.1  Microsoft Direct2D Desktop Components
directmanipulation.dll  10.0.26100.7920  Microsoft Direct Manipulation Component
directml.dll  1.15.5.0  DirectML Library
directsr.dll    
directxdatabasehelper.dll  10.0.26100.7920  DirectXDatabaseHelper
discan.dll  10.0.26100.7309  Data Integrity Scan Task
dismapi.dll  10.0.26100.7920  DISM API Framework
dispbroker.desktop.dll  10.0.26100.7920  Desktop Display Broker
dispbroker.dll  10.0.26100.7705  Display Broker API
dispex.dll  10.0.26100.7920  Microsoft ® DispEx
display.dll  10.0.26100.7705  Display Control Panel
displaymanager.dll  10.0.26100.7309  DisplayManager
dlnashext.dll  10.0.26100.7309  DLNA Namespace DLL
dmalertlistener.proxystub.dll  10.0.26100.7705  ProxyStub for DeviceManagment Alert
dmapisetextimpldesktop.dll  10.0.26100.7309  DmApiSetExtImplDesktop
dmappsres.dll  10.0.26100.4202  DMAppsRes
dmcfgutils.dll  10.0.26100.7309  dmcfgutils
dmcmnutils.dll  10.0.26100.7920  dmcmnutils
dmcommandlineutils.dll  10.0.26100.1  dmcommandlineutils
dmcsps.dll  10.0.26100.7309  dmcsps
dmdlgs.dll  10.0.26100.4202  Disk Management Snap-in Dialogs
dmdskmgr.dll  10.0.26100.5074  Disk Management Snap-in Support Library
dmdskres.dll  10.0.26100.4202  Disk Management Snap-in Resources
dmdskres2.dll  10.0.26100.4202  Disk Management Snap-in Resources
dmenrollengine.dll  10.0.26100.7920  Enroll Engine DLL
dmenterprisediagnostics.dll  10.0.26100.7309  ETW for MDM Enterprise Diagnostics
dmintf.dll  10.0.26100.4202  Disk Management DCOM Interface Stub
dmiso8601utils.dll  10.0.26100.1  dmiso8601utils
dmloader.dll  10.0.26100.7309  Microsoft DirectMusic Loader
dmocx.dll  10.0.26100.1882  TreeView OCX
dmoleaututils.dll  10.0.26100.5074  dmoleaututils
dmosconfig.dll  10.0.26100.7920  DmOsConfig
dmprocessxmlfiltered.dll  10.0.26100.7309  dmprocessxmlfiltered
dmpushproxy.dll  10.0.26100.5074  dmpushproxy
dmpushroutercore.dll  10.0.26100.7309  MDM Pushrouter
dmrcdecoder.dll    
dmrserver.dll  10.0.26100.7309  Digital Media Receiver DLL
dmsynth.dll  10.0.26100.1882  Microsoft DirectMusic Software Synthesizer
dmusic.dll  10.0.26100.7309  Microsoft DirectMusic Core Services
dmutil.dll  10.0.26100.4202  Logical Disk Manager Utility Library
dmvdsitf.dll  10.0.26100.1  Disk Management Snap-in Support Library
dmwappushsvc.dll  10.0.26100.7309  dmwappushsvc
dmwmicsp.dll  10.0.26100.3323  dmwmicsp
dmxmlhelputils.dll  10.0.26100.7309  dmxmlhelputils
dnsapi.dll  10.0.26100.7920  DNS Client API DLL
dnsclientcsp.dll    
dnscmmc.dll  10.0.26100.8036  DNS Client MMC Snap-in DLL
dnsext.dll  10.0.26100.1  DNS extension DLL
dnsrslvr.dll  10.0.26100.7920  DNS Caching Resolver Service
docking.virtualinput.dll  10.0.26100.7920  Docking.VirtualInput
dockinterface.proxystub.dll  10.0.26100.2161  Windows Wireless Docking DockInterface Proxy/Stub DLL
doclient.dll  1451.2601.23012.0  Delivery Optimization Client
docprop.dll  10.0.26100.5074  OLE DocFile Property Page
documentperformanceevents.dll  10.0.26100.1  Documents and Printing Performance Events
dolbydecmft_redirect.dll  10.0.26100.4202  Media Foundation Dolby Digital Atmos Decoders
domgmt.dll  10.0.26100.7309  Delivery Optimization Management
domiprov.dll  1451.2510.27012.0  Delivery Optimization MI Provider
dosettings.dll  10.0.26100.7920  Delivery Optimization Settings
dosvc.dll  10.0.26100.7920  Delivery Optimization
dot3api.dll  10.0.26100.7309  802.3 Autoconfiguration API
dot3cfg.dll  10.0.26100.7309  802.3 Netsh Helper
dot3gpclnt.dll  10.0.26100.7309  802.3 Group Policy Client
dot3gpui.dll  10.0.26100.7705  802.3 Network Policy Management Snap-in
dot3msm.dll  10.0.26100.7309  802.3 Media Specific Module
dot3svc.dll  10.0.26100.7309  Wired AutoConfig Service
dot3ui.dll  10.0.26100.7309  802.3 Advanced UI
dpapi.dll  10.0.26100.1  Data Protection API
dpapiprovider.dll  10.0.26100.7309  dpapiprovider DLL
dpapisrv.dll  10.0.26100.7920  DPAPI Server
dplcsp.dll    
dpnaddr.dll  10.0.26100.4202  DirectPlay Stub
dpnathlp.dll  10.0.26100.4202  DirectPlay Stub
dpnet.dll  10.0.26100.4202  DirectPlay Stub
dpnhpast.dll  10.0.26100.4202  DirectPlay Stub
dpnhupnp.dll  10.0.26100.4202  DirectPlay Stub
dpnlobby.dll  10.0.26100.4202  DirectPlay Stub
dps.dll  10.0.26100.7920  WDI Diagnostic Policy Service
dpx.dll  10.0.26100.7309  Microsoft(R) Delta Package Expander
dragdropexperiencedataexchangedelegated.dll  10.0.26100.7309  In-Proc WinRT server for Windows.Internal.PlatformExtensions.DragDropExperienceDataExchangeDelegated
drprov.dll  10.0.26100.1  Microsoft Remote Desktop Session Host Server Network Provider
drvsetup.dll  10.0.26100.7920  Microsoft (R) Driver Setup
drvstore.dll  10.0.26100.7920  Driver Store API
dsauth.dll  10.0.26100.2894  DS Authorization for Services
dsccore.dll  10.0.26100.1150  DSC
dsccoreconfprov.dll  6.2.9200.16384  DSC
dsclient.dll  10.0.26100.7920  Data Sharing Service Client DLL
dscproxy.dll  10.0.26100.1150  dscproxy
dsctimer.dll  10.0.26100.1150  DscTimer
dsdmo.dll  10.0.26100.5074  DirectSound Effects
dskquota.dll  10.0.26100.7309  Windows Shell Disk Quota Support DLL
dskquoui.dll  10.0.26100.7309  Windows Shell Disk Quota UI DLL
dsound.dll  10.0.26100.7309  DirectSound
dsparse.dll  10.0.26100.1  Active Directory Domain Services API
dsprop.dll  10.0.26100.1150  Windows Active Directory Property Pages
dsquery.dll  10.0.26100.7309  Directory Service Find
dsreg.dll  10.0.26100.7920  Microsoft Entra User Device Registration
dsregtask.dll  10.0.26100.7920  DSREG task handler
dsrole.dll  10.0.26100.1150  DS Setup Client DLL
dssec.dll  10.0.26100.7705  Directory Service Security UI
dssenh.dll  10.0.26100.5074  Microsoft Enhanced DSS and Diffie-Hellman Cryptographic Provider
dssvc.dll  10.0.26100.7309  Data Sharing Service NT Service DLL
dsui.dll  10.0.26100.7309  Device Setup UI Pages
dsuiext.dll  10.0.26100.1150  Directory Service Common UI
dswave.dll  10.0.26100.7309  Microsoft DirectMusic Wave
dtsh.dll  10.0.26100.7309  Detection and Sharing Status API
ducsps.dll  10.0.26100.7309  DuCSPs
dui70.dll  10.0.26100.7920  Windows DirectUI Engine
duser.dll  10.0.26100.7920  Windows DirectUser Engine
dusmapi.dll  10.0.26100.7309  Data Usage API
dusmsvc.dll  10.0.26100.7920  Data Usage Service
dwmapi.dll  10.0.26100.7920  Microsoft Desktop Window Manager API
dwmcore.dll  10.0.26100.7920  Microsoft DWM Core Library
dwmghost.dll  10.0.26100.7309  DWMGhost
dwminit.dll  10.0.26100.7920  DWMInit
dwmredir.dll  10.0.26100.7920  Microsoft Desktop Window Manager Redirection Component
dwmscene.dll  10.0.26100.7623  Microsoft DWM Scene Library
dwrite.dll  10.0.26100.7824  Microsoft DirectX Typography Services
dxcore.dll  10.0.26100.7920  DXCore
dxdiagn.dll  10.0.26100.7920  Microsoft DirectX Diagnostic Tool
dxgi.dll  10.0.26100.7920  DirectX Graphics Infrastructure
dxgwdi.dll  10.0.26100.7920  Microsoft DirectX Graphics WDI Handler
dxilconv.dll  101.8.2502.37  DirectX IL Converter DLL
dxmasf.dll  12.0.26100.4202  Microsoft Windows Media Component Removal File.
dxp.dll  10.0.26100.7309  Device Stage Shell Extension
dxpps.dll  10.0.26100.1150  Device Experience Platform Proxy\Stub DLL
dxptasksync.dll  10.0.26100.7309  Microsoft Windows DXP Sync.
dxtmsft.dll  11.0.26100.5074  DirectX Media -- Image DirectX Transforms
dxtrans.dll  11.0.26100.5074  DirectX Media -- DirectX Transform Core
dxva2.dll  10.0.26100.7309  DirectX Video Acceleration 2.0 DLL
dynamoapi.dll  10.0.26100.7309  dynamoapi
eamprogresshandler.dll  10.0.26100.7920  EAMProgressHandler
eapp3hst.dll  10.0.26100.7920  Microsoft ThirdPartyEapDispatcher
eappcfg.dll  10.0.26100.7920  Eap Peer Config
eappcfgui.dll  10.0.26100.7309  Eap Peer Config UI
eappgnui.dll  10.0.26100.7920  EAP Generic UI
eapphost.dll  10.0.26100.7920  Microsoft EAPHost Peer service
eappprxy.dll  10.0.26100.7920  Microsoft EAPHost Peer Client DLL
eapprovp.dll  10.0.26100.7920  EAP extension DLL
eapputil.dll  10.0.26100.7920  EAP Private Utility DLL
eapsimextdesktop.dll  10.0.26100.7705  EAP SIM EXT config dll
eapsvc.dll  10.0.26100.7705  Microsoft EAPHost service
eapteapauth.dll  10.0.26100.7920  EAP Teap Runtime DLL
eapteapconfig.dll  10.0.26100.7920  EAP Teap Config DLL
eapteapext.dll  10.0.26100.7309  EAP Teap Desktop Extension DLL
easconsent.dll  10.0.26100.1  EASConsent
easinvoker.proxystub.dll  10.0.26100.4484  Exchange ActiveSync Invoker Proxy Stub
easpolicymanagerbrokerps.dll  10.0.26100.1  COM Proxy Dll for the Exchange Active Sync Policy Manager Broker
easwrt.dll  10.0.26100.7920  Exchange ActiveSync Windows Runtime DLL
ecoscoretask.dll  10.0.26100.7309  EcoScoreTask Task
edgeangle.dll  11.0.26100.1882  Microsoft Edge Angle
edgecontent.dll  11.0.26100.7920  Microsoft Edge Content
edgehtml.dll  11.0.26100.7920  Microsoft Edge Web Platform
edgeiso.dll  11.0.26100.8036  Isolation Library for edgehtml hosts
edgemanager.dll  11.0.26100.7920  Microsoft Edge Manager
edgeresetplugin.dll  10.0.26100.1150  Edge Reset Plugin
editbuffertesthook.dll  10.0.26100.7309  "EditBufferTestHook.DYNLINK"
editionupgradehelper.dll  10.0.26100.7920  EDITIONUPGRADEHELPER.DLL
editionupgrademanagerobj.dll  10.0.26100.7920  Get your Windows license
edpauditapi.dll  10.0.26100.7309  EDP Audit API
edpcsp.dll  10.0.26100.7309  EnterpriseDataProtectionCSP
edptask.dll  10.0.26100.7920  EdpTask Task
edputil.dll  10.0.26100.7309  EDP util
eeprov.dll  10.0.26100.7920  Energy Estimator SRUM provider
eeutil.dll  10.0.26100.7705  Energy Estimator Utility
efsadu.dll  10.0.26100.7920  File Encryption Utility
efscore.dll  10.0.26100.7920  EFS Core Library
efsext.dll  10.0.26100.7309  EFSEXT.DLL
efslsaext.dll  10.0.26100.7309  LSA extension for EFS
efssvc.dll  10.0.26100.7309  EFS Service
efsutil.dll  10.0.26100.7309  EFS Utility Library
efswrt.dll  10.0.26100.7309  Storage Protection Windows Runtime DLL
ehstorapi.dll  10.0.26100.7920  Windows Enhanced Storage API
ehstorpwdmgr.dll  10.0.26100.1150  Microsoft Enhanced Storage Password Manager
ehstorshell.dll  10.0.26100.8036  Windows Enhanced Storage Shell Extension DLL
els.dll  10.0.26100.5074  Event Viewer Snapin
elscore.dll  10.0.26100.1882  Els Core Platform DLL
elshyph.dll  10.0.26100.1  ELS Hyphenation Service
elslad.dll  10.0.26100.3323  ELS Language Detection
elstrans.dll  10.0.26100.1882  ELS Transliteration Service
emailapis.dll  10.0.26100.7309  DLL for EmailRT
embeddedmodesvc.dll  10.0.26100.7309  Debug Register Service
embeddedmodesvcapi.dll  10.0.26100.7309  Embedded Mode Service Client DLL
emojids.dll  10.0.26100.7309  "EmojiDS.DYNLINK"
encapi.dll  10.0.26100.1150  Encoder API
energy.dll  10.0.26100.7920  Power Efficiency Diagnostics
energyprov.dll  10.0.26100.7920  Energy System Resource Usage Monitor (SRUM) provider
energytask.dll  10.0.26100.7019  Power Efficiency Diagnostics Task
enrollmentapi.dll  10.0.26100.7309  Legacy Phone Enrollment API BackCompat Shim
enterpriseapncsp.dll  10.0.26100.7309  EnterpriseAPN Configuration Service Provider
enterpriseappmgmtclient.dll  10.0.26100.5074  EnterpriseAppMgmtClient.dll
enterpriseappmgmtsvc.dll  10.0.26100.7920  Enterprise server dll
enterprisecsps.dll  10.0.26100.7920  API for MDM Enrollment DLL
enterprisedesktopappmgmtcsp.dll  10.0.26100.7309  EnterpriseDesktopAppManagementCSP
enterpriseetw.dll  10.0.26100.1  <d> DLL
enterprisemodernappmgmtcsp.dll  10.0.26100.7920  EnterpriseModernAppMgmtCSP
enterpriseresourcemanager.dll  10.0.26100.7309  enterpriseresourcemanager DLL
eqossnap.dll  10.0.26100.1150  EQoS Snapin extension
errordetails.dll  10.0.26100.7309  Microsoft Windows operating system.
errordetailscore.dll  10.0.26100.7309  Microsoft Windows operating system.
es.dll  2001.12.10941.16384  COM+
esclprotocol.dll  10.0.26100.7920  EsclProtocol dll
esclscan.dll    
esclwiadriver.dll  10.0.26100.7920  ESCL Scan Driver DLL
esdsip.dll  10.0.26100.7309  Crypto SIP provider for signing and verifying .esd Electronic Software Distribution files
esent.dll  10.0.26100.7920  Extensible Storage Engine for Microsoft(R) Windows(R)
esentprf.dll  10.0.26100.1150  Extensible Storage Engine Performance Monitoring Library for Microsoft(R) Windows(R)
esevss.dll  10.0.26100.3624  Microsoft(R) ESENT shadow utilities
eshims.dll  11.0.26100.7705  Microsoft Edge Compatibility Shims
ethernetmediamanager.dll  10.0.26100.7920  Windows Ethernet Media Manager DLL
etwcoreuicomponentsresources.dll  10.0.26100.1  Microsoft CoreComponents UI ETW manifest Dll
etweseproviderresources.dll  10.0.26100.1  Microsoft ESE ETW
etwrundown.dll  10.0.26100.7019  Etw Rundown Helper Library
euiccscsp.dll  10.0.26100.7705  eUICCsCSP
eventaggregation.dll  10.0.26100.1150  Event Aggregation User Mode Library
eventcls.dll  10.0.26100.5074  Microsoft® Volume Shadow Copy Service event class
evr.dll  10.0.26100.7309  Enhanced Video Renderer DLL
execmodelclient.dll  10.0.26100.7309  ExecModelClient
execmodelproxy.dll  10.0.26100.1  ExecModelProxy
explorerframe.dll  10.0.26100.7920  ExplorerFrame
exsmime.dll  10.0.26100.5074  LExsmime
extrasxmlparser.dll  10.0.26100.1882  Extras XML parser used to extract extension information from XML
f3ahvoas.dll  10.0.26100.1  JP Japanese Keyboard Layout for Fujitsu FMV oyayubi-shift keyboard
facecredentialprovider.dll  10.0.26100.7920  Face Credential Provider
facilitator.dll  10.0.26100.7705  Facilitator
family.authentication.dll  10.0.26100.7309  Family.Authentication DLL
family.cache.dll  10.0.26100.7920  Family.Cache DLL
family.client.dll  10.0.26100.7309  Family.Client DLL
family.syncengine.dll  10.0.26100.7309  Family.SyncEngine DLL
familysafetyext.dll  10.0.26100.1  FamilySafety ChildAccount Extensions
faultrep.dll  10.0.26100.7920  Windows User Mode Crash Reporting DLL
faxprinterinstaller.dll  10.0.26100.7623  Fax Printer Installer
fcon.dll  10.0.26100.8036  Feature Configuration
fdbth.dll  10.0.26100.7309  Function Discovery Bluetooth Provider Dll
fdbthproxy.dll  10.0.26100.1  Bluetooth Provider Proxy Dll
fddevquery.dll  10.0.26100.1150  Microsoft Windows Device Query Helper
fde.dll  10.0.26100.1882  Folder Redirection Snapin Extension
fdeploy.dll  10.0.26100.7309  Folder Redirection Group Policy Extension
fdphost.dll  10.0.26100.1  Function Discovery Provider host service
fdpnp.dll  10.0.26100.5074  Pnp Provider Dll
fdprint.dll  10.0.26100.7309  Function Discovery Print Provider Dll
fdproxy.dll  10.0.26100.1  Function Discovery Proxy Dll
fdrespub.dll  10.0.26100.1  Function Discovery Resource Publication Service
fdssdp.dll  10.0.26100.7920  Function Discovery SSDP Provider Dll
fdwcn.dll  10.0.26100.7705  Windows Connect Now - Config Function Discovery Provider DLL
fdwnet.dll  10.0.26100.1150  Function Discovery WNet Provider Dll
fdwsd.dll  10.0.26100.7309  Function Discovery WS Discovery Provider Dll
feclient.dll  10.0.26100.7309  Windows NT File Encryption Client Interfaces
ffbroker.dll  10.0.26100.7019  Force Feedback Broker And Policy COM Server
fhcat.dll  10.0.26100.7920  File History Catalog Library
fhcfg.dll  10.0.26100.7920  File History Configuration Manager
fhcleanup.dll  10.0.26100.1882  File History Disk Cleanup Handler
fhcpl.dll  10.0.26100.7824  File History Control Panel
fhengine.dll  10.0.26100.7920  File History Engine
fhevents.dll  10.0.26100.1882  File History Event Listener Library
fhsettingsprovider.dll  10.0.26100.7309  File History Backup & Restore Settings Provider
fhshl.dll  10.0.26100.3323  File History Custom Shell Library
fhsrchapi.dll  10.0.26100.1882  File History Search API
fhsrchph.dll  10.0.26100.1882  File History Search Protocol Handler
fhsvc.dll  10.0.26100.5074  File History Service
fhsvcctl.dll  10.0.26100.4484  File History Service Control Library
fhtask.dll  10.0.26100.1882  File History Task Handler
fhuxadapter.dll  10.0.26100.3037  File History Data Adapter
fhuxapi.dll  10.0.26100.3037  File History API
fhuxcommon.dll  10.0.26100.3037  File History Common Library
fhuxgraphics.dll  10.0.26100.7920  File History Graphics
fhuxpresentation.dll  10.0.26100.3037  File History Presentation
fidocredprov.dll  10.0.26100.7920  FIDO Credential Provider
fileappxstreamingdatasource.dll  10.0.26100.7920  File AppX Streaming Data Source Library
filemgmt.dll  10.0.26100.1882  Services and Shared Folders
filterds.dll  10.0.26100.7309  Microsoft Filter Data Source Datasource Dll
findnetprinters.dll  10.0.26100.5074  Find Network Printers COM Component
fingerprintcredential.dll  10.0.26100.7920  WinBio Fingerprint Credential
firewallapi.dll  10.0.26100.7920  Windows Defender Firewall API
firewallcontrolpanel.dll  10.0.26100.7309  Windows Defender Firewall Control Panel
firewallux.dll  10.0.26100.7705  COM server for Windows.Internal.NetworkUX.Firewall
firmwareattestationserverproxystub.dll  10.0.26100.4202  FirmwareAttestationServer Proxy Stub Dll
flightsettings.dll  10.0.26100.7920  Flight Settings
fltlib.dll  10.0.26100.1150  Filter Library
fltmgrres.dll  10.0.26100.7920  Microsoft Filesystem Filter Manager Resources
fluencyds.dll  10.0.26100.7920  "FluencyDS.DYNLINK"
fmapi.dll  10.0.26100.1  File Management API
fmifs.dll  10.0.26100.5074  FM IFS Utility DLL
fms.dll  10.0.26100.7309  Font Management Services
fntcache.dll  10.0.26100.7309  Windows Font Cache Service
fontext.dll  10.0.26100.7824  Windows Font Folder
fontglyphanimator.dll  10.0.26100.7920  Font Glyph Animator
fontgroupsoverride.dll  10.0.26100.1  fontgroupsoverride.dll
fontprovider.dll  10.0.26100.1150  Windows Font Provider Library
fontsub.dll  10.0.26100.7705  Font Subsetting DLL
fphc.dll  10.0.26100.5074  Filtering Platform Helper Class
framedyn.dll  10.0.26100.7019  WMI SDK Provider Framework
framedynos.dll  10.0.26100.7920  WMI SDK Provider Framework
frameserver.dll  10.0.26100.7920  Windows Camera Frame Server DLL
frameserverclient.dll  10.0.26100.7920  Frame Server Client DLL
frameservercore.dll  10.0.26100.7920  Windows Camera Frame Server Core DLL
frameservermonitor.dll  10.0.26100.7920  Windows Camera Frame Server Monitor DLL
frameservermonitorclient.dll  10.0.26100.7920  Frame Server Monitor Client DLL
frprov.dll  10.0.26100.1150  Folder Redirection WMI Provider
fsnvsdevicesource.dll  10.0.26100.7705  Frame Server Network Video Streaming Device Source DLL
fstx.dll  10.0.26100.7920  FsTx
fsutilext.dll  10.0.26100.4768  FS Utility Extension DLL
fthsvc.dll  10.0.26100.1  Microsoft Windows Fault Tolerant Heap Diagnostic Module
fundisc.dll  10.0.26100.7920  Function Discovery Dll
fveapi.dll  10.0.26100.7920  Windows BitLocker Drive Encryption API
fveapibase.dll  10.0.26100.7920  Windows BitLocker Drive Encryption Base API
fvecerts.dll  10.0.26100.7705  BitLocker Certificates Library
fvecpl.dll  10.0.26100.7309  BitLocker Drive Encryption control panel
fveskybackup.dll  10.0.26100.7920  Windows BitLocker Drive Encryption OneDrive Backup
fveui.dll  10.0.26100.7920  BitLocker Drive Encryption UI
fvewiz.dll  10.0.26100.7920  BitLocker Drive Encryption Wizard
fwbase.dll  10.0.26100.7920  Firewall Base DLL
fwcfg.dll  10.0.26100.1882  Windows Defender Firewall Configuration Helper
fwmdmcsp.dll  10.0.26100.7920  FWMDMCSP
fwpolicyiomgr.dll  10.0.26100.7920  FwPolicyIoMgr DLL
fwpuclnt.dll  10.0.26100.7920  FWP/IPsec User-Mode API
fwremotesvr.dll  10.0.26100.7920  Windows Defender Firewall Remote APIs Server
gamebarpresencewriter.proxy.dll  10.0.26100.1882  GameBar Presence Writer Proxy
gamechatoverlayext.dll  10.0.26100.1150  GameChat Overlay Extension
gamechattranscription.dll  10.0.26100.7019  GameChatTranscription
gameinput.dll  0.2309.26100.7920  GameInput API
gamemode.dll  10.0.26100.7824  Game Mode Client
gamepanelexternalhook.dll  10.0.26100.1882  GamePanelExternalHook.dll
gamestreamingext.dll  10.0.26100.1  Xbox Game Streaming Extension
gameux.dll  10.0.26100.1  Games Explorer
gamingtcui.dll  10.0.26100.7309  Windows Gaming Internal CallableUI dll
gcdef.dll  10.0.26100.1591  Game Controllers Default Sheets
gdi32.dll  10.0.26100.8036  GDI Client DLL
gdi32full.dll  10.0.26100.8036  GDI Client DLL
gdiplus.dll  10.0.26100.8036  Microsoft GDI+
generaltel.dll  10.0.26100.7920  General Telemetry
genpix.dll    
geocommon.dll  10.0.26100.7309  Geocommon
geolocation.dll  10.0.26100.7309  Geolocation Runtime DLL
getuname.dll  10.0.26100.1  Unicode name Dll for UCE
glmf32.dll  10.0.26100.1150  OpenGL Metafiling DLL
globinputhost.dll  10.0.26100.7920  Windows Globalization Extension API for Input
glu32.dll  10.0.26100.1150  OpenGL Utility Library DLL
gmsaclient.dll  10.0.26100.7309  "gmsaclient.DYNLINK"
gpapi.dll  10.0.26100.7920  Group Policy Client API
gpcsewrappercsp.dll  10.0.26100.7920  GPCSEWrapperCsp
gpedit.dll  10.0.26100.7920  GPEdit
gpprnext.dll  10.0.26100.5074  Group Policy Printer Extension
gpsvc.dll  10.0.26100.7920  Group Policy Client
gptext.dll  10.0.26100.1150  GPTExt
graphicscapture.dll  10.0.26100.7920  Microsoft Windows Graphics Capture Api
graphicsperfsvc.dll  10.0.26100.7920  GraphicsPerfSvc
hal.dll  10.0.26100.1  Hardware Abstraction Layer DLL
halextintclpiodma.dll  10.0.26100.4202  HAL Extension for Intel(R) Low Power Subsystem DMA Controller
halextintcpsedma.dll  10.0.26100.4202  HAL Extension for Intel(R) Platform Services Engine DMA Controller
halextpl080.dll  10.0.26100.4202  HAL Extension for PL080 DMA Controller
hanjads.dll  10.0.26100.7309  "HanjaDS.DYNLINK"
hascsp.dll  10.0.26100.7309  HealthAttestationCSP
hashtagds.dll  10.0.26100.7309  HASHTAGDS.DLL
hbaapi.dll  10.0.26100.1  HBA API data interface dll for HBA_API_Rev_2-18_2002MAR1.doc
hcproviders.dll  10.0.26100.7309  Security and Maintenance Providers
hdcphandler.dll  10.0.26100.1150  Hdcp Handler DLL
heatcore.dll  10.0.26100.7309  Microsoft (R) Windows HEAT processor framework
helppaneproxy.dll  10.0.26100.5074  Microsoft® Help Proxy
hgcpl.dll  10.0.26100.7309  HomeGroup Control Panel
hhsetup.dll  10.0.26100.7705  Microsoft® HTML Help
hid.dll  10.0.26100.1150  Hid User Library
hidcfu.dll  1.0.0.0  hidCfu Device
hidserv.dll  10.0.26100.4484  Human Interface Device Service
hlink.dll  10.0.26100.7309  Microsoft Office 2000 component
hmkd.dll  10.0.26100.7309  Windows HMAC Key Derivation API
hnetcfg.dll  10.0.26100.7309  Home Networking Configuration Manager
hnetcfgclient.dll  10.0.26100.7309  Home Networking Configuration API Client
hnetmon.dll  10.0.26100.1150  Home Networking Monitor DLL
hotpatchutil.dll    
hotplug.dll  10.0.26100.1882  Safely Remove Hardware applet
hpatchmon.dll  10.0.26100.7920  Hotpatch Monitoring Service
hrtfapo.dll  10.0.26100.7309  Spatial Audio Processing Library
hrtfdspcpu.dll  2024.0.80.0  Microsoft (R) Spatial Audio DSP Library
hspapi.dll  10.0.26100.7309  Hardware Security Platfrom API Library
httpapi.dll  10.0.26100.7920  HTTP Protocol Stack API
httpprxc.dll  10.0.26100.5074  Proxy Manager Provider RPC interface
httpprxm.dll  10.0.26100.7019  Proxy Manager
httpprxp.dll  10.0.26100.1  Proxy Manager Provider RPC interface
httpsdatasource.dll  10.0.26100.7920  Https Data Source Library
htui.dll  10.0.26100.1882  Common halftone Color Adjustment Dialogs
hvhostsvc.dll  10.0.26100.7309  Microsoft Hypervisor Host Service
hvloader.dll  10.0.26100.7824  Hv Loader Library
hvsocket.dll  10.0.26100.7309  HvSocket Utilities DLL
hwreqchk.dll    
ia2comproxy.dll  10.0.26100.1  IAccessible2 COM Proxy Stub DLL
ias.dll  10.0.26100.3037  Network Policy Server
iasacct.dll  10.0.26100.7920  NPS Accounting Provider
iasads.dll  10.0.26100.5074  NPS Active Directory Data Store
iasdatastore.dll  10.0.26100.5074  NPS Datastore server
iashlpr.dll  10.0.26100.1882  NPS Surrogate Component
iasmigplugin.dll  10.0.26100.5074  NPS Migration DLL
iasnap.dll  10.0.26100.3323  NPS NAP Provider
iaspolcy.dll  10.0.26100.3037  NPS Pipeline
iasrad.dll  10.0.26100.5074  NPS RADIUS Protocol Component
iasrecst.dll  10.0.26100.5074  NPS XML Datastore Access
iassam.dll  10.0.26100.1882  NPS NT SAM Provider
iassdo.dll  10.0.26100.5074  NPS SDO Component
iassvcs.dll  10.0.26100.3037  NPS Services Component
icfupgd.dll  10.0.26100.7920  Windows Firewal ICF Settings Upgrade
icm32.dll  10.0.26100.2314  Microsoft Color Management Module (CMM)
icmp.dll  10.0.26100.1  ICMP DLL
icmui.dll  10.0.26100.1591  Microsoft Color Matching System User Interface DLL
iconcodecservice.dll  10.0.26100.1  Converts a PNG part of the icon to a legacy bmp icon
icsigd.dll  10.0.26100.1882  Internet Gateway Device properties
icsvc.dll  10.0.26100.7705  Virtual Machine Integration Component Service
icsvcext.dll  10.0.26100.7309  Virtual Machine Integration Component Service
icsvcvss.dll  10.0.26100.7309  Virtual Machine Integration Components Volume Snapshot Service
icu.dll  72.1.0.4  ICU Combined Library
icuin.dll  72.1.0.4  ICU I18N Forwarder DLL (deprecated)
icuuc.dll  72.1.0.4  ICU Common Forwarder DLL (deprecated)
idctrls.dll  10.0.26100.7824  Identity Controls
idstore.dll  10.0.26100.7019  Identity Store
ieadvpack.dll  11.0.26100.7309  ADVPACK
ieapfltr.dll  11.0.26100.7920  Microsoft SmartScreen Filter
iedkcs32.dll  18.0.26100.7309  IEAK branding
ieframe.dll  11.0.26100.7920  Internet Browser
iemigplugin.dll  11.0.26100.7920  IE Migration Plugin
iepeers.dll  11.0.26100.5074  Internet Explorer Peer Objects
ieproxy.dll  11.0.26100.3624  IE ActiveX Interface Marshaling Library
ieproxydesktop.dll  11.0.26100.1  IE Desktop ActiveX Interface Marshaling Library
iernonce.dll  11.0.26100.7309  Extended RunOnce processing with UI
iertutil.dll  11.0.26100.8036  Run time utility for Internet Explorer
iesetup.dll  11.0.26100.7309  IOD Version Map
iesysprep.dll  11.0.26100.7309  IE Sysprep Provider
ieui.dll  11.0.26100.7920  Internet Explorer UI Engine
ifmon.dll  10.0.26100.1150  IF Monitor DLL
ifsutil.dll  10.0.26100.7019  IFS Utility DLL
ifsutilx.dll  10.0.26100.1  IFS Utility Extension DLL
ihds.dll  10.0.26100.7309  "IHDS.DYNLINK"
ikeext.dll  10.0.26100.7920  IKE extension
imagehlp.dll  10.0.26100.4202  Windows NT Image Helper
imageres.dll  10.0.26100.7705  Windows Image Resource
imagesp1.dll  10.0.26100.1  Windows SP1 Image Resource
imapi.dll  10.0.26100.1150  Image Mastering API
imapi2.dll  10.0.26100.5074  Image Mastering API v2
imapi2fs.dll  10.0.26100.5074  Image Mastering File System Imaging API v2
ime_textinputhelpers.dll  10.0.26100.7309  "IME_TextInputHelpers.DYNLINK"
imgutil.dll  11.0.26100.5074  IE plugin image decoder support DLL
imm32.dll  10.0.26100.7309  Multi-User Windows IMM32 API Client DLL
implatsetup.dll  10.0.26100.7309  NdisImPlatform Network Setup Plugin
indexeddblegacy.dll  10.0.26100.7920  "IndexedDbLegacy.DYNLINK"
inetcomm.dll  10.0.26100.7309  Microsoft Internet Messaging API Resources
inetmib1.dll  10.0.26100.1150  Microsoft MIB-II subagent
inetpp.dll  10.0.26100.7309  Internet Print Provider DLL
inetppui.dll  10.0.26100.7309  Internet Print Client DLL
inetres.dll  10.0.26100.6725  Microsoft Internet Messaging API Resources
inked.dll  10.0.26100.5074  Microsoft Tablet PC InkEdit Control
inkobjcore.dll  10.0.26100.5074  Microsoft Tablet PC Ink Platform Component
inproclogger.dll  10.0.26100.7309  In-proc Private Event Trace Logger
input.dll  10.0.26100.7920  InputSetting DLL
inputcloudstore.dll  10.0.26100.7705  Windows Input Cloud Store Task Handlers
inputcontroller.dll  10.0.26100.1882  Windows Perception Simulation Input Controller
inputhost.dll  10.0.26100.7920  InputHost
inputinjectionbroker.dll  10.0.26100.7309  Broker for WinRT input injection.
inputlocalemanager.dll  10.0.26100.7309  "InputLocaleManager.DYNLINK"
inputservice.dll  10.0.26100.7920  Microsoft Text InputService Dll
inputswitch.dll  10.0.26100.7920  Microsoft Windows Input Switcher
inputviewexperience.dll  10.0.26100.7309  InputViewExperience
inseng.dll  11.0.26100.7309  Install engine
installmon.dll  10.0.26100.7920  Application Install Tracing
installservice.dll  10.0.26100.7920  InstallService
installservicetasks.dll  10.0.26100.7920  InstallService Tasks
internetmail.dll  10.0.26100.7309  InternetMail sync engine for contacts, calendar
internetmailcsp.dll  10.0.26100.7309  Internet Mail CSP DLL
invagent.dll  10.0.26100.7920  Inventory Agent
inventorysvc.dll  10.0.26100.7920  Compatibility Inventory Service
iologmsg.dll  10.0.26100.4202  IO Logging DLL
iphlpapi.dll  10.0.26100.7920  IP Helper API
iphlpsvc.dll  10.0.26100.7920  Service that offers IPv6 connectivity over an IPv4 network.
ipnathlp.dll  10.0.26100.7920  Microsoft NAT Helper Components
ipnathlpclient.dll  10.0.26100.1  IP NAT Helper Client
ippcommon.dll  10.0.26100.7920  IppCommon dll
ippcommonproxy.dll  10.0.26100.1150  IppCommon COM Proxy dll
iprtprio.dll  10.0.26100.7920  IP Routing Protocol Priority DLL
iprtrmgr.dll  10.0.26100.7920  IP Router Manager
ipsecsnp.dll  10.0.26100.5074  IP Security Policy Management Snap-in
ipsecsvc.dll  10.0.26100.5074  Windows IPsec SPD Server DLL
ipsmsnap.dll  10.0.26100.7462  IP Security Monitor Snap-in
ipxlatcfg.dll  10.0.26100.7920  IP Translation Configuration Service
iri.dll  10.0.26100.1  iri
iscsicpl.dll  5.2.3790.1830  iSCSI Initiator Control Panel Applet
iscsidsc.dll  10.0.26100.3037  iSCSI Discovery api
iscsied.dll  10.0.26100.3037  iSCSI Extension DLL
iscsiexe.dll  10.0.26100.5074  iSCSI Discovery service
iscsilog.dll  10.0.26100.4202  iSCSI Event Log DLL
iscsium.dll  10.0.26100.5074  iSCSI Discovery api
iscsiwmi.dll  10.0.26100.3037  MS iSCSI Initiator WMI Provider
iscsiwmiv2.dll  10.0.26100.3037  WMI Provider for iSCSI
ism.dll  10.0.26100.7920  ISM
itircl.dll  10.0.26100.5074  Microsoft® InfoTech IR Local DLL
itss.dll  10.0.26100.7705  Microsoft® InfoTech Storage System Library
iuilp.dll  10.0.26100.7309  iuilp
iumbase.dll  10.0.26100.7623  IUM Layer Secure Win32 DLL
iumcrypt.dll  10.0.26100.7705  IUM Crypto Support Routines
iumdll.dll  10.0.26100.7623  IUM Layer DLL
iumsdk.dll  10.0.26100.7623  IumSdk DLL
iyuv_32.dll  10.0.26100.1150  Intel Indeo(R) Video YUV Codec
javascriptcollectionagent.dll  11.0.26100.1150  JavaScript Performance Collection Agent
joinproviderol.dll  10.0.26100.7019  Online Join Provider DLL
joinutil.dll  10.0.26100.3775  Join Utility DLL
jpmapcontrol.dll  10.0.26100.7309  Jupiter Map Control
jpndecoder.dll  10.0.26100.7309  "JpnDecoder.DYNLINK"
jpninputrouter.dll  10.0.26100.7309  "JpnInputRouter.DYNLINK"
jpnranker.dll  10.0.26100.7309  "JpnRanker.DYNLINK"
jpnserviceds.dll  10.0.26100.7309  "JpnServiceDS.DYNLINK"
jscript.dll  10.0.26100.7920  Microsoft ® JScript
jscript9.dll  11.0.26100.7920  Microsoft ® JScript
jscript9diag.dll  11.0.26100.7920  Microsoft ® JScript Diagnostics
jscript9legacy.dll  11.0.26100.7920  Microsoft ® JScript
jsproxy.dll  11.0.26100.7920  JScript Proxy Auto-Configuration
kbd101.dll  10.0.26100.2454  JP Japanese Keyboard Layout for 101
kbd101a.dll  10.0.26100.2454  KO Hangeul Keyboard Layout for 101 (Type A)
kbd101b.dll  10.0.26100.2454  KO Hangeul Keyboard Layout for 101(Type B)
kbd101c.dll  10.0.26100.2454  KO Hangeul Keyboard Layout for 101(Type C)
kbd103.dll  10.0.26100.2454  KO Hangeul Keyboard Layout for 103
kbd106.dll  10.0.26100.2454  JP Japanese Keyboard Layout for 106
kbd106n.dll  10.0.26100.2454  JP Japanese Keyboard Layout for 106
kbda1.dll  10.0.26100.7309  Arabic_English_101 Keyboard Layout
kbda2.dll  10.0.26100.7309  Arabic_2 Keyboard Layout
kbda3.dll  10.0.26100.7309  Arabic_French_102 Keyboard Layout
kbdadlm.dll  10.0.26100.2454  Adlam Keyboard Layout
kbdal.dll  10.0.26100.2454  Albania Keyboard Layout
kbdarme.dll  10.0.26100.2454  Eastern Armenian Keyboard Layout
kbdarmph.dll  10.0.26100.2454  Armenian Phonetic Keyboard Layout
kbdarmty.dll  10.0.26100.2454  Armenian Typewriter Keyboard Layout
kbdarmw.dll  10.0.26100.2454  Western Armenian Keyboard Layout
kbdax2.dll  10.0.26100.2454  JP Japanese Keyboard Layout for AX2
kbdaze.dll  10.0.26100.2454  Azerbaijan_Cyrillic Keyboard Layout
kbdazel.dll  10.0.26100.2454  Azeri-Latin Keyboard Layout
kbdazst.dll  10.0.26100.2454  Azerbaijani (Standard) Keyboard Layout
kbdbash.dll  10.0.26100.2454  Bashkir Keyboard Layout
kbdbe.dll  10.0.26100.2454  Belgian Keyboard Layout
kbdbene.dll  10.0.26100.2454  Belgian Dutch Keyboard Layout
kbdbgph.dll  10.0.26100.2454  Bulgarian Phonetic Keyboard Layout
kbdbgph1.dll  10.0.26100.2454  Bulgarian (Phonetic Traditional) Keyboard Layout
kbdbhc.dll  10.0.26100.2454  Bosnian (Cyrillic) Keyboard Layout
kbdblr.dll  10.0.26100.2454  Belarusian Keyboard Layout
kbdbr.dll  10.0.26100.2454  Brazilian Keyboard Layout
kbdbu.dll  10.0.26100.2454  Bulgarian (Typewriter) Keyboard Layout
kbdbug.dll  10.0.26100.2454  Buginese Keyboard Layout
kbdbulg.dll  10.0.26100.2454  Bulgarian Keyboard Layout
kbdca.dll  10.0.26100.2454  Canadian Multilingual Keyboard Layout
kbdcan.dll  10.0.26100.2454  Canadian Multilingual Standard Keyboard Layout
kbdcher.dll  10.0.26100.2454  Cherokee Nation Keyboard Layout
kbdcherp.dll  10.0.26100.2454  Cherokee Phonetic Keyboard Layout
kbdcmk.dll  10.0.26100.2454  Colemak Keyboard Layout
kbdcr.dll  10.0.26100.2454  Croatian/Slovenian Keyboard Layout
kbdcz.dll  10.0.26100.2454  Czech Keyboard Layout
kbdcz1.dll  10.0.26100.2454  Czech_101 Keyboard Layout
kbdcz2.dll  10.0.26100.2454  Czech_Programmer's Keyboard Layout
kbdda.dll  10.0.26100.2454  Danish Keyboard Layout
kbddiv1.dll  10.0.26100.2454  Divehi Phonetic Keyboard Layout
kbddiv2.dll  10.0.26100.2454  Divehi Typewriter Keyboard Layout
kbddv.dll  10.0.26100.2454  Dvorak US English Keyboard Layout
kbddzo.dll  10.0.26100.2454  Dzongkha Keyboard Layout
kbdes.dll  10.0.26100.2454  Spanish Alernate Keyboard Layout
kbdest.dll  10.0.26100.2454  Estonia Keyboard Layout
kbdfa.dll  10.0.26100.2454  Persian Keyboard Layout
kbdfar.dll  10.0.26100.2454  Persian Standard Keyboard Layout
kbdfc.dll  10.0.26100.2454  Canadian French Keyboard Layout
kbdfi.dll  10.0.26100.2454  Finnish Keyboard Layout
kbdfi1.dll  10.0.26100.2454  Finnish-Swedish with Sami Keyboard Layout
kbdfo.dll  10.0.26100.2454  Færoese Keyboard Layout
kbdfr.dll  10.0.26100.2454  French Keyboard Layout
kbdfrna.dll  10.0.26100.2454  French (Standard, AZERTY) Keyboard Layout
kbdfrnb.dll  10.0.26100.2454  French (Standard, BÉPO) Keyboard Layout
kbdfthrk.dll  10.0.26100.2454  Futhark Keyboard Layout
kbdgae.dll  10.0.26100.2454  Scottish Gaelic (United Kingdom) Keyboard Layout
kbdgeo.dll  10.0.26100.2454  Georgian Keyboard Layout
kbdgeoer.dll  10.0.26100.2454  Georgian (Ergonomic) Keyboard Layout
kbdgeome.dll  10.0.26100.2454  Georgian (MES) Keyboard Layout
kbdgeooa.dll  10.0.26100.2454  Georgian (Old Alphabets) Keyboard Layout
kbdgeoqw.dll  10.0.26100.2454  Georgian (QWERTY) Keyboard Layout
kbdgkl.dll  10.0.26100.2454  Greek_Latin Keyboard Layout
kbdgn.dll  10.0.26100.2454  Guarani Keyboard Layout
kbdgr.dll  10.0.26100.2454  German Keyboard Layout
kbdgr1.dll  10.0.26100.2454  German_IBM Keyboard Layout
kbdgre1.dll  10.0.26100.2454  German Extended (E1) Keyboard Layout
kbdgre2.dll  10.0.26100.2454  German Extended (E2) Keyboard Layout
kbdgrlnd.dll  10.0.26100.2454  Greenlandic Keyboard Layout
kbdgthc.dll  10.0.26100.2454  Gothic Keyboard Layout
kbdhau.dll  10.0.26100.2454  Hausa Keyboard Layout
kbdhaw.dll  10.0.26100.2454  Hawaiian Keyboard Layout
kbdhe.dll  10.0.26100.2454  Greek Keyboard Layout
kbdhe220.dll  10.0.26100.2454  Greek IBM 220 Keyboard Layout
kbdhe319.dll  10.0.26100.2454  Greek IBM 319 Keyboard Layout
kbdheb.dll  10.0.26100.2454  KBDHEB Keyboard Layout
kbdhebl3.dll  10.0.26100.2454  Hebrew Standard Keyboard Layout
kbdhebsi.dll  10.0.26100.2454  Hebrew (Standard, 2018) Keyboard Layout
kbdhela2.dll  10.0.26100.2454  Greek IBM 220 Latin Keyboard Layout
kbdhela3.dll  10.0.26100.2454  Greek IBM 319 Latin Keyboard Layout
kbdhept.dll  10.0.26100.2454  Greek_Polytonic Keyboard Layout
kbdhu.dll  10.0.26100.2454  Hungarian Keyboard Layout
kbdhu1.dll  10.0.26100.2454  Hungarian 101-key Keyboard Layout
kbdibm02.dll  10.0.26100.2454  JP Japanese Keyboard Layout for IBM 5576-002/003
kbdibo.dll  10.0.26100.2454  Igbo Keyboard Layout
kbdic.dll  10.0.26100.2454  Icelandic Keyboard Layout
kbdinasa.dll  10.0.26100.2454  Assamese (Inscript) Keyboard Layout
kbdinbe1.dll  10.0.26100.2454  Bengali - Inscript (Legacy) Keyboard Layout
kbdinbe2.dll  10.0.26100.2454  Bengali (Inscript) Keyboard Layout
kbdinben.dll  10.0.26100.2454  Bengali Keyboard Layout
kbdindev.dll  10.0.26100.2454  Devanagari Keyboard Layout
kbdinen.dll  10.0.26100.2454  English (India) Keyboard Layout
kbdinguj.dll  10.0.26100.2454  Gujarati Keyboard Layout
kbdinhin.dll  10.0.26100.2454  Hindi Keyboard Layout
kbdinkan.dll  10.0.26100.2454  Kannada Keyboard Layout
kbdinmal.dll  10.0.26100.2454  Malayalam Keyboard Layout Keyboard Layout
kbdinmar.dll  10.0.26100.2454  Marathi Keyboard Layout
kbdinori.dll  10.0.26100.2454  Odia Keyboard Layout
kbdinpun.dll  10.0.26100.2454  Punjabi/Gurmukhi Keyboard Layout
kbdintam.dll  10.0.26100.2454  Tamil Keyboard Layout
kbdintel.dll  10.0.26100.2454  Telugu Keyboard Layout
kbdinuk2.dll  10.0.26100.2454  Inuktitut Naqittaut Keyboard Layout
kbdinuk3.dll  10.0.26100.3624  Inuktitut - Nattilik Keyboard Layout
kbdir.dll  10.0.26100.2454  Irish Keyboard Layout
kbdit.dll  10.0.26100.2454  Italian Keyboard Layout
kbdit142.dll  10.0.26100.2454  Italian 142 Keyboard Layout
kbdiulat.dll  10.0.26100.2454  Inuktitut Latin Keyboard Layout
kbdjav.dll  10.0.26100.2454  Javanese Keyboard Layout
kbdjpn.dll  10.0.26100.2454  JP Japanese Keyboard Layout Stub driver
kbdkaz.dll  10.0.26100.2454  Kazak_Cyrillic Keyboard Layout
kbdkhmr.dll  10.0.26100.2454  Cambodian Standard Keyboard Layout
kbdkni.dll  10.0.26100.2454  Khmer (NIDA) Keyboard Layout
kbdkor.dll  10.0.26100.2454  KO Hangeul Keyboard Layout Stub driver
kbdkurd.dll  10.0.26100.2454  Central Kurdish Keyboard Layout
kbdkyr.dll  10.0.26100.2454  Kyrgyz Keyboard Layout
kbdla.dll  10.0.26100.2454  Latin-American Spanish Keyboard Layout
kbdlao.dll  10.0.26100.2454  Lao Standard Keyboard Layout
kbdlisub.dll  10.0.26100.2454  Lisu Basic Keyboard Layout
kbdlisus.dll  10.0.26100.2454  Lisu Standard Keyboard Layout
kbdlk41a.dll  10.0.26100.2454  DEC LK411-AJ Keyboard Layout
kbdlt.dll  10.0.26100.2454  Lithuania Keyboard Layout
kbdlt1.dll  10.0.26100.2454  Lithuanian Keyboard Layout
kbdlt2.dll  10.0.26100.2454  Lithuanian Standard Keyboard Layout
kbdlv.dll  10.0.26100.2454  Latvia Keyboard Layout
kbdlv1.dll  10.0.26100.2454  Latvia-QWERTY Keyboard Layout
kbdlvst.dll  10.0.26100.2454  Latvian (Standard) Keyboard Layout
kbdmac.dll  10.0.26100.2454  Macedonian (North Macedonia) Keyboard Layout
kbdmacst.dll  10.0.26100.2454  Macedonian (North Macedonia) - Standard Keyboard Layout
kbdmaori.dll  10.0.26100.2454  Maori Keyboard Layout
kbdmlt47.dll  10.0.26100.2454  Maltese 47-key Keyboard Layout
kbdmlt48.dll  10.0.26100.2454  Maltese 48-key Keyboard Layout
kbdmon.dll  10.0.26100.2454  Mongolian Keyboard Layout
kbdmonmo.dll  10.0.26100.2454  Mongolian (Mongolian Script) Keyboard Layout
kbdmons2.dll  10.0.26100.3624  Traditional Mongolian (MNS) Keyboard Layout
kbdmonst.dll  10.0.26100.2454  Traditional Mongolian (Standard) Keyboard Layout
kbdmyan.dll  10.0.26100.2454  Myanmar Keyboard Layout
kbdne.dll  10.0.26100.2454  Dutch Keyboard Layout
kbdnec.dll  10.0.26100.2454  JP Japanese Keyboard Layout for (NEC PC-9800)
kbdnec95.dll  10.0.26100.2454  JP Japanese Keyboard Layout for (NEC PC-9800 Windows 95)
kbdnecat.dll  10.0.26100.2454  JP Japanese Keyboard Layout for (NEC PC-9800 on PC98-NX)
kbdnecnt.dll  10.0.26100.2454  JP Japanese NEC PC-9800 Keyboard Layout
kbdnepr.dll  10.0.26100.2454  Nepali Keyboard Layout
kbdnko.dll  10.0.26100.2454  N'Ko Keyboard Layout
kbdno.dll  10.0.26100.2454  Norwegian Keyboard Layout
kbdno1.dll  10.0.26100.2454  Norwegian with Sami Keyboard Layout
kbdnso.dll  10.0.26100.2454  Sesotho sa Leboa Keyboard Layout
kbdntl.dll  10.0.26100.2454  New Tai Leu Keyboard Layout
kbdogham.dll  10.0.26100.2454  Ogham Keyboard Layout
kbdolch.dll  10.0.26100.2454  Ol Chiki Keyboard Layout
kbdoldit.dll  10.0.26100.2454  Old Italic Keyboard Layout
kbdosa.dll  10.0.26100.2454  Osage Keyboard Layout
kbdosm.dll  10.0.26100.2454  Osmanya Keyboard Layout
kbdpash.dll  10.0.26100.2454  Pashto (Afghanistan) Keyboard Layout
kbdphags.dll  10.0.26100.2454  Phags-pa Keyboard Layout
kbdpl.dll  10.0.26100.2454  Polish Keyboard Layout
kbdpl1.dll  10.0.26100.2454  Polish Programmer's Keyboard Layout
kbdpo.dll  10.0.26100.2454  Portuguese Keyboard Layout
kbdro.dll  10.0.26100.2454  Romanian (Legacy) Keyboard Layout
kbdropr.dll  10.0.26100.2454  Romanian (Programmers) Keyboard Layout
kbdrost.dll  10.0.26100.2454  Romanian (Standard) Keyboard Layout
kbdru.dll  10.0.26100.2454  Russian Keyboard Layout
kbdru1.dll  10.0.26100.2454  Russia(Typewriter) Keyboard Layout
kbdrum.dll  10.0.26100.2454  Russian - Mnemonic Keyboard Layout
kbdsf.dll  10.0.26100.2454  Swiss French Keyboard Layout
kbdsg.dll  10.0.26100.2454  Swiss German Keyboard Layout
kbdsl.dll  10.0.26100.2454  Slovak Keyboard Layout
kbdsl1.dll  10.0.26100.2454  Slovak(QWERTY) Keyboard Layout
kbdsmsfi.dll  10.0.26100.2454  Sami Extended Finland-Sweden Keyboard Layout
kbdsmsno.dll  10.0.26100.2454  Sami Extended Norway Keyboard Layout
kbdsn1.dll  10.0.26100.2454  Sinhala Keyboard Layout
kbdsora.dll  10.0.26100.2454  Sora Keyboard Layout
kbdsorex.dll  10.0.26100.2454  Sorbian Extended Keyboard Layout
kbdsors1.dll  10.0.26100.2454  Sorbian Standard Keyboard Layout
kbdsorst.dll  10.0.26100.2454  Sorbian Standard (Legacy) Keyboard Layout
kbdsp.dll  10.0.26100.2454  Spanish Keyboard Layout
kbdsw.dll  10.0.26100.2454  Swedish Keyboard Layout
kbdsw09.dll  10.0.26100.2454  Sinhala - Wij 9 Keyboard Layout
kbdsyr1.dll  10.0.26100.2454  Syriac Standard Keyboard Layout
kbdsyr2.dll  10.0.26100.2454  Syriac Phoenetic Keyboard Layout
kbdtaile.dll  10.0.26100.2454  Tai Le Keyboard Layout
kbdtajik.dll  10.0.26100.2454  Tajik Keyboard Layout
kbdtam99.dll  10.0.26100.2454  Tamil99Keyboard Keyboard Layout
kbdtat.dll  10.0.26100.2454  Tatar (Legacy) Keyboard Layout
kbdth0.dll  10.0.26100.2454  Thai Kedmanee Keyboard Layout
kbdth1.dll  10.0.26100.2454  Thai Pattachote Keyboard Layout
kbdth2.dll  10.0.26100.2454  Thai Kedmanee (non-ShiftLock) Keyboard Layout
kbdth3.dll  10.0.26100.2454  Thai Pattachote (non-ShiftLock) Keyboard Layout
kbdtifi.dll  10.0.26100.2454  Tifinagh (Basic) Keyboard Layout
kbdtifi2.dll  10.0.26100.2454  Tifinagh (Extended) Keyboard Layout
kbdtiprc.dll  10.0.26100.2454  Tibetan (PRC) Keyboard Layout
kbdtiprd.dll  10.0.26100.2454  Tibetan (PRC) - Updated Keyboard Layout
kbdtt102.dll  10.0.26100.2454  Tatar Keyboard Layout
kbdtuf.dll  10.0.26100.2454  Turkish F Keyboard Layout
kbdtuq.dll  10.0.26100.2454  Turkish Q Keyboard Layout
kbdturme.dll  10.0.26100.2454  Turkmen Keyboard Layout
kbdtzm.dll  10.0.26100.2454  Central Atlas Tamazight Keyboard Layout
kbdughr.dll  10.0.26100.2454  Uyghur (Legacy) Keyboard Layout
kbdughr1.dll  10.0.26100.2454  Uyghur Keyboard Layout
kbduk.dll  10.0.26100.2454  United Kingdom Keyboard Layout
kbdukx.dll  10.0.26100.2454  United Kingdom Extended Keyboard Layout
kbdur.dll  10.0.26100.2454  Ukrainian Keyboard Layout
kbdur1.dll  10.0.26100.2454  Ukrainian (Enhanced) Keyboard Layout
kbdurdu.dll  10.0.26100.2454  Urdu Keyboard Layout
kbdus.dll  10.0.26100.4202  United States Keyboard Layout
kbdusa.dll  10.0.26100.2454  US IBM Arabic 238_L Keyboard Layout
kbdusl.dll  10.0.26100.2454  Dvorak Left-Hand US English Keyboard Layout
kbdusr.dll  10.0.26100.2454  Dvorak Right-Hand US English Keyboard Layout
kbdusx.dll  10.0.26100.2454  US Multinational Keyboard Layout
kbduzb.dll  10.0.26100.2454  Uzbek_Cyrillic Keyboard Layout
kbdvntc.dll  10.0.26100.2454  Vietnamese Keyboard Layout
kbdwol.dll  10.0.26100.2454  Wolof Keyboard Layout
kbdyak.dll  10.0.26100.2454  Sakha - Russia Keyboard Layout
kbdyba.dll  10.0.26100.2454  Yoruba Keyboard Layout
kbdycc.dll  10.0.26100.2454  Serbian (Cyrillic) Keyboard Layout
kbdycl.dll  10.0.26100.2454  Serbian (Latin) Keyboard Layout
kd.dll  10.0.26100.1  Local Kernel Debugger
kd_02_10df.dll  10.0.26100.7309  Emulex Network Kernel Debug Extensibility Module
kd_02_10ec.dll  10.0.26100.7309  Realtek Network Kernel Debug Extensibility Module
kd_02_1137.dll  10.0.26100.7309  Cisco Vic Network Kernel Debug Extensibility Module
kd_02_1414.dll  10.0.26100.7309  Mana Network Kernel Debug Extensibility Module
kd_02_14e4.dll  10.0.26100.7309  Broadcom Network Kernel Debug Extensibility Module
kd_02_15ad.dll    
kd_02_15b3.dll  10.0.26100.7309  Mellanox ConnectX Network Kernel Debug Extensibility Module
kd_02_1969.dll  10.0.26100.7309  Qualcomm Atheros Network Kernel Debug Extensibility Module
kd_02_19a2.dll  10.0.26100.7309  Emulex Network Kernel Debug Extensibility Module
kd_02_1af4.dll  10.0.26100.7309  VirtIO Network Kernel Debug Extensibility Module
kd_02_1d0f.dll  10.0.26100.7309  Ena Network Kernel Debug Extensibility Module
kd_02_8086.dll  10.0.26100.7309  Intel Network Kernel Debug Extensibility Module
kd_07_1415.dll  10.0.26100.7309  Network Kernel Debug Serial Extensibility Module
kd_0c_8086.dll  10.0.26100.7309  Intel USB Network Kernel Debug Extensibility Module
kdcom.dll  10.0.26100.1882  Serial Kernel Debugger
kdcpw.dll  10.0.26100.7623  KDCPW
kdhvcom.dll  10.0.26100.1150  Enlightened Kernel Serial Debugger Extension DLL
kdnet.dll  10.0.26100.7705  Network Kernel Debugger
kdnet_uart16550.dll  10.0.26100.7309  Network Kernel Debug Serial Extensibility Module
kdscli.dll  10.0.26100.7623  Microsoft Key Distribution Service Provider
kdstub.dll  10.0.26100.7705  Network Kernel Debug Extensibility Stubs
kdusb.dll  10.0.26100.1882  USB 2.0 Kernel Debugger
keepaliveprovider.dll  10.0.26100.3037  Keep alive provider API
kerb3961.dll  10.0.26100.7920  Kerberos cipher suites (RFC 3961)
kerbclientshared.dll  10.0.26100.7824  Kerberos Client Shared Functionality
kerberos.dll  10.0.26100.7920  Kerberos Security Package
kernel.appcore.dll  10.0.26100.7920  AppModel API Host
kernel32.dll  10.0.26100.7920  Windows NT BASE API Client DLL
kernelbase.dll  10.0.26100.7920  Windows NT BASE API Client DLL
keycredmgr.dll  10.0.26100.7309  Microsoft Key Credential Manager
keyiso.dll  10.0.26100.7019  CNG Key Isolation Service
keymgr.dll  10.0.26100.1150  Stored User Names and Passwords
keyworddetectormsftsidadapter.dll  10.0.26100.7309  Microsoft keyword detector adapter for speaker id
knobscore.dll  10.0.26100.7309  Knobs Core Library
knobscsp.dll  10.0.26100.7309  Knobs CSP
ksuser.dll  10.0.26100.1150  User CSA Library
ktmw32.dll  10.0.26100.1  Windows KTM Win32 Client DLL
l2gpstore.dll  10.0.26100.1150  Policy Storage dll
l2nacp.dll  10.0.26100.1150  Windows Onex Credential Provider
lamparray.dll  10.0.26100.7920  LampArray DLL for Dynamic Lighting
langcleanupsysprepaction.dll  10.0.26100.4484  Language cleanup Sysprep action
languagecomponentsinstaller.dll  10.0.26100.7920  LanguageComponentsInstaller Task
languageoverlayserver.dll  10.0.26100.7705  Provides infrastructure support for deploying and configuring localized Windows resources.
languageoverlayutil.dll  10.0.26100.7309  Provides helper APIs for managing overlaid localized Windows resources.
languagepackdiskcleanup.dll  10.0.26100.7920  Language Pack Disk Cleanup
languagepackmanagementcsp.dll  10.0.26100.7309  LanguagePackManagementCSP
laprxy.dll  12.0.26100.1  Windows Media Logagent Proxy
laps.dll  10.0.26100.7920  LAPS Server DLL
lapscsp.dll  10.0.26100.7309  LAPS CSP DLL
legacynetux.dll  10.0.26100.1882  Legacy Net UX DLL
legacysystemsettings.dll  10.0.26100.7309  Legacy System Settings Extension Point
lfsvc.dll  10.0.26100.7309  Geolocation Service
libcrypto.dll  3.8.2.0  LibreSSL
liblouis.dll    
libsmartscreenn.dll    
licensemanager.dll  10.0.26100.7920  LicenseManager
licensemanagerapi.dll  10.0.26100.7309  "LicenseManagerApi.DYNLINK"
licensemanagersvc.dll  10.0.26100.7920  LicenseManagerSvc
licenseprotection.dll  10.0.26100.7309  LicenseProtection
licensingcsp.dll  10.0.26100.7309  LicensingCSP
licensingdiagspp.dll  10.0.26100.7309  Licensing Diagnostics SPP Plugin
licensingwinrt.dll  10.0.26100.7920  LicensingWinRuntime
licmgr10.dll  11.0.26100.1150  Microsoft® License Manager DLL
linkinfo.dll  10.0.26100.1  Windows Volume Tracking
lltdapi.dll  10.0.26100.7920  Link-Layer Topology Mapper API
lltdres.dll  10.0.26100.1  Link-Layer Topology Discovery Resources
lltdsvc.dll  10.0.26100.7920  Link-Layer Topology Mapper Service
lmhsvc.dll  10.0.26100.1882  TCPIP NetBios Transport Services DLL
loadperf.dll  10.0.26100.7705  Load & Unload Performance Counters
localkdcsvc.dll  10.0.26100.7920  Local KDC Service
localsec.dll  10.0.26100.7309  Local Users and Groups MMC Snapin
localspl.dll  10.0.26100.7920  Local Spooler DLL
localui.dll  10.0.26100.6899  Local Monitor UI DLL
locationapi.dll  10.0.26100.7309  Microsoft Windows Location API
locationframework.dll  10.0.26100.7920  Windows Geolocation Framework
locationframeworkinternalps.dll  10.0.26100.7019  Windows Geolocation Framework Internal PS
locationframeworkps.dll  10.0.26100.7019  Windows Geolocation Framework PS
locationwinpalmisc.dll  10.0.26100.7920  Windows Location Platform Abstraction Layer
lockappbroker.dll  10.0.26100.7824  Windows Lock App Broker DLL
lockcontroller.dll  10.0.26100.7920  LockController
lockhostingframework.dll  10.0.26100.7824  LockHostingFramework
lockscreencontent.dll  10.0.26100.7920  Windows Lock Screen Content
lockscreencontenthost.dll  10.0.26100.7309  LockScreenContent Host
lockscreendata.dll  10.0.26100.7824  Windows Lock Screen Data DLL
loghours.dll  10.0.26100.1882  Schedule Dialog
logoncli.dll  10.0.26100.7705  Net Logon Client DLL
logoncontroller.dll  10.0.26100.7920  Logon UX Controller
lpasvc.dll  10.0.26100.7920  Local Profile Assistant Service
lpk.dll  10.0.26100.7705  Language Pack
lpksetupproxyserv.dll  10.0.26100.4484  COM proxy server for lpksetup.exe
lsaadt.dll  10.0.26100.8036  Local Security Authority Auditing
lsasrv.dll  10.0.26100.8036  LSA Server DLL
lsm.dll  10.0.26100.8036  Local Session Manager Service
lsmproxy.dll  10.0.26100.7705  LSM interfaces proxy Dll
luiapi.dll  10.0.26100.7920  LUI API
lxutil.dll  10.0.26100.1150  lxutil
lz32.dll  5.0.1.1  LZ Expand/Compress API DLL
magnification.dll  10.0.26100.1150  Microsoft Magnification API
maintenanceui.dll  10.0.26100.7309  Maintenance Settings Control Panel
manageci.dll  10.0.26100.7705  Code Integrity Management Interface
mapconfiguration.dll  10.0.26100.7309  MapConfiguration
mapcontrolcore.dll  10.0.26100.7309  Map Control Core
mapcontrolstringsres.dll  10.0.26100.1882  Map control resource strings
mapgeocoder.dll  10.0.26100.7309  Maps Geocoder
mapi32.dll  1.0.2536.0  Extended MAPI 1.0 for Windows NT
mapistub.dll  1.0.2536.0  Extended MAPI 1.0 for Windows NT
maprouter.dll  10.0.26100.7705  Maps Router
mapsbtsvc.dll  10.0.26100.7309  Maps Background Transfer Service
mapsbtsvcproxy.dll  10.0.26100.1882  Maps Background Transfer Service proxy
mapscsp.dll  10.0.26100.7309  MapsCSP
mapsstore.dll  10.0.26100.7309  Maps Store Dll
mapstoasttask.dll  10.0.26100.7309  MapsToastTask Task
mapsupdatetask.dll  10.0.26100.7309  MapsUpdateTask Task
mbaeapi.dll  10.0.26100.7920  Mobile Broadband Account Experience API
mbaeapipublic.dll  10.0.26100.7920  Mobile Broadband Account API
mbmediamanager.dll  10.0.26100.7920  Windows MB Media Manager DLL
mbsmsapi.dll  10.0.26100.7920  Microsoft Windows Mobile Broadband SMS API
mbussdapi.dll  10.0.26100.7705  Microsoft Windows Mobile Broadband USSD API
mccsengineshared.dll  10.0.26100.7309  Utilies shared among OneSync engines
mccspal.dll  10.0.26100.1882  Platform abstraction layer dll for MCCS
mciavi32.dll  10.0.26100.1882  Video For Windows MCI driver
mcicda.dll  10.0.26100.1150  MCI driver for cdaudio devices
mciqtz32.dll  10.0.26100.1150  DirectShow MCI Driver
mciseq.dll  10.0.26100.1  MCI driver for MIDI sequencer
mciwave.dll  10.0.26100.5074  MCI driver for waveform audio
mcmsvc.dll  10.0.26100.7920  Mobile Connectivity Management Service
mcpmanagementproxy.dll  10.0.26100.7705  Universal Print Management COM Proxy dll
mcpmanagementservice.dll  10.0.26100.7920  Universal Print Management Service
mcrecvsrc.dll  10.0.26100.7920  Miracast Media Foundation Source DLL
mcupdate_authenticamd.dll    
mcupdate_genuineintel.dll    
mdmcommon.dll  10.0.26100.7309  MdmCommon
mdmdiagnostics.dll  10.0.26100.7920  MdmDiagnostics
mdminst.dll  10.0.26100.1150  Modem Class Installer
mdmlocalmanagement.dll  10.0.26100.7309  MDM Local Management DLL
mdmmigrator.dll  10.0.26100.7309  Device Management Update Migrator DLL
mdmpostprocessevaluator.dll  10.0.26100.7309  MDM PostProcessing Configuration Dependency Evaluator
mdmregistration.dll  10.0.26100.7920  MDM Registration DLL
mediafoundation.defaultperceptionprovider.dll  10.0.26100.7309  MediaFoundation Default Perception Provider
mediafoundationaggregator.dll    
memorydiagnostic.dll  10.0.26100.7920  Microsoft Windows Memory Diagnostic Task Handler
messagingdatamodel2.dll  10.0.26100.7309  MessagingDataModel2
messagingservice.dll  10.0.26100.7705  Messaging Service
mf.dll  10.0.26100.8036  Media Foundation DLL
mf3216.dll  10.0.26100.8036  32-bit to 16-bit Metafile Conversion DLL
mfaacenc.dll  10.0.26100.7309  Media Foundation AAC Encoder
mfasfsrcsnk.dll  10.0.26100.7920  Media Foundation ASF Source and Sink DLL
mfaudiocnv.dll  10.0.26100.7309  Media Foundation Audio Converter DLL
mfc42.dll  6.6.8063.0  MFCDLL Shared Library - Retail Version
mfc42u.dll  6.6.8063.0  MFCDLL Shared Library - Retail Version
mfcaptureengine.dll  10.0.26100.7920  Media Foundation CaptureEngine DLL
mfcore.dll  10.0.26100.8036  Media Foundation Core DLL
mfcsubs.dll  2001.12.10941.16384  COM+
mfds.dll  10.0.26100.7309  Media Foundation Direct Show wrapper DLL
mfdshowreversebridge.dll  10.0.26100.7920  Media Foundation Reverse Dshow Bridge Source DLL
mfdvdec.dll  10.0.26100.5074  Media Foundation DV Decoder
mferror.dll  10.0.26100.3912  Media Foundation Error DLL
mfh263enc.dll  10.0.26100.3912  Media Foundation h263 Encoder
mfh264enc.dll  10.0.26100.7920  Media Foundation H264 Encoder
mfksproxy.dll  10.0.26100.7920  Dshow MF Bridge DLL DLL
mfmediaengine.dll  10.0.26100.7920  Media Foundation Media Engine DLL
mfmjpegdec.dll  10.0.26100.7920  Media Foundation MJPEG Decoder
mfmkvsrcsnk.dll  10.0.26100.7920  Media Foundation MKV Media Source and Sink DLL
mfmp4srcsnk.dll  10.0.26100.8036  Media Foundation MPEG4 Source and Sink DLL
mfmpeg2srcsnk.dll  10.0.26100.7920  Media Foundation MPEG2 Source and Sink DLL
mfnetcore.dll  10.0.26100.7309  Media Foundation Net Core DLL
mfnetsrc.dll  10.0.26100.7309  Media Foundation Net Source DLL
mfperfhelper.dll  10.0.26100.1150  MFPerf DLL
mfplat.dll  10.0.26100.7920  Media Foundation Platform DLL
mfplay.dll  10.0.26100.7920  Media Foundation Playback API DLL
mfps.dll  10.0.26100.1882  Media Foundation Proxy DLL
mfreadwrite.dll  10.0.26100.7920  Media Foundation ReadWrite DLL
mfsensorgroup.dll  10.0.26100.7920  Media Foundation Sensor Group DLL
mfsrcsnk.dll  10.0.26100.7920  Media Foundation Source and Sink DLL
mfsvr.dll  10.0.26100.7920  Media Foundation Simple Video Renderer DLL
mftranscode.dll  10.0.26100.7920  Media Foundation Transcode DLL
mfvdsp.dll  10.0.26100.5074  Windows Media Foundation Video DSP Components
mfvfw.dll  10.0.26100.1150  MF VFW MFT
mfwmaaec.dll  10.0.26100.1882  Windows Media Audio AEC for Media Foundation
mgmtapi.dll  10.0.26100.1150  Microsoft SNMP Manager API (uses WinSNMP)
mgmtrefreshcredprov.dll  10.0.26100.7309  Autopilot Reset Credential Provider
mi.dll  10.0.26100.1  Management Infrastructure
mibincodec.dll  10.0.26100.1  Management Infrastructure binary codec component
microsoft.bluetooth.audio.dll  10.0.26100.7920  Microsoft.Bluetooth.Audio DLL
microsoft.bluetooth.proxy.dll  10.0.26100.7309  Microsoft Bluetooth COM Proxy DLL
microsoft.bluetooth.service.dll  10.0.26100.7920  Microsoft.Bluetooth.Service DLL
microsoft.bluetooth.userservice.dll  10.0.26100.7920  Bluetooth User Support Service
microsoft.data.usageandqualityinsights.dll  10.0.26100.7920  Microsoft.Data.UsageAndQualityInsights
microsoft.graphics.display.displayenhancementservice.dll  10.0.26100.7920  Microsoft.Graphics.Display.DisplayEnhancementService DLL
microsoft.internal.frameworkudk.system.dll  10.0.26100.7309  Microsoft Framework UDK System DLL
microsoft.internal.warppal.dll    
microsoft.localuserimageprovider.dll  10.0.26100.7309  Local User Image Provider
microsoft.management.infrastructure.native.unmanaged.dll  10.0.26100.1  Microsoft.Management.Infrastructure.Native.Unmanaged.dll
microsoft.media.playready.appraiser.dll  10.0.10011.16384  Microsoft Media PlayReady Appraiser Dll
microsoft.windows.storage.core.dll  10.0.26100.1  
microsoft.windows.storage.storagebuscache.dll  10.0.26100.1  
microsoftaccount.tokenprovider.core.dll  10.0.26100.7920  Microsoft Account Token Provider Core
microsoftaccountcloudap.dll  10.0.26100.7309  MicrosoftAccount Cloud AP Plugin
microsoftaccountextension.dll  10.0.26100.7920  Microsoft Account Extension DLL
microsoftaccounttokenprovider.dll  10.0.26100.7920  Microsoft® Account Token Provider
microsoftaccountwamextension.dll  10.0.26100.7920  Microsoft Account WAM Extension DLL
microsoft-windows-appmodelexecevents.dll  10.0.26100.1  AppModel Execution Provider
microsoft-windows-battery-events.dll  10.0.26100.3624  Microsoft-Windows-Battery-Events Resources
microsoft-windows-hal-events.dll  10.0.26100.1  Microsoft-Windows-HAL-Events Resources
microsoft-windows-internal-shell-nearshareexperience.dll  10.0.26100.7824  NearByShareExperience
microsoft-windows-kernel-cc-events.dll  10.0.26100.1  Microsoft-Windows-Kernel-Cache-Events Resources
microsoft-windows-kernel-pnp-events.dll  10.0.26100.1591  Microsoft-Windows-Kernel-Pnp-Events Resources
microsoft-windows-kernel-power-events.dll  10.0.26100.7171  Microsoft-Windows-Kernel-Power-Events Resources
microsoft-windows-kernel-processor-power-events.dll  10.0.26100.7705  Microsoft-Windows-Kernel-Processor-Power-Events Resources
microsoft-windows-mapcontrols.dll  10.0.26100.1882  Map Event Resources
microsoft-windows-moshost.dll  10.0.26100.1882  MosHost Event Resources
microsoft-windows-mptf-events.dll  10.0.26100.7309  Microsoft-Windows-MPTF-Events Resources
microsoft-windows-pdc.dll  10.0.26100.1  Microsoft-Windows-Pdc Resources
microsoft-windowsphone-semanagementprovider.dll  10.0.26100.3323  Microsoft-WindowsPhone-SEManagementProvider
microsoft-windows-power-cad-events.dll  10.0.26100.1  Microsoft-Windows-Power-CAD-Events Resources
microsoft-windows-processor-aggregator-events.dll  10.0.26100.1  Microsoft-Windows-Processor-Aggregator-Events Resources
microsoft-windows-sleepstudy-events.dll  10.0.26100.4202  Microsoft-Windows-SleepStudy-Events Resources
microsoft-windows-storage-tiering-events.dll  10.0.26100.1  Microsoft-Windows-Storage-Tiering-Events Resources
microsoft-windows-system-events.dll  10.0.26100.7920  Microsoft-Windows-System-Events Resources
midi2.bs2umptransform.dll  1.0.15.0  MIDI 2.0 translation service plugin
midi2.diagnosticstransport.dll  1.0.15.0  Windows MIDI Services Service Test Transport Plugin
midi2.ksaggregatetransport.dll  1.0.15.0  Windows MIDI Services KSA Transport Plugin
midi2.kstransport.dll  1.0.15.0  Windows MIDI Services KS Transport Plugin
midi2.loopbackmiditransport.dll  1.0.15.0  Windows MIDI Services Loopback Transport Plugin
midi2.midisrvtransport.dll  1.0.15.0  Windows MIDI Services app API service interface
midi2.schedulertransform.dll  1.0.15.0  Windows MIDI Services Message Scheduler Service Plugin
midi2.ump2bstransform.dll  1.0.15.0  MIDI 2.0 translation service plugin
midi2.umpprotocoldownscalertransform.dll  1.0.15.0  MIDI 2.0 to MIDI 1.0 downscaler service plugin
midi2.virtualmiditransport.dll  1.0.15.0  Windows MIDI Services Virtual Device MIDI Transport Plugin
midimap.dll  10.0.26100.1882  Microsoft MIDI Mapper
migisol.dll  10.0.26100.1  Migration System Isolation Layer
miguiresource.dll  10.0.26100.7019  MIG wini32 resources
mimefilt.dll  2008.0.26100.7309  MIME Filter
mimofcodec.dll  10.0.26100.1150  Management Infrastructure mof codec component
minstoreevents.dll  10.0.26100.1  Minstore Event Resource
miracastinputmgr.dll  10.0.26100.1150  Miracast Input Manager DLL
miracastreceiver.dll  10.0.26100.7705  Miracast Receiver API
miracastreceiverext.dll  10.0.26100.7309  Miracast Receiver Extensions
mirrordrvcompat.dll  10.0.26100.1150  Mirror Driver Compatibility Helper
mispace.dll  10.0.26100.7920  Storage Management Provider for Spaces
missioncontrolaggregator.dll  10.0.26100.7309  Microsoft (R) Sample Aggregator Native Aggregation Plugin
mitigationclient.dll  10.0.26100.7920  MitigationClient
mitigationconfiguration.dll  10.0.26100.7309  Exploit Guard Configuration Helper
miutils.dll  10.0.26100.3323  Management Infrastructure
mlang.dll  10.0.26100.7019  Multi Language Support DLL
mmcbase.dll  10.0.26100.5074  MMC Base DLL
mmcndmgr.dll  10.0.26100.7920  MMC Node Manager DLL
mmcshext.dll  10.0.26100.5074  MMC Shell Extension DLL
mmdevapi.dll  10.0.26100.7920  MMDevice API
mmgaclient.dll  10.0.26100.7309  MMGA
mmgaproxystub.dll  10.0.26100.1150  MMGA
mmres.dll  10.0.26100.1  General Audio Resources
mobilenetworking.dll  10.0.26100.7705  "MobileNetworking.DYNLINK"
modemui.dll  10.0.26100.1882  Windows Modem Properties
modernexecserver.dll  10.0.26100.7309  Modern Execution Server
modernprintconfighelper.dll  10.0.26100.7920  Microsoft Modern Print Config Helper
moricons.dll  10.0.26100.1  Windows NT Setup Icon Resources Library
moshost.dll  10.0.26100.7309  Downloaded Maps Manager
moshostclient.dll  10.0.26100.7309  MosHostClient
moshostcore.dll  10.0.26100.7309  Downloaded Maps Manager Core
mosstorage.dll  10.0.26100.7309  MosStorage
mp3dmod.dll  10.0.26100.4202  Microsoft MP3 Decoder DMO
mp43decd.dll  10.0.26100.1150  Windows Media MPEG-4 Video Decoder
mp4sdecd.dll  10.0.26100.7019  Windows Media MPEG-4 S Video Decoder
mpecm.dll  10.0.26100.7309  Microsoft Privacy Engine Connection Monitor Native Aggregation Plugin
mpehttpext.dll  10.0.26100.7309  Microsoft Privacy Engine HTTP Extension DLL
mpeval.dll  10.0.26100.1882  Monitoring Platform Evaluator
mpg4decd.dll  10.0.26100.2894  Windows Media MPEG-4 Video Decoder
mpr.dll  10.0.26100.7019  Multiple Provider Router DLL
mprapi.dll  10.0.26100.7920  Windows NT MP Router Administration DLL
mprddm.dll  10.0.26100.7920  Demand Dial Manager Supervisor
mprdim.dll  10.0.26100.7920  Dynamic Interface Manager
mprext.dll  10.0.26100.1  Multiple Provider Router Extension DLL
mprmsg.dll  10.0.26100.3037  Multi-Protocol Router Service Messages DLL
mpssvc.dll  10.0.26100.7920  Microsoft Protection Service
mpunits.dll  10.0.26100.1882  Monitoring Platform Built-In Composable Units
mrmcorer.dll  10.0.26100.7920  Microsoft Windows MRM
mrmdeploy.dll  10.0.26100.7920  Microsoft Windows MRM Deployment
mrmindexer.dll  10.0.26100.7920  Microsoft Windows MRM
mrt_map.dll  2.2.29722.0  Microsoft .NET Native Error Reporting Helper
mrt100.dll  2.2.29722.0  Microsoft .NET Native Runtime
ms3dthumbnailprovider.dll  10.0.26100.7309  3D Builder
msaatext.dll  2.0.10413.0  Active Accessibility text support
msacm32.dll  10.0.26100.7019  Microsoft ACM Audio Filter
msadce.dll  10.0.26100.5074  OLE DB Cursor Engine
msadce.dll  10.0.26100.5074  OLE DB Cursor Engine
msadcer.dll  10.0.26100.1  OLE DB Cursor Engine Resources
msadcer.dll  10.0.26100.1  OLE DB Cursor Engine Resources
msadco.dll  10.0.26100.5074  Remote Data Services Data Control
msadco.dll  10.0.26100.5074  Remote Data Services Data Control
msadcor.dll  10.0.26100.1  Remote Data Services Data Control Resources
msadcor.dll  10.0.26100.1  Remote Data Services Data Control Resources
msadds.dll  10.0.26100.5074  OLE DB Data Shape Provider
msadds.dll  10.0.26100.5074  OLE DB Data Shape Provider
msaddsr.dll  10.0.26100.1   OLE DB Data Shape Provider Resources
msaddsr.dll  10.0.26100.1   OLE DB Data Shape Provider Resources
msader15.dll  10.0.26100.1  ActiveX Data Objects Resources
msader15.dll  10.0.26100.1  ActiveX Data Objects Resources
msado15.dll  10.0.26100.5074  ActiveX Data Objects
msado15.dll  10.0.26100.5074  ActiveX Data Objects
msadomd.dll  10.0.26100.3912  ActiveX Data Objects (Multi-Dimensional)
msadomd.dll  10.0.26100.3912  ActiveX Data Objects (Multi-Dimensional)
msador15.dll  10.0.26100.1  Microsoft ActiveX Data Objects Recordset
msador15.dll  10.0.26100.1  Microsoft ActiveX Data Objects Recordset
msadox.dll  10.0.26100.3037  ActiveX Data Objects Extensions
msadox.dll  10.0.26100.5074  ActiveX Data Objects Extensions
msadrh15.dll  10.0.26100.3037  ActiveX Data Objects Rowset Helper
msadrh15.dll  10.0.26100.3037  ActiveX Data Objects Rowset Helper
msafd.dll  10.0.26100.1  Microsoft Windows Sockets 2.0 Service Provider
msalacdecoder.dll  10.0.26100.1150  Media Foundation ALAC Decoder
msalacencoder.dll  10.0.26100.1150  Media Foundation ALAC Encoder
msamrnbdecoder.dll  10.0.26100.1150  AMR Narrowband Decoder DLL
msamrnbencoder.dll  10.0.26100.1150  AMR Narrowband Encoder DLL
msamrnbsink.dll  10.0.26100.1150  AMR Narrowband Sink DLL
msamrnbsource.dll  10.0.26100.7309  AMR Narrowband Source DLL
msaprofilenotificationhandler.dll  10.0.26100.7309  MSA Profile Notification Handler
msasn1.dll  10.0.26100.7623  ASN.1 Runtime APIs
msauddecmft.dll  10.0.26100.7920  Media Foundation Audio Decoders
msaudite.dll  10.0.26100.6725  Security Audit Events DLL
msauserext.dll  10.0.26100.7309  MSA USER Extension DLL
mscandui.dll  10.0.26100.7309  MSCANDUI Server DLL
mscat32.dll  10.0.26100.1  MSCAT32 Forwarder DLL
msclmd.dll  10.0.26100.8037  Microsoft Class Mini-driver
mscms.dll  10.0.26100.7920  Microsoft Color Matching System DLL
mscoree.dll  10.0.26100.3624  Microsoft .NET Runtime Execution Engine
mscorier.dll  10.0.26100.1  Microsoft .NET Runtime IE resources
mscories.dll  2.0.50727.9157  Microsoft .NET IE SECURITY REGISTRATION
msctf.dll  10.0.26100.7920  MSCTF Server DLL
msctfmonitor.dll  10.0.26100.7309  MsCtfMonitor DLL
msctfp.dll  10.0.26100.3624  MSCTFP Server DLL
msctfui.dll  10.0.26100.7309  MSCTFUI Server DLL
msctfuimanager.dll  10.0.26100.7920  Microsoft UIManager DLL
msdadc.dll  10.0.26100.1  OLE DB Data Conversion Stub
msdadiag.dll  10.0.26100.1  Built-In Diagnostics
msdaenum.dll  10.0.26100.1  OLE DB Root Enumerator Stub
msdaer.dll  10.0.26100.1  OLE DB Error Collection Stub
msdaora.dll  10.0.26100.3912  OLE DB Provider for Oracle
msdaorar.dll  10.0.26100.1  OLE DB Provider for Oracle Resources
msdaosp.dll  10.0.26100.1  OLE DB Simple Provider
msdaosp.dll  10.0.26100.1150  OLE DB Simple Provider
msdaprsr.dll  10.0.26100.1  OLE DB Persistence Services Resources
msdaprsr.dll  10.0.26100.1  OLE DB Persistence Services Resources
msdaprst.dll  10.0.26100.1  OLE DB Persistence Services
msdaprst.dll  10.0.26100.1150  OLE DB Persistence Services
msdaps.dll  10.0.26100.1  OLE DB Interface Proxies/Stubs
msdaps.dll  10.0.26100.1150  OLE DB Interface Proxies/Stubs
msdarem.dll  10.0.26100.3037  OLE DB Remote Provider
msdarem.dll  10.0.26100.5074  OLE DB Remote Provider
msdaremr.dll  10.0.26100.1  OLE DB Remote Provider Resources
msdaremr.dll  10.0.26100.1  OLE DB Remote Provider Resources
msdart.dll  10.0.26100.3037  OLE DB Runtime Routines
msdasc.dll  10.0.26100.1  OLE DB Service Components Stub
msdasql.dll  10.0.26100.2894  OLE DB Provider for ODBC Drivers
msdasql.dll  10.0.26100.2894  OLE DB Provider for ODBC Drivers
msdasqlr.dll  10.0.26100.1  OLE DB Provider for ODBC Drivers Resources
msdasqlr.dll  10.0.26100.1  OLE DB Provider for ODBC Drivers Resources
msdatl3.dll  10.0.26100.1882  OLE DB Implementation Support Routines
msdatl3.dll  10.0.26100.1882  OLE DB Implementation Support Routines
msdatt.dll  10.0.26100.1  OLE DB Temporary Table Services
msdaurl.dll  10.0.26100.1  OLE DB RootBinder Stub
msdelta.dll  5.0.1.1  Microsoft Patch Engine
msdfmap.dll  10.0.26100.1  Data Factory Handler
msdfmap.dll  10.0.26100.1150  Data Factory Handler
msdmo.dll  10.0.26100.1150  DMO Runtime
msdrm.dll  10.0.26100.1150  Windows Rights Management client
msdtckrm.dll  2001.12.10941.16384  Microsoft Distributed Transaction Coordinator OLE Transactions KTM Resource Manager DLL
msdtclog.dll  2001.12.10941.16384  Microsoft Distributed Transaction Coordinator Log Manager DLL
msdtcprx.dll  2001.12.10941.16384  Microsoft Distributed Transaction Coordinator OLE Transactions Interface Proxy DLL
msdtcspoffln.dll  2001.12.10941.16384  Microsoft Distributed Transaction Coordinator SysPrep Specialize Offline DLL
msdtctm.dll  2001.12.10941.16384  Microsoft Distributed Transaction Coordinator Transaction Manager DLL
msdtcuiu.dll  2001.12.10941.16384  Microsoft Distributed Transaction Coordinator Administrative DLL
msdtcvsp1res.dll  2001.12.10941.16384  Microsoft Distributed Transaction Coordinator Resources for Vista SP1
msfeeds.dll  11.0.26100.7309  Microsoft Feeds Manager
msfeedsbs.dll  11.0.26100.7309  Microsoft Feeds Background Sync
msflacdecoder.dll  10.0.26100.7920  Media Foundation FLAC Decoder
msflacencoder.dll  10.0.26100.7309  Media Foundation FLAC Encoder
msftedit.dll  10.0.26100.7705  Rich Text Edit Control, v8.5
msftoemdlligneous.dll  10.0.26100.7309  Microsoft OEM DLL for Igneous
mshtml.dll  11.0.26100.7920  Microsoft (R) HTML Viewer
mshtmldac.dll  11.0.26100.1150  DAC for Trident DOM
mshtmled.dll  11.0.26100.2454  Microsoft® HTML Editing Component
mshtmler.dll  11.0.26100.4202  Microsoft® HTML Editing Component's Resource DLL
msi.dll  5.0.26100.7920  Windows Installer
msicofire.dll  10.0.26100.1150  Corrupted MSI File Recovery Diagnostic Module
msidcrl40.dll  10.0.26100.1150  Microsoft® Account Dynamic Link Library
msident.dll  10.0.26100.1882  Microsoft Identity Manager
msidle.dll  10.0.26100.1  User Idle Monitor
msidntld.dll  10.0.26100.1  Microsoft Identity Manager
msieftp.dll  10.0.26100.7309  Microsoft Internet Explorer FTP Folder Shell Extension
msihnd.dll  5.0.26100.7920  Windows® installer
msiltcfg.dll  5.0.26100.3624  Windows Installer Configuration API Stub
msimg32.dll  10.0.26100.8036  GDIEXT Client DLL
msimsg.dll  5.0.26100.7920  Windows® Installer International Messages
msimtf.dll  10.0.26100.1150  Active IMM Server DLL
msisip.dll  5.0.26100.7309  MSI Signature SIP Provider
msiso.dll  11.0.26100.8036  Isolation Library for Internet Explorer
msiwer.dll  5.0.26100.1  MSI Windows Error Reporting
msixdatasourceextensionps.dll  10.0.26100.1150  APPX Random Access Stream Provider COM Proxy/Stub DLL
msjro.dll  10.0.26100.3912  Jet and Replication Objects
mskeyprotcli.dll  10.0.26100.7309  Windows Client Key Protection Provider
mskeyprotect.dll  10.0.26100.7623  Microsoft Key Protection Provider
msls31.dll  3.10.349.0  Microsoft Line Services library file
msmpeg2adec.dll  10.0.26100.7705  Microsoft DTV-DVD Audio Decoder
msmpeg2enc.dll  10.0.26100.7705  Microsoft MPEG-2 Encoder
msmpeg2vdec.dll  10.0.26100.8036  Microsoft DTV-DVD Video Decoder
msobjs.dll  10.0.26100.6725  System object audit names
msoert2.dll  10.0.26100.6725  Microsoft Windows Mail RT Lib
msopusdecoder.dll  10.0.26100.1150  Media Foundation Opus Decoder
mspatcha.dll  5.0.1.1  Microsoft File Patch Application API
mspatchc.dll  5.0.1.1  Microsoft Patch Creation Engine
msphotography.dll  10.0.26100.7920  MS Photography DLL
msports.dll  10.0.26100.7309  Ports Class Installer
msprivs.dll  10.0.26100.1  Microsoft Privilege Translations
msrahc.dll  10.0.26100.7623  Remote Assistance Diagnostics Provider
msrating.dll  10.0.26100.2454  "msrating.DYNLINK"
msrdc.dll  10.0.26100.5074  Remote Differential Compression COM server
msrdpwebaccess.dll  10.0.26100.1150  Microsoft Remote Desktop Services Web Access Control
msrle32.dll  10.0.26100.1882  Microsoft RLE Compressor
msscntrs.dll  7.0.26100.7920  PKM Perfmon Counter DLL
mssign32.dll  10.0.26100.7309  Microsoft Trust Signing APIs
mssip32.dll  10.0.26100.1  MSSIP32 Forwarder DLL
mssitlb.dll  7.0.26100.7920  mssitlb
msspellcheckingfacility.dll  10.0.26100.7920  Microsoft Spell Checking Facility
mssph.dll  7.0.26100.7920  Microsoft Search Protocol Handler
mssprxy.dll  7.0.26100.7920  Microsoft Search Proxy
mssrch.dll  7.0.26100.7920  Microsoft Embedded Search
mssvp.dll  7.0.26100.7920  MSSearch Vista Platform
mstask.dll  10.0.26100.1150  Task Scheduler interface DLL
mstextprediction.dll  10.0.26100.5074  Microsoft TextPrediction DLL
mstscax.dll  10.0.26100.7920  Remote Desktop Services ActiveX Client
msutb.dll  10.0.26100.7920  MSUTB Server DLL
msv1_0.dll  10.0.26100.7920  Microsoft Authentication Package v1.0
msvcirt.dll  7.0.26100.3323  Windows NT IOStreams DLL
msvcp_win.dll  10.0.26100.7623  Microsoft® C Runtime Library
msvcp110_win.dll  10.0.26100.7019  Microsoft® STL110 C++ Runtime Library
msvcp120_clr0400.dll  12.0.52519.0  Microsoft® C Runtime Library
msvcp140_clr0400.dll  14.29.30154.0  Microsoft® C Runtime Library
msvcp60.dll  7.0.26100.1  Windows NT C++ Runtime Library DLL
msvcr100_clr0400.dll  14.8.9221.0  Microsoft® .NET Framework
msvcr120_clr0400.dll  12.0.52519.0  Microsoft® C Runtime Library
msvcrt.dll  7.0.26100.7623  Windows NT CRT DLL
msvfw32.dll  10.0.26100.1150  Microsoft Video for Windows DLL
msvidc32.dll  10.0.26100.1882  Microsoft Video 1 Compressor
msvidctl.dll  6.5.26100.5074  ActiveX control for streaming video
msvideodsp.dll  10.0.26100.5074  Video Stabilization MFT
msvp9dec.dll  10.0.26100.4202  Windows VP9 Video Decoder
msvproc.dll  10.0.26100.7920  Media Foundation Video Processor
msvpxenc.dll  10.0.26100.4202  Windows VPX Video Encoder
mswb7.dll  10.0.26100.7309  MSWB7 DLL
mswmdm.dll  12.0.26100.5074  Windows Media Device Manager Core
mswsock.dll  10.0.26100.7920  Microsoft Windows Sockets 2.0 Service Provider
msxactps.dll  10.0.26100.1  OLE DB Transaction Proxies/Stubs
msxactps.dll  10.0.26100.1  OLE DB Transaction Proxies/Stubs
msxml3.dll  8.110.26100.7309  MSXML 3.0
msxml3r.dll  8.110.26100.1882  XML Resources
msxml6.dll  6.30.26100.7309  MSXML 6.0
msxml6r.dll  6.30.26100.1882  XML Resources
msyuv.dll  10.0.26100.1150  Microsoft UYVY Video Decompressor
mtcmodel.dll  10.0.26100.7309  MtcModel
mtf.dll  10.0.26100.7309  "MTF.DYNLINK"
mtfappserviceds.dll  10.0.26100.7309  Microsoft AppService Datasource Dll
mtfdecoder.dll  10.0.26100.7309  "MtfDecoder.DYNLINK"
mtffuzzyds.dll  10.0.26100.7309  Microsoft Fuzzy Datasource Dll
mtfserver.dll  10.0.26100.7309  "MTFServer.DYNLINK"
mtfspellcheckds.dll  10.0.26100.7309  "MTFSpellcheckDS.DYNLINK"
mtxclu.dll  2001.12.10941.16384  Microsoft Distributed Transaction Coordinator Failover Clustering Support DLL
mtxdm.dll  2001.12.10941.16384  COM+
mtxex.dll  2001.12.10941.16384  COM+
mtxoci.dll  2001.12.10941.16384  Microsoft Distributed Transaction Coordinator Database Support DLL for Oracle
muifontsetup.dll  10.0.26100.2161  MUI Callback for font registry settings
muilanguagecleanup.dll  10.0.26100.4484  MUI Callback for Language pack cleanup
musappupdatehandlers.dll  10.0.26100.7920  Modern App Update Settings Handler Implementation
museuxdocked.dll  10.0.26100.7920  Muse Ux Docked DLL
musupdatehandlers.dll    
musupdatehandlers1.dll  10.0.26100.7920  Modern Update Settings Handler Implementation
mycomput.dll  10.0.26100.7019  Computer Management
mydocs.dll  10.0.26100.7309  My Documents Folder UI
napcrypt.dll  10.0.26100.8036  NAP Cryptographic API helper
napinsp.dll  10.0.26100.1150  E-mail Naming Shim Provider
naturalauth.dll  10.0.26100.7309  Natural Authentication Service
naturalauthclient.dll  10.0.26100.1882  Natural Authentication Client Library
naturallanguage6.dll  10.0.26100.7309  Natural Language Development Platform 6
navshutdown.dll  10.0.26100.7309  NAVShutdown
ncaapi.dll  10.0.26100.1  Microsoft Network Connectivity Assistant API
ncasvc.dll  10.0.26100.5074  Microsoft Network Connectivity Assistant Service
ncbservice.dll  10.0.26100.7309  Network Connection Broker
ncdautosetup.dll  10.0.26100.7309  Network Connected Devices Auto-Setup service DLL
ncdprop.dll  10.0.26100.1150  Advanced network device properties
nci.dll  10.0.26100.7309  CoInstaller: NET
ncobjapi.dll  10.0.26100.7920  Microsoft® Windows® Operating System
ncrypt.dll  10.0.26100.7705  Windows NCrypt Router
ncryptprov.dll  10.0.26100.7920  Microsoft KSP
ncryptsslp.dll  10.0.26100.5074  Microsoft SChannel Provider
ncsi.dll  10.0.26100.7920  Network Connectivity Status Indicator
ncuprov.dll  10.0.26100.7920  Network Connectivity Statistics Provider for System Resource Usage Monitor Service
nddeapi.dll  10.0.26100.1  Network DDE Share Management APIs
ndfapi.dll  10.0.26100.7920  Network Diagnostic Framework Client API
ndfetw.dll  10.0.26100.5074  Network Diagnostic Engine Event Interface
ndfhcdiscovery.dll  10.0.26100.5074  Network Diagnostic Framework HC Discovery API
ndproxystub.dll  10.0.26100.1150  Network Diagnostic Engine Proxy/Stub
nduprov.dll  10.0.26100.7920  Network Statistics Provider for System Resource Usage Monitor Service
negoexts.dll  10.0.26100.7309  NegoExtender Security Package
netapi32.dll  10.0.26100.7019  Net Win32 API DLL
netbios.dll  10.0.26100.1  NetBIOS Interface Library
netcenter.dll  10.0.26100.7309  Network Center control panel
netcfgx.dll  10.0.26100.7309  Network Configuration Objects
netdiagfx.dll  10.0.26100.7309  Network Diagnostic Framework
netdriverinstall.dll  10.0.26100.7920  Network Driver Installation
netevent.dll  10.0.26100.4202  Net Event Handler
netfxperf.dll  10.0.26100.3624  Extensible Performance Counter Shim
neth.dll  10.0.26100.4202  Net Help Messages DLL
netid.dll  10.0.26100.7309  System Control Panel Applet; Network ID Page
netiohlp.dll  10.0.26100.7920  Netio Helper DLL
netjoin.dll  10.0.26100.3037  Domain Join DLL
netlogon.dll  10.0.26100.7920  Net Logon Services DLL
netman.dll  10.0.26100.7920  Network Connections Manager
netmsg.dll  10.0.26100.4202  Net Messages DLL
netplwiz.dll  10.0.26100.7824  Map Network Drives/Network Places Wizard
netprofm.dll  10.0.26100.7920  Network List Manager
netprofmsvc.dll  10.0.26100.7920  Network Profile Service DLL
netprovfw.dll  10.0.26100.1150  Provisioning Service Framework DLL
netprovisionsp.dll  10.0.26100.1  Provisioning Service Provider DLL
netsetupapi.dll  10.0.26100.7920  Network Configuration API
netsetupengine.dll  10.0.26100.7920  Network Configuration Engine
netsetupshim.dll  10.0.26100.7705  Network Configuration API
netsetupsvc.dll  10.0.26100.7705  Network Setup Service
netshell.dll  10.0.26100.7920  Network Connections Shell
nettrace.dll  10.0.26100.7920  Network Trace Helper
nettracehelper.dll  10.0.26100.7920  Network Trace Helper
netutils.dll  10.0.26100.1882  Net Win32 API Helpers DLL
networkbindingenginemigplugin.dll  10.0.26100.7824  Network Binding Engine Migration Plugin
networkcollectionagent.dll  11.0.26100.3624  Network Collection Agent
networkdesktopsettings.dll  10.0.26100.7920  System settings network desktop handlers group
networkexplorer.dll  10.0.26100.7309  Network Explorer
networkhelper.dll  10.0.26100.7309  Network utilities for mail, contacts, calendar
networkicon.dll  10.0.26100.7920  In-Proc WinRT server for Windows.Internal.UX.NetworkUX.NetworkIcon
networkitemfactory.dll  10.0.26100.1  NetworkItem Factory
networkmobilesettings.dll  10.0.26100.7920  System settings network mobile handlers group
networkproxycsp.dll  10.0.26100.1150  NetworkProxyCSP
networkqospolicycsp.dll  10.0.26100.7309  NetworkQoSPolicyCSP
networkuxbroker.dll  10.0.26100.7920  NetworkUXBroker DLL
newdev.dll  6.0.5054.0  Add Hardware Device Library
nfcprovisioningplugin.dll  10.0.26100.7309  NFC Provisioning Plugin
nfcradiomedia.dll  10.0.26100.3323  NFC Radio Media Provider
ngccredprov.dll  10.0.26100.7920  Microsoft Passport Credential Provider
ngcctnr.dll  10.0.26100.7920  Microsoft Passport Container
ngcctnrgidshandler.dll  10.0.26100.7309  Microsoft Passport Container GIDS Handler
ngcctnrsvc.dll  10.0.26100.7920  Microsoft Passport Container Service
ngcisoctnr.dll  10.0.26100.7920  Windows Hello Secure Container
ngckeyenum.dll  10.0.26100.7920  Microsoft Passport Key Enumeration Manager
ngcksp.dll  10.0.26100.7920  Microsoft Passport Key Storage Provider
ngclocal.dll  10.0.26100.7920  NGC Local Account APIs
ngcpopkeysrv.dll  10.0.26100.7920  Microsoft Passport Proof-of-possession Key Service
ngcprocsp.dll  10.0.26100.7920  Microsoft Passport CSP
ngcrecovery.dll  10.0.26100.7920  Windows Hello Recovery Helper
ngcsvc.dll  10.0.26100.7920  Microsoft Passport Service
ngctasks.dll  10.0.26100.7920  Microsoft Passport Tasks
ngcutils.dll  10.0.26100.7920  Microsoft Passport Utils Outside OneCore
ninput.dll  10.0.26100.7920  Microsoft Pen and Touch Input Component
nlaapi.dll  10.0.26100.7920  Network Location Awareness 2
nlansp_c.dll  10.0.26100.7309  NLA Namespace Service Provider DLL
nlhtml.dll  2008.0.26100.7309  HTML filter
nlmgp.dll  10.0.26100.7920  Network List Manager Snapin
nlmproxy.dll  10.0.26100.7920  Network List Manager Public Proxy
nlmsprep.dll  10.0.26100.7920  Network List Manager Sysprep Module
nlsbres.dll  10.0.26100.4484  NLSBuild resource DLL
nlsdata0000.dll  10.0.26100.1150  Microsoft Neutral Natural Language Server Data and Code
nlsdata0009.dll  10.0.26100.3912  Microsoft English Natural Language Server Data and Code
nlsdl.dll  10.0.26100.1882  Deprecated Nls Downlevel DLL
nlslexicons0009.dll  10.0.26100.1  Microsoft English Natural Language Server Data and Code
nmadirect.dll  10.0.26100.7309  Nma Direct
noise.dll  10.0.26100.7309  Windows Noise Protocol Implementation
normaliz.dll  10.0.26100.1  Unicode Normalization DLL
notificationcontroller.dll  10.0.26100.7920  NotificationController
notificationcontrollerps.dll  10.0.26100.7920  NotificationController Proxy Stub
notificationintelligenceplatform.dll  10.0.26100.7309  NotificationIntelligencePlatform
notificationplatformcomponent.dll  10.0.26100.7309  NotificationPlatformComponent
npmproxy.dll  10.0.26100.7309  Network List Manager Proxy
npsm.dll  10.0.26100.7309  NPSM
npsmdesktopprovider.dll  10.0.26100.7309  <d> NPSM Desktop Local Provider DLL
nrpsrv.dll  10.0.26100.1  Name Resolution Proxy (NRP) RPC interface
nrtapi.dll  10.0.26100.7920  Name Resolution Tracker API
nshdnsclient.dll  10.0.26100.7920  DNS client netsh DLL
nshhttp.dll  10.0.26100.7920  HTTP netsh DLL
nshipsec.dll  10.0.26100.1150  Net Shell IP Security helper DLL
nshwfp.dll  10.0.26100.7920  Windows Filtering Platform Netsh Helper
nsi.dll  10.0.26100.7920  NSI User-mode interface DLL
nsisvc.dll  10.0.26100.7920  Network Store Interface RPC server
ntasn1.dll  10.0.26100.1882  Microsoft ASN.1 API
ntdll.dll  10.0.26100.7920  NT Layer DLL
ntdsapi.dll  10.0.26100.1  Active Directory Domain Services API
ntfsres.dll  10.0.26100.7920  NT File System Driver Resources
ntlanman.dll  10.0.26100.7920  Microsoft® Lan Manager
ntlanui2.dll  10.0.26100.1  Network object shell UI
ntlmshared.dll  10.0.26100.7705  NTLM Shared Functionality
ntmarta.dll  10.0.26100.7019  Windows NT MARTA provider
ntprint.dll  10.0.26100.7705  Spooler Setup DLL
ntshrui.dll  10.0.26100.7920  Shell extensions for sharing
ntvdm64.dll  10.0.26100.4202  16-bit Emulation on NT64
objsel.dll  10.0.26100.7705  Object Picker Dialog
occache.dll  11.0.26100.5074  Object Control Viewer
ocsetapi.dll  10.0.26100.7920  Windows Optional Component Setup API
odbc32.dll  10.0.26100.7309  ODBC Driver Manager
odbcbcp.dll  10.0.26100.1150  BCP for ODBC
odbcconf.dll  10.0.26100.7824  ODBC Driver Configuration Program
odbccp32.dll  10.0.26100.5074  ODBC Installer
odbccr32.dll  10.0.26100.1  ODBC Cursor Library
odbccu32.dll  10.0.26100.1  ODBC Cursor Library
odbcint.dll  10.0.26100.3037  ODBC Resources
odbctrac.dll  10.0.26100.1  ODBC Driver Manager Trace
oemdefaultassociations.dll  10.0.26100.1301  OEMDefaultAssociations
oemlicense.dll  10.0.26100.4202  Client Licensing Platform Client Provisioning
offfilt.dll  2008.0.26100.7309  OFFICE Filter
officecsp.dll  10.0.26100.5074  Office CSP
offlinelsa.dll  10.0.26100.8036  Windows
offlinesam.dll  10.0.26100.7920  Windows
offreg.dll  10.0.26100.7623  Offline registry DLL
ole32.dll  10.0.26100.7920  Microsoft OLE for Windows
oleacc.dll  7.2.26100.7920  Active Accessibility Core Component
oleacchooks.dll  7.2.26100.7920  Active Accessibility Event Hooks Library
oleaccrc.dll  7.2.26100.4202  Active Accessibility Resource DLL
oleaut32.dll  10.0.26100.7920  OLEAUT32.DLL
oledb32.dll  10.0.26100.5074  OLE DB Core Services
oledb32.dll  10.0.26100.5074  OLE DB Core Services
oledb32r.dll  10.0.26100.1  OLE DB Core Services Resources
oledb32r.dll  10.0.26100.1  OLE DB Core Services Resources
oledlg.dll  10.0.26100.7309  OLE User Interface Support
oleprn.dll  10.0.26100.7309  Oleprn DLL
omadmagent.dll  10.0.26100.7309  omadmagent
omadmapi.dll  10.0.26100.7920  omadmapi
ondemandbrokerclient.dll  10.0.26100.5074  OnDemandBrokerClient
ondemandconnroutehelper.dll  10.0.26100.7920  On Demand Connctiond Route Helper
onebackuphandler.dll  10.0.26100.7920  Backup & Restore Handlers Implementation
onecorecommonproxystub.dll  10.0.26100.7920  OneCore Common Proxy Stub
onecoreuapcommonproxystub.dll  10.0.26100.7920  OneCoreUAP Common Proxy Stub
onesettingsclient.dll  10.0.26100.7309  Microsoft OneSettings Client
onex.dll  10.0.26100.7920  IEEE 802.1X supplicant library
onexui.dll  10.0.26100.7309  IEEE 802.1X supplicant UI library
onnxruntime.dll  1.17.2504.1701  ONNX Runtime
oobewv2host.dll  10.0.26100.7920  OOBE WebView2 Host
opcservices.dll  10.0.26100.7309  Native Code OPC Services Library
opencl.dll  3.0.6.0  OpenCL Client DLL
opengl32.dll  10.0.26100.7920  OpenGL Client DLL
osbaseln.dll  10.0.26100.1  Service Reporting API
osksupport.dll  10.0.26100.1  Microsoft On-Screen Keyboard Support Utilities
osuninst.dll  10.0.26100.1  Uninstall Interface
p9np.dll  10.0.26100.7309  Plan 9 Network Provider
p9rdrservice.dll  10.0.26100.7824  Plan9 Redirector Service DLL
packager.dll  10.0.26100.7309  Object Packager2
packagestatechangehandler.dll  10.0.26100.7920  Package State Change Handler
panmap.dll  10.0.26100.1150  PANOSE(tm) Font Mapper
passwordenrollmentmanager.dll  10.0.26100.7824  In-Proc WinRT server for PasswordEnrollmentManager
pautoenr.dll  10.0.26100.1150  Auto Enrollment DLL
payloadrestrictions.dll  10.0.26100.1150  Payload Restrictions Mitigation Provider
paymentmediatorserviceproxy.dll  10.0.26100.1150  Payment Mediator Service Proxy
pcacli.dll  10.0.26100.7920  Program Compatibility Assistant Client Module
pcadm.dll  10.0.26100.7920  Program Compatibility Assistant Diagnostic Module
pcaevts.dll  10.0.26100.7920  Program Compatibility Assistant Event Resources
pcasvc.dll  10.0.26100.7920  Program Compatibility Assistant Service
pcaui.dll  10.0.26100.7920  Program Compatibility Assistant User Interface Module
pcpksp.dll  10.0.26100.7920  Microsoft Platform Key Storage Provider for Platform Crypto Provider
pcrpf.dll  10.0.26100.7920  PCRPF
pcshellcommonproxystub.dll  10.0.26100.5074  PCShell Common Proxy Stub
pcsvdevice.dll  10.0.26100.1882  PCSV Proxy Provider for devices
pcwum.dll  10.0.26100.1  Performance Counters for Windows Native DLL
pcwutl.dll  10.0.26100.7920  Program Compatibility Troubleshooter Helper
pdh.dll  10.0.26100.7309  Windows Performance Data Helper DLL
pdhui.dll  10.0.26100.7309  PDH UI
penservice.dll  10.0.26100.7920  Pen Service
peopleapis.dll  10.0.26100.7019  DLL for PeopleRT
peopleband.dll  10.0.26100.7824  People Desktop Band
perceptionsimulation.proxystubs.dll  10.0.26100.1  Windows Perception Simulation Proxy Stubs
perceptionsimulationmanager.dll  10.0.26100.7309  Windows Perception Simulation Manager
perfdisk.dll  10.0.26100.7705  Windows Disk Performance Objects DLL
perfnet.dll  10.0.26100.7705  Windows Network Service Performance Objects DLL
performancetracehandler.dll  10.0.26100.7920  PerformanceTraceHandler task
perfos.dll  10.0.26100.7705  Windows System Performance Objects DLL
perfproc.dll  10.0.26100.7705  Windows System Process Performance Objects DLL
perfts.dll  10.0.26100.1882  Windows Remote Desktop Services Performance Objects
personalizationcsp.dll  10.0.26100.7309  PersonalizationCSP
pfclient.dll  10.0.26100.4202  SysMain Client
phonecallhistoryapis.dll  10.0.26100.7309  DLL for PhoneCallHistoryRT
phoneom.dll  10.0.26100.7920  Phone Object Model
phoneplatformabstraction.dll  10.0.26100.7309  Phone Platform Abstraction
phoneproviders.dll  10.0.26100.7920  Phone-specific Component Provider for Windows Telephony Stack.
phoneservice.dll  10.0.26100.7920  The service used to manage phone calls and other telephony related functionality
phoneserviceres.dll  10.0.26100.1  Resource DLL for the Phone Service
phoneutil.dll  10.0.26100.7309  Phone utilities
phoneutilres.dll  10.0.26100.1  Resource DLL for Phone utilities
photometadatahandler.dll  10.0.26100.7309  Photo Metadata Handler
photowiz.dll  10.0.26100.5074  Photo Printing Wizard
pickerplatform.dll  10.0.26100.7309  PickerPlatform
pid.dll  10.0.26100.1591  Microsoft PID
pidgenx.dll  10.0.26100.7309  Pid Generation
pifmgr.dll  10.0.26100.1  Windows NT PIF Manager Icon Resources Library
pimindexmaintenance.dll  10.0.26100.7920  Service responsible for contacts indexing and other user data related tasks
pimindexmaintenanceclient.dll  10.0.26100.7920  Client dll for Pim Index Maintenance
pimstore.dll  10.0.26100.7309  POOM
pinenrollmenthelper.dll  10.0.26100.7920  PinEnrollmentHelper
pkeyhelper.dll  10.0.26100.7920  Product Key Helper
pktmonapi.dll  10.0.26100.7309  Pktmon API library
pku2u.dll  10.0.26100.7309  Pku2u Security Package
pla.dll  10.0.26100.7309  Performance Logs & Alerts
playlistfolder.dll  10.0.26100.7920  Playlist Folder
playsndsrv.dll  10.0.26100.7309  PlaySound Service
playtodevice.dll  10.0.26100.7705  PLAYTODEVICE DLL
playtomanager.dll  10.0.26100.7309  Microsoft Windows PlayTo Manager
playtomenu.dll  12.0.26100.7309  Cast to Device Menu DLL
playtoreceiver.dll  10.0.26100.7309  DLNA DMR DLL
playtostatusprovider.dll  10.0.26100.5074  PlayTo Status Provider Dll
ploptin.dll  10.0.26100.5074  Prelaunch OptIn
plutonapi.dll    
plutonfw_authenticamd.dll    
plutonfw_genuineintel.dll    
plutonfw_hspv2_authenticamd.dll    
plutontasks.dll  10.0.26100.7705  Pluton Tasks
pngfilt.dll  11.0.26100.5074  IE PNG plugin image decoder
pnpclean.dll  10.0.26100.1150  Plug and Play Maintenance Task Library
pnpdiag.dll  10.0.26100.7920  PnP Diagnostic API
pnppolicy.dll  10.0.26100.7920  pnppolicy Task
pnpts.dll  10.0.26100.1  PlugPlay Troubleshooter
pnpui.dll  5.2.3668.0  Plug and Play User Interface DLL
pnpxassoc.dll  10.0.26100.7309  PNPX Association Dll
pnpxassocprx.dll  10.0.26100.1  PNPX Association Dll
policymanager.dll  10.0.26100.7920  Policy Manager DLL
policymanagerprecheck.dll  10.0.26100.7920  policymanagerprecheck
polstore.dll  10.0.26100.1  Policy Storage dll
popkeycli.dll  10.0.26100.7309  Pop Key Client DLL
portabledeviceapi.dll  10.0.26100.7920  Windows Portable Device API Components
portabledeviceclassextension.dll  10.0.26100.5074  Windows Portable Device Class Extension Component
portabledeviceconnectapi.dll  10.0.26100.5074  Portable Device Connection API Components
portabledevicestatus.dll  10.0.26100.5074  Microsoft Windows Portable Device Status Provider
portabledevicesyncprovider.dll  10.0.26100.7705  Microsoft Windows Portable Device Provider.
portabledevicetypes.dll  10.0.26100.5074  Windows Portable Device (Parameter) Types Component
portabledevicewiacompat.dll  10.0.26100.7705  PortableDevice WIA Compatibility Driver
posetup.dll  10.0.26100.1150  Power Setup
posyncservices.dll  10.0.26100.1882  Change Tracking
pots.dll  10.0.26100.1  Power Troubleshooter
powercpl.dll  10.0.26100.7309  Power Options Control Panel
powergridforecasttask.dll  10.0.26100.7309  PowerGridForecastTask Task
powrprof.dll  10.0.26100.3912  Power Profile Helper DLL
prauthproviders.dll  10.0.26100.7309  prauthproviders
presentationhostproxy.dll  10.0.26100.5074  Windows Presentation Foundation Host Proxy
prflbmsg.dll  10.0.26100.4202  Perflib Event Messages
print.printsupport.source.dll  10.0.26100.7920  Microsoft Windows Print Support
print.workflow.source.dll  10.0.26100.7309  Microsoft Windows Print Workflow Source App Library
printdeviceconfigurationservice.dll  10.0.26100.7920  PrintDeviceConfigurationService dll
printerassociationcommon.dll  10.0.26100.7920  PrinterAssociationCommon dll
printerassociationcommonproxy.dll  10.0.26100.7920  PrinterAssociationCommon COM Proxy dll
printercleanuptask.dll  10.0.26100.7623  Windows Printer Cleanup Task
printerservicesadapter.dll    
printfilterpipelineprxy.dll  10.0.26100.7920  Print Filter Pipeline Proxy
printisolationproxy.dll  10.0.26100.7920  Print Sandbox COM Proxy Stub
printnotification.dll    
printplatformconfig.dll  10.0.26100.7309  Legacy Print Platform Adapter
printrenderapihost.dll  10.0.26100.7920  PDF Writer
printscanbrokerservice.dll  10.0.26100.7920  Microsoft Windows PrintScan Broker Service Internal
printticketvalidation.dll  10.0.26100.7309  PrintTicketValidation dll
printui.dll  10.0.26100.7920  Printer Settings User Interface
printworkflowservice.dll  10.0.26100.7920  Microsoft Windows Print Workflow Service Internal
printwsdahost.dll  10.0.26100.7309  PrintWSDAHost
prm0009.dll  10.0.26100.1  Microsoft English Natural Language Data and Code
prncache.dll  10.0.26100.5074  Print UI Cache
prnfldr.dll  10.0.26100.7019  prnfldr dll
prnntfy.dll  10.0.26100.7920  prnntfy DLL
prntvpt.dll  10.0.26100.7920  Print Ticket Services Module
productenumerator.dll  10.0.26100.7019  Product Enumerator
profapi.dll  10.0.26100.7309  User Profile Basic API
profext.dll  10.0.26100.7920  profext
profprov.dll  10.0.26100.7309  User Profile WMI Provider
profsvc.dll  10.0.26100.7920  ProfSvc
profsvcext.dll  10.0.26100.7920  ProfSvcExt
propsys.dll  7.0.26100.7920  Microsoft Property System
provcore.dll  10.0.26100.7920  Microsoft Wireless Provisioning Core
provdatastore.dll  10.0.26100.7309  Provisioning Engine Datastore Library
provdiagnostics.dll  10.0.26100.4202  ETW for Provisioning Diagnostics
provengine.dll  10.0.26100.7309  Provisioning Engine Library
provhandlers.dll  10.0.26100.7309  Provisioning Engine Handlers Library
provisioningcommandscsp.dll  10.0.26100.7309  Provisioning package command configuration service provider
provisioningcsp.dll  10.0.26100.7309  Provisioning package configuration service provider
provisioninghandlers.dll  10.0.26100.7920  Provisioning Handlers Implementation
provmigrate.dll  10.0.26100.7309  Provisioning Migration Handler
provops.dll  10.0.26100.7920  Provision Operations Library
provpackageapidll.dll  10.0.26100.7309  Provisioning package API DLL for STL encapsulation
provplatformdesktop.dll  10.0.26100.7920  Provisioning platform for desktop editions
provplugineng.dll  10.0.26100.7309  Provisioning plugin engine dll
provsysprep.dll  10.0.26100.7309  Sysprep provider for Provisioning
provthrd.dll  10.0.26100.1882  WMI Provider Thread & Log Library
proximitycommon.dll  10.0.26100.1150  Proximity Common Implementation
proximitycommonpal.dll  10.0.26100.1150  Proximity Common PAL
proximityrtapipal.dll  10.0.26100.7309  Proximity WinRT API PAL
proximityservice.dll  10.0.26100.7920  Proximity Service Implementation
proximityservicepal.dll  10.0.26100.7920  Proximity Service PAL
prvdmofcomp.dll  10.0.26100.3323  WMI
prxyqry.dll  10.0.26100.7920  ProxyQuery
psapi.dll  10.0.26100.1  Process Status Helper
pshed.dll  10.0.26100.1150  Platform Specific Hardware Error Driver
psisdecd.dll  10.0.26100.3912  Microsoft SI/PSI parser for MPEG2 based networks.
psmodulediscoveryprovider.dll  10.0.26100.1150  WMI
psmserviceexthost.dll  10.0.26100.7920  Resource Manager PSM Service Extension
psmsrv.dll  10.0.26100.7920  Process State Manager (PSM) Service
pstask.dll  10.0.26100.1  pstask Task
pstorec.dll  10.0.26100.1  Deprecated Protected Storage COM interfaces
ptpprov.dll  10.0.26100.7309  PTP Time Provider
puiapi.dll  10.0.26100.7309  puiapi DLL
puiobj.dll  10.0.26100.5074  PrintUI Objects DLL
pushtoinstall.dll  10.0.26100.7920  PushToInstall
pwlauncher.dll  10.0.26100.5074  Windows To Go Launcher
pwrshplugin.dll  10.0.26100.1591  pwrshplugin.dll
pwrshsip.dll  10.0.26100.1  Crypto SIP provider for signing and verifying PowerShell script files (.ps1/.ps1xml)
pwsso.dll  10.0.26100.1882  Windows To Go Shell Service Object
qasf.dll  12.0.26100.1  DirectShow ASF Support
qcap.dll  10.0.26100.5074  DirectShow Runtime.
qdv.dll  10.0.26100.5074  DirectShow Runtime.
qdvd.dll  10.0.26100.7309  DirectShow DVD PlayBack Runtime.
qedit.dll  10.0.26100.7309  DirectShow Editing.
qedwipes.dll  10.0.26100.1  DirectShow Editing SMPTE Wipes
qmgr.dll  7.8.26100.7309  Background Intelligent Transfer Service
quartz.dll  10.0.26100.7309  DirectShow Runtime.
query.dll  10.0.26100.7920  Content Index Utility DLL
quickactionsdatamodel.dll  10.0.26100.7824  QuickActionsDataModel
quiethours.dll  10.0.26100.7920  QuietHours
qwave.dll  10.0.26100.7920  Windows NT
racengn.dll  10.0.26100.1150  Reliability analysis metrics calculation engine
racpldlg.dll  10.0.26100.7623  Remote Assistance Contact List
radardt.dll  10.0.26100.1150  Microsoft Windows Resource Exhaustion Detector
radarrs.dll  10.0.26100.1882  Microsoft Windows Resource Exhaustion Resolver
radcui.dll  10.0.26100.7309  RemoteApp and Desktop Connection UI Component
randomaccessstreamdatasource.dll  10.0.26100.7920  RandomAccessStream Data Source Library
rasadhlp.dll  10.0.26100.7920  Remote Access AutoDial Helper
rasapi32.dll  10.0.26100.7920  Remote Access API
rasauto.dll  10.0.26100.7920  Remote Access AutoDial Manager
raschap.dll  10.0.26100.7920  Remote Access PPP CHAP
raschapext.dll  10.0.26100.7920  Windows Extension library for raschap
rasctrs.dll  10.0.26100.8036  Windows NT Remote Access Perfmon Counter dll
rascustom.dll  10.0.26100.7920  Custom Protocol Engine
rasdiag.dll  10.0.26100.8036  RAS Diagnostics Helper Classes
rasdlg.dll  10.0.26100.7920  Remote Access Common Dialog API
rasgcw.dll  10.0.26100.7920  RAS Wizard Pages
rasman.dll  10.0.26100.7920  Remote Access Connection Manager
rasmans.dll  10.0.26100.7920  Remote Access Connection Manager
rasmbmgr.dll  10.0.26100.1  Provides support for the switching of mobility enabled VPN connections if their underlying interface goes down.
rasmediamanager.dll  10.0.26100.7920  Windows Ras Media Manager DLL
rasmontr.dll  10.0.26100.7705  RAS Monitor DLL
rasplap.dll  10.0.26100.7920  RAS PLAP Credential Provider
rasppp.dll  10.0.26100.7920  Remote Access PPP
rastapi.dll  10.0.26100.7920  Remote Access TAPI Compliance Layer
rastls.dll  10.0.26100.7920  Remote Access PPP EAP-TLS
rastlsext.dll  10.0.26100.7920  Windows Extension library for rastls
rdbui.dll  10.0.26100.7309  ReadyBoost UI
rdpavenc.dll  10.0.26100.7920  Rdp Advanced Video Encoders
rdpbase.dll  10.0.26100.7920  Rdp OneCore Base Services
rdpcfgex.dll  10.0.26100.1  Remote Desktop Session Host Server Connection Configuration Extension for the RDP protocol
rdpcorets.dll  10.0.26100.7920  TS RDPCore DLL
rdpcredentialprovider.dll  10.0.26100.7309  "RdpCredentialProvider.DYNLINK"
rdpendp.dll  10.0.26100.7309  RDP Audio Endpoint
rdplite.dll  10.0.26100.7920  Rdp Light Stack
rdpnanotransport.dll  3.2503.11002.0  
rdprelaytransport.dll  10.0.26100.1150  RdpRelayTransport DLL
rdpsaps.dll  10.0.26100.7705  RDP Session Agent Proxy Stub
rdpserverbase.dll  10.0.26100.7920  Rdp Server OneCore Base Services
rdpsharercom.dll  10.0.26100.7920  RDPSRAPI Sharer COM Objects
rdpviewerax.dll  10.0.26100.7019  RDPSRAPI Viewer COM Objects and ActiveX
rdsappxhelper.dll  10.0.26100.7309  Remote Desktop AppX Scheduler Helper DLL
rdsdwmdr.dll  10.0.26100.7920  Microsoft Remote Desktop Services Desktop Composition Component
rdvvmtransport.dll  10.0.26100.7920  RdvVmTransport EndPoints
rdxservice.dll  10.0.26100.8036  RDXService
rdxtaskfactory.dll  10.0.26100.8036  RDXTaskFactory
reagent.dll  10.0.26100.7920  Microsoft Windows Recovery Agent DLL
reagenttask.dll  10.0.26100.3037  Microsoft Windows Recovery Agent Task Handler
recovery.dll  10.0.26100.7309  Recovery Control Panel
refsdedupsvc.proxy.dll  10.0.26100.2605  "RefsDedupSvc.Proxy.dll"
regapi.dll  10.0.26100.1150  Registry Configuration APIs
regctrl.dll  10.0.26100.5074  RegCtrl
regidle.dll  10.0.26100.4202  RegIdle Backup Task
regsvc.dll  10.0.26100.7019  Remote Registry Service
reguwpapi.dll  10.0.26100.4484  UWP Registry API
reinfo.dll  10.0.26100.7920  Microsoft Windows Recovery Info DLL
remoteaudioendpoint.dll  10.0.26100.8036  Remote Audio Endpoint
remotepg.dll  10.0.26100.1882  Remote Sessions CPL Extension
remoteremediationcsp.dll  10.0.26100.7309  RemoteRemediationCSP
remotewipecsp.dll  10.0.26100.7309  RemoteWipeCSP
removablemediaprovisioningplugin.dll  10.0.26100.7309  Removable Media Provisioning Plugin
removedevicecontexthandler.dll  10.0.26100.7309  Devices & Printers Remove Device Context Menu Handler
removedeviceelevated.dll  10.0.26100.1  RemoveDeviceElevated Proxy Dll
reportingcsp.dll  10.0.26100.7309  ReportingCSP
resampledmo.dll  10.0.26100.7019  Windows Media Resampler
resbparser.dll  10.0.26100.3037  Provide information to identify string resources
resetengine.dll  10.0.26100.7920  Push-Button Reset Engine
resetengonline.dll  10.0.26100.7920  Reset Engine Online
resourcemapper.dll  10.0.26100.7309  Provide information to identify string resources
resourcepolicyclient.dll  10.0.26100.7309  Resource Policy Client
resourcepolicyserver.dll  10.0.26100.7920  Resource Policy RM Service Extension
resutils.dll  10.0.26100.7920  Microsoft Cluster Resource Utility DLL
rgb9rast.dll  10.0.26100.1882  Microsoft® Windows® Operating System
riched20.dll  5.31.23.1231  Rich Text Edit Control, v3.1
riched32.dll  10.0.26100.1  Wrapper Dll for Richedit 1.0
rjvmdmconfig.dll  10.0.26100.7920  Windows System Reset Platform Plugin for MDM Agent
rmapi.dll  10.0.26100.7920  Radio Manager API
rmclient.dll  10.0.26100.7309  Resource Manager Client
rmsroamingsecurity.dll  10.0.26100.7309  Roaming Security RMS implementation
rnr20.dll  10.0.26100.1  Windows Socket2 NameSpace DLL
roamingsecurity.dll  10.0.26100.5074  Roaming Security implementation
rometadata.dll  4.8.9221.0  Microsoft MetaData Library
rotmgr.dll  10.0.26100.5074  Auto-Rotation Manager
rpcepmap.dll  10.0.26100.7019  RPC Endpoint Mapper
rpchttp.dll  10.0.26100.1  RPC HTTP DLL
rpcns4.dll  10.0.26100.1  Remote Procedure Call Name Service Client
rpcnsh.dll  10.0.26100.7705  RPC Netshell Helper
rpcrt4.dll  10.0.26100.8036  Remote Procedure Call Runtime
rpcrtremote.dll  10.0.26100.7705  Remote RPC Extension
rpcss.dll  10.0.26100.7920  Distributed COM Services
rsaenh.dll  10.0.26100.7705  Microsoft Enhanced Cryptographic Provider
rshx32.dll  10.0.26100.7705  Security Shell Extension
rstrtmgr.dll  10.0.26100.7309  Restart Manager
rtffilt.dll  2008.0.26100.7309  RTF Filter
rtm.dll  10.0.26100.7920  Routing Table Manager
rtmediaframe.dll  10.0.26100.7920  Windows Runtime MediaFrame DLL
rtutils.dll  10.0.26100.3037  Routing Utilities
rtworkq.dll  10.0.26100.7309  Realtime WorkQueue DLL
rulebasedds.dll  10.0.26100.7309  "RuleBasedDS.DYNLINK"
samcli.dll  10.0.26100.7920  Security Accounts Manager Client DLL
samlib.dll  10.0.26100.7920  SAM Library DLL
samsrv.dll  10.0.26100.7920  SAM Server DLL
sas.dll  10.0.26100.3323  WinLogon Software SAS Library
sbe.dll  10.0.26100.5074  DirectShow Stream Buffer Filter.
sbeio.dll  12.0.26100.7920  Stream Buffer IO DLL
sberes.dll  10.0.26100.1  DirectShow Stream Buffer Filter Resouces.
sbservicetrigger.dll  10.0.26100.3037  Socket Broker Service Trigger
scansetting.dll  10.0.26100.1150  Microsoft® Windows(TM) ScanSettings Profile and Scanning implementation
scardbi.dll  10.0.26100.7309  SmartCard Background Infrastructure Library
scarddlg.dll  10.0.26100.8037  SCardDlg - Smart Card Common Dialog
scardsvr.dll  10.0.26100.7705  Smart Card Resource Management Server
scavengeui.dll  10.0.26100.6725  Update Package Cleanup
scdeviceenum.dll  10.0.26100.8037  Smart Card Device Enumeration Service
scecli.dll  10.0.26100.7309  Windows Security Configuration Editor Client Engine
scesrv.dll  10.0.26100.7920  Windows Security Configuration Editor Engine
schannel.dll  10.0.26100.7920  TLS / SSL Security Provider
schedcli.dll  10.0.26100.1150  Scheduler Service Client DLL
schedsvc.dll  10.0.26100.7309  Task Scheduler Service
scksp.dll  10.0.26100.8037  Microsoft Smart Card Key Storage Provider
scripto.dll  6.6.26100.1150  Microsoft ScriptO
scrobj.dll  10.0.26100.7920  Windows ® Script Component Runtime
scrrun.dll  10.0.26100.7920  Microsoft ® Script Runtime
sdcpl.dll  10.0.26100.7309  Backup and Restore (Windows 7) Control Panel
sdds.dll  10.0.26100.7309  "SDDS.DYNLINK"
sdengin2.dll  10.0.26100.7309  Microsoft® Windows Backup Engine
sdfhost.dll  10.0.26100.7623  SDFHOST.DLL
sdhcinst.dll  10.0.26100.1  Secure Digital Host Controller Class Installer
sdiageng.dll  10.0.26100.7309  Scripted Diagnostics Execution Engine
sdiagprv.dll  10.0.26100.1150  Windows Scripted Diagnostic Provider API
sdiagschd.dll  10.0.26100.7309  Scripted Diagnostics Scheduled Task
sdohlp.dll  10.0.26100.5074  NPS SDO Helper Component
sdrsvc.dll  10.0.26100.7309  Microsoft® Windows Backup Service
sdshext.dll  10.0.26100.5074  Microsoft® Windows Backup Shell Extension
search.protocolhandler.mapi2.dll  7.0.26100.7920  Microsoft Search Protocol Handler for MAPI2
searchfolder.dll  10.0.26100.7920  SearchFolder
searchindexercore.dll  10.0.26100.7920  Search Indexer Core
sebbackgroundmanagerpolicy.dll  10.0.26100.7309  <d> SEB Background Manager Policy DLL
sechost.dll  10.0.26100.7920  Host for SCM/SDDL/LSA Lookup APIs
seclogon.dll  10.0.26100.7920  Secondary Logon Service DLL
secproc.dll  10.0.26100.5074  Windows Rights Management Desktop Security Processor
secproc_isv.dll  10.0.26100.5074  Windows Rights Management Desktop Security Processor
secproc_ssp.dll  10.0.26100.4202  Windows Rights Management Services Server Security Processor
secproc_ssp_isv.dll  10.0.26100.4202  Windows Rights Management Services Server Security Processor (Pre-production)
secur32.dll  10.0.26100.7705  Security Support Provider Interface
securetimeaggregator.dll  10.0.26100.7309  Secure Time Aggregator
security.dll  10.0.26100.1  Security Support Provider Interface
securitycenterbroker.dll  10.0.26100.7309  Security Center Broker
securitycenterbrokerps.dll  10.0.26100.2454  SecurityCenterBrokerPS
securityhealthagent.dll  10.0.26100.7309  Windows Security Health Agent
securityhealthcore.dll  10.0.26100.7824  Windows Security Health Core
securityhealthproxystub.dll  10.0.26100.1882  Windows Defender Security Health Proxy Stub
securityhealthsso.dll  10.0.26100.7309  Security Health SSO
securityhealthssoudk.dll  10.0.26100.7920  Windows Security Health SSO UDK
securityhealthudk.dll  10.0.26100.7920  Windows Security Health UDK
semgrps.dll  10.0.26100.3323  SEMgrSvc Proxy
semgrsvc.dll  10.0.26100.7920  NFC SEManagement Service DLL
sendmail.dll  10.0.26100.7920  Send Mail
sens.dll  10.0.26100.5074  System Event Notification Service (SENS)
sensapi.dll  10.0.26100.1  SENS Connectivity API DLL
sensorperformanceevents.dll  10.0.26100.1  Sensors Performance Events
sensorsapi.dll  10.0.26100.7920  Sensor API
sensorsclassextension.dll  10.0.26100.7309  Sensor Driver Class Extension component
sensorscpl.dll  10.0.26100.1  Open Location and Other Sensors
sensorservice.dll  10.0.26100.7920  Sensor Service
sensorsnativeapi.dll  10.0.26100.7309  Sensors Native API
sensorsnativeapi.v2.dll  10.0.26100.7920  Sensors Native API (V2 stack)
sensorsutilsv2.dll  10.0.26100.7920  Sensors v2 Utilities DLL
sensrsvc.dll  10.0.26100.7309  Microsoft Windows Sensor Monitoring Service
serialui.dll  10.0.26100.1150  Serial Port Property Pages
servicingcommon.dll  10.0.26100.7920  Servicing Base DLL
servicinguapi.dll  10.0.26100.7920  Servicing Unified API
serwvdrv.dll  10.0.26100.1882  Unimodem Serial Wave driver
sessenv.dll  10.0.26100.7920  Remote Desktop Configuration service
setbcdlocale.dll  10.0.26100.1  MUI Callback for Bcd
setnetworklocation.dll  10.0.26100.7309  Set Network Location Utility
settingsconfigtask.dll  10.0.26100.7920  SettingsConfigTask Task
settingsenvironment.desktop.dll  10.0.26100.8036  System Settings Environment for Desktop
settingsextensibilityhandlers.dll  10.0.26100.7920  System Settings SettingsExtensibility Handler Implementation
settingshandlers_a9.dll  10.0.26100.7920  Settings Handler DLL for A9
settingshandlers_accessibility.dll  10.0.26100.7920  System Settings Accessibility Handlers Implementation
settingshandlers_advertisingid.dll  10.0.26100.7920  System Settings Advertising Id Handler
settingshandlers_appcontrol.dll  10.0.26100.7920  System Settings App Control Handlers Implementation
settingshandlers_appexecutionalias.dll  10.0.26100.7920  System Settings AppExecutionAlias Handlers Implementation
settingshandlers_authentication.dll  10.0.26100.7920  System Settings Authentication Handlers Implementation
settingshandlers_backgroundapps.dll  10.0.26100.7920  System Settings Background Apps Handlers Implementation
settingshandlers_backup.dll  10.0.26100.7920  Settings Handler DLL for Backup
settingshandlers_batteryusage.dll  10.0.26100.7920  Battery Usage Settings Handlers Implementation
settingshandlers_camera.dll  10.0.26100.7920  System Settings Camera Handlers Implementation
settingshandlers_capabilityaccess.dll  10.0.26100.7920  System Settings Capability Access Handlers Implementation
settingshandlers_clipboard.dll  10.0.26100.7920  Clipboard Settings Handlers
settingshandlers_closedcaptioning.dll  10.0.26100.7920  System Settings Closed Captioning Handlers Implementation
settingshandlers_cloudpc.dll  10.0.26100.7920  Settings Handler DLL for Desktop CloudPC
settingshandlers_contentdeliverymanager.dll  10.0.26100.7920  System Settings Handlers Implementation for Content Delivery Manager
settingshandlers_copilot.dll  10.0.26100.7920  System Settings Copilot Handlers Implementation
settingshandlers_cortana.dll  10.0.26100.7920  System Settings Search Handlers Implementation
settingshandlers_desktopdisplay.dll  10.0.26100.7920  Settings Handler DLL for Desktop Display
settingshandlers_desktoptaskbar.dll  10.0.26100.7920  Settings Handler DLL for Desktop Taskbar
settingshandlers_devices.dll  10.0.26100.7920  Devices settings page handler
settingshandlers_display.dll  10.0.26100.7920  System Settings Handlers Implementation for Display Page
settingshandlers_flights.dll  10.0.26100.7920  System Settings Flight Handlers Implementation
settingshandlers_fonts.dll  10.0.26100.7920  System Settings Fonts Handlers Implementation
settingshandlers_forcesync.dll  10.0.26100.7920  System Settings Sync Time Handler Implementation
settingshandlers_gaming.dll  10.0.26100.7920  System Settings Handlers Implementation for Desktop Gaming Page
settingshandlers_geolocation.dll  10.0.26100.7920  System Settings Geolocation Handlers Implementation
settingshandlers_gpu.dll  10.0.26100.7920  System Settings Gpu Handlers Implementation
settingshandlers_humanpresence.dll  10.0.26100.7920  Settings Handler DLL for Human Presence
settingshandlers_ime.dll  10.0.26100.7920  System Settings IME Handlers Implementation
settingshandlers_inkingtypingprivacy.dll  10.0.26100.7920  System Settings Inking and Typing Privacy Handlers Implementation
settingshandlers_inputpersonalization.dll  10.0.26100.7920  System Settings Input Personalization
settingshandlers_installedupdates.dll  10.0.26100.7920  System Settings Installed Updates Handlers Implementation
settingshandlers_keyboard.dll  10.0.26100.7920  System Settings Keyboard Handlers Implementation
settingshandlers_language.dll  10.0.26100.7920  System Settings Language Handlers Implementation
settingshandlers_lighting.dll  10.0.26100.7920  System Settings Lighting Handlers Implementation
settingshandlers_managephone.dll  10.0.26100.7920  Phone settings page handler
settingshandlers_maps.dll  10.0.26100.7920  System Settings Maps Handlers Implementation
settingshandlers_mouse.dll  10.0.26100.7920  System Settings Mouse Handlers Implementation
settingshandlers_notifications.dll  10.0.26100.7920  System Settings Notifications Handlers Implementation
settingshandlers_nt.dll  10.0.26100.8036  System Settings Handlers Implementation
settingshandlers_onecore_batterysaver.dll  10.0.26100.7920  System Settings Battery Saver One Core Handlers Implementation
settingshandlers_onecore_powerandsleep.dll  10.0.26100.7920  System Settings Power and Sleep One Core Handlers Implementation
settingshandlers_onedrivebackup.dll  10.0.26100.7920  System Settings One Drive Backup Handlers Implementation
settingshandlers_optionalfeatures.dll  10.0.26100.7920  System Settings Optional Features Handlers Implementation
settingshandlers_pcdisplay.dll  10.0.26100.7920  System Settings Handlers Implementation for Desktop Display Page
settingshandlers_pcdisplayremote.dll  10.0.26100.7920  System Settings Handlers Implementation for Remote Desktop Display Page
settingshandlers_pen.dll  10.0.26100.7920  System Settings Pen Handlers Implementation
settingshandlers_recovery.dll  10.0.26100.7920  System Settings Recovery Handlers Implemmentation
settingshandlers_region.dll  10.0.26100.7920  System Settings Region Handlers Implementation
settingshandlers_resume.dll  10.0.26100.7920  Settings Handler DLL for Desktop Resume
settingshandlers_sharedexperiences_rome.dll  10.0.26100.7920  System Settings Shared Experiences Handlers Implementation
settingshandlers_siuf.dll  10.0.26100.7920  System Settings System Initiated User Feedback Handlers Implementation
settingshandlers_smartactions.dll  10.0.26100.7920  Settings Handler DLL for SmartActions
settingshandlers_speechprivacy.dll  10.0.26100.7920  System Settings Speech Privacy Handlers Implementation
settingshandlers_startup.dll  10.0.26100.7920  System Settings Startup Handlers Implementation
settingshandlers_storage.dll  10.0.26100.7920  System Settings Storage Handler Implementation
settingshandlers_storagesense.dll  10.0.26100.7920  System Settings Storage Handler Implementation
settingshandlers_touch.dll  10.0.26100.7920  System Settings Touch Handlers Implementation
settingshandlers_troubleshoot.dll  10.0.26100.7920  Troubleshoot Handlers Implementation
settingshandlers_user.dll  10.0.26100.7920  System Settings Handlers Implementation for Desktop Users Page
settingshandlers_useraccount.dll  10.0.26100.7920  System Settings User Account Handlers Implementation
settingshandlers_userexperience.dll  10.0.26100.7920  System Settings UserExperience Info Handlers Implementation
settingshandlers_userintent.dll  10.0.26100.7920  System Settings Handlers Implementation for Desktop User Intent
settingshandlers_workaccess.dll  10.0.26100.7920  System Settings Work Access Handlers Implementation
settingsyncdownloadhelper.dll  10.0.26100.7309  SettingSyncDownloadHelper
setupapi.dll  10.0.26100.7920  Windows Setup API
setupcl.dll  10.0.26100.4484  System Clone Library
setupcln.dll  10.0.26100.4768  Setup Files Cleanup
setupetw.dll  10.0.26100.4202  Setup ETW Event Resources
sfape.dll  10.0.26100.7623  SFAP
sfapm.dll  10.0.26100.7623  SFAP
sfc.dll  10.0.26100.1  Windows File Protection
sfc_os.dll  10.0.26100.1  Windows File Protection
sfsenclave.dll    
shacct.dll  10.0.26100.4484  Shell Accounts Classes
shacctprofile.dll  10.0.26100.7309  Shell Accounts Profile Classes
sharedpccsp.dll  10.0.26100.7824  SharedPCCSP
sharehost.dll  10.0.26100.7920  ShareHost
sharemediacpl.dll  10.0.26100.7309  Share Media Control Panel
sharetargets.dll    
shcore.dll  10.0.26100.7920  SHCORE
shdocvw.dll  10.0.26100.7920  Shell Doc Object and Control Library
shell32.dll  10.0.26100.7920  Windows Shell Common Dll
shellcommoncommonproxystub.dll  10.0.26100.7920  ShellCommon Common Proxy Stub
shellconfigtask.dll  10.0.26100.7920  ShellConfigTask Task
shellstyle.dll  10.0.26100.1  Windows Shell Style Resource Dll
shfolder.dll  10.0.26100.1  Shell Folder Service
shgina.dll  10.0.26100.1  Windows Shell User Logon
shimeng.dll  10.0.26100.5074  Shim Engine DLL
shimgvw.dll  10.0.26100.7309  Photo Gallery Viewer
shlwapi.dll  10.0.26100.7920  Shell Light-weight Utility Library
shpafact.dll  10.0.26100.1  Windows Shell LUA/PA Elevation Factory Dll
shsetup.dll  10.0.26100.7309  Shell setup helper
shsvcs.dll  10.0.26100.7309  Windows Shell Services Dll
shunimpl.dll  10.0.26100.5074  Windows Shell Obsolete APIs
shutdownext.dll  10.0.26100.1150  Shutdown Graphic User Interface
shutdownux.dll  10.0.26100.7920  Shutdown UX
shwebsvc.dll  10.0.26100.7309  Windows Shell Web Services
signdrv.dll  10.0.26100.5074  WMI provider for Signed Drivers
simauth.dll  10.0.26100.7920  EAP SIM run-time dll
simcfg.dll  10.0.26100.7705  EAP SIM config dll
skci.dll  10.0.26100.7705  Secure Kernel Code Integrity Module
slc.dll  10.0.26100.7824  Software Licensing Client Dll
slcext.dll  10.0.26100.4484  Software Licensing Client Extension Dll
slwga.dll  10.0.26100.1150  Software Licensing WGA API
smartactionplatform.dll  10.0.26100.7309  SmartActionPlatform
smartcardbackgroundpolicy.dll  10.0.26100.7309  SmartCardBackgroundPolicy
smartcardcredentialprovider.dll  10.0.26100.8037  Windows Smartcard Credential Provider
smartcardsimulator.dll  10.0.26100.7309  Microsoft Smart Card Simulator Transport
smartscreen.dll  1.2.2511.0  SmartScreen Dynamic Link Library
smartscreenps.dll  10.0.26100.7309  SmartScreenPS
smbhelperclass.dll  1.0.0.1  SMB (File Sharing) Helper Class for Network Diagnostic Framework
smbwmiv2.dll  10.0.26100.7309  WMIv2 Provider for SMB File Server/Client
smiengine.dll  10.0.26100.5074  WMI Configuration Core
smphost.dll  10.0.26100.7920  Storage Management Provider (SMP) host service
smsroutersvc.dll  10.0.26100.8036  Windows SMS Router Service
sndvolsso.dll  10.0.26100.7920  SCA Volume
snmpapi.dll  10.0.26100.1882  SNMP Utility Library
socialapis.dll  10.0.26100.7309  DLL for SocialRT
softkbd.dll  10.0.26100.7309  Soft Keyboard Server and Tip
softpub.dll  10.0.26100.1  Softpub Forwarder DLL
sortserver2003compat.dll  10.0.26100.1  Sort Version Server 2003
sortwindows61.dll  10.0.26100.1  SortWindows61 Dll
sortwindows62.dll  10.0.26100.1  SortWindows62 Dll
sortwindows63.dll  10.0.26100.1  SortWindows63 Dll
sortwindows64.dll  10.0.26100.1  SortWindows64 Dll
sortwindows6compat.dll  10.0.26100.1  Sort Version Windows 6.0
spacecontrol.dll  10.0.26100.7920  Storage Spaces control panel
spbcd.dll  10.0.26100.4202  BCD Sysprep Plugin
spfileq.dll  10.0.26100.1882  Windows SPFILEQ
spinf.dll  10.0.26100.1150  Windows SPINF
spmpm.dll  10.0.26100.1  MountPointManager Sysprep Plugin
spnet.dll  10.0.26100.1  Net Sysprep Plugin
spoolss.dll  10.0.26100.7920  Spooler SubSystem DLL
spopk.dll  10.0.26100.4484  OPK Sysprep Plugin
spp.dll  10.0.26100.2314  Microsoft® Windows Shared Protection Point Library
sppc.dll  10.0.26100.7824  Software Licensing Client Dll
sppcext.dll  10.0.26100.7920  Software Protection Platform Client Extension Dll
sppcomapi.dll  10.0.26100.7920  Software Licensing Library
sppcommdlg.dll  10.0.26100.1  Software Licensing UI API
sppnp.dll  10.0.26100.7920  PnP module of SysPrep
sppobjs.dll  10.0.26100.8036  Software Protection Platform Plugins
sppwinob.dll  10.0.26100.7920  Software Protection Platform Windows Plugin
sppwmi.dll  10.0.26100.7920  Software Protection Platform WMI provider
spwinsat.dll  10.0.26100.1  WinSAT Sysprep Plugin
spwizeng.dll  10.0.26100.7309  Setup Wizard Framework
spwizimg.dll  10.0.26100.1882  Setup Wizard Framework Resources
spwizres.dll  10.0.26100.1882  Setup Wizard Framework Resources
spwmp.dll  12.0.26100.1882  Windows Media Player System Preparation DLL
sqloledb.dll  10.0.26100.7309  OLE DB Provider for SQL Server
sqloledb.dll  10.0.26100.7309  OLE DB Provider for SQL Server
sqlsrv32.dll  10.0.26100.3624  SQL Server ODBC Driver
sqlxmlx.dll  10.0.26100.1  XML extensions for SQL Server
sqlxmlx.dll  10.0.26100.1150  XML extensions for SQL Server
sqmapi.dll  10.0.26100.7705  SQM Client
srchadmin.dll  7.0.26100.7920  Indexing Options
srclient.dll  10.0.26100.4343  Microsoft® Windows System Restore Client Library
srcore.dll  10.0.26100.5074  Microsoft® Windows System Restore Core Library
srevents.dll  10.0.26100.1  SrEvents
srh.dll  10.0.26100.7920  Screen Reader Helper DLL
srhelper.dll  10.0.26100.5074  Microsoft® Windows driver and windows update enumeration library
srpapi.dll  10.0.26100.7309  SRP APIs Dll
srrstr.dll  10.0.26100.5074  Microsoft® Windows System Protection Configuration Library
srumapi.dll  10.0.26100.5074  System Resource Usage Monitor API
srumsvc.dll  10.0.26100.7920  System Resource Usage Monitor Service
srvcli.dll  10.0.26100.1150  Server Service Client DLL
srvsvc.dll  10.0.26100.7920  Server Service DLL
srwmi.dll  10.0.26100.7309  Microsoft® Windows System Restore WMI Provider
sscore.dll  10.0.26100.7920  Server Service Core DLL
sscoreext.dll  10.0.26100.1  Server Service Core DLL
ssdm.dll  10.0.26100.7309  Spatial Audio Shared Memory Manager
ssdpapi.dll  10.0.26100.7920  SSDP Client API DLL
ssdpsrv.dll  10.0.26100.7920  SSDP Service DLL
sspicli.dll  10.0.26100.7920  Security Support Provider Interface
sspisrv.dll  10.0.26100.7920  LSA SSPI RPC interface DLL
ssshim.dll  10.0.26100.7920  Windows Componentization Platform Servicing API
sstpcfg.dll  10.0.26100.1  SSTP config
sstpsvc.dll  10.0.26100.8036  Provides the facility of using Secure Socket Tunneling Protocol (SSTP) to connect to remote computers (using VPN).
starttiledata.dll  10.0.26100.7920  Start Tile Data InProc Server
startupscan.dll  10.0.26100.7309  Startup scan task DLL
staterepository.core.dll  10.0.26100.7920  StateRepository Core
stclient.dll  2001.12.10941.16384  COM+ Configuration Catalog Client
sti.dll  10.0.26100.7309  Still Image Devices client DLL
sti_ci.dll  10.0.26100.7920  Still Image Class Installer
stobject.dll  10.0.26100.7920  Systray shell service object
storagecontexthandler.dll  10.0.26100.7309  Device Center Storage Context Menu Handler
storageusage.dll  10.0.26100.7309  Storage Usage
storagewmi.dll  10.0.26100.7920  WMI Provider for Storage Management
storagewmi_passthru.dll  10.0.26100.7920  WMI PassThru Provider for Storage Management
storewuauth.dll  1451.2510.27012.0  Authentication Provider
storprop.dll  10.0.26100.1882  Property Pages for Storage Devices
storsvc.dll  10.0.26100.7920  Storage Services
streamci.dll  10.0.26100.1  Streaming Device Class Installer
stringfeedbackengine.dll  10.0.26100.7309  Component to invoke StringFeedbackEngine
structuredquery.dll  7.0.26100.7920  Structured Query
sud.dll  10.0.26100.7920  SUD Control Panel
sustainabilityservice.dll  10.0.26100.7920  Microsoft Windows Sustainability Service
svsvc.dll  10.0.26100.1150  Microsoft\Spot Verifier
switcherdatamodel.dll  10.0.26100.7309  Switcher Data Model
swprv.dll  10.0.26100.5074  Microsoft® Volume Shadow Copy Service software provider
sxproxy.dll  10.0.26100.2314  Microsoft® Windows System Protection Proxy Library
sxs.dll  10.0.26100.7920  Fusion 2.5
sxshared.dll  10.0.26100.1882  Microsoft® Windows SX Shared Library
sxssrv.dll  10.0.26100.1882  Windows SxS Server DLL
sxsstore.dll  10.0.26100.7309  Sxs Store DLL
symcryptk.dll  103.9.1.0  Microsoft® SymCrypt Kernel Module
synccenter.dll  10.0.26100.7920  Microsoft Sync Center
synccontroller.dll  10.0.26100.7920  SyncController for managing sync of mail, contacts, calendar
synchostps.dll  10.0.26100.1150  Proxystub for sync host
syncinfrastructure.dll  10.0.26100.7309  Microsoft Windows Sync Infrastructure.
syncinfrastructureps.dll  10.0.26100.1  Microsoft Windows sync infrastructure proxy stub.
syncproxy.dll  10.0.26100.7309  SyncProxy for RPC communication about sync of mail, contacts, calendar
syncreg.dll  2007.94.26100.1150  Microsoft Synchronization Framework Registration
syncres.dll  10.0.26100.4202  ActiveSync Resources
syncsettings.dll  10.0.26100.7920  Sync Settings
syncutil.dll  10.0.26100.7309  Sync utilities for mail, contacts, calendar
sysclass.dll  10.0.26100.1  System Class Installer Library
sysfxui.dll  10.0.26100.7920  Audio System FX Control Panel Extension
sysmain.dll  10.0.26100.7309  SysMain Service Host
sysntfy.dll  10.0.26100.8036  Windows Notifications Dynamic Link Library
syssetup.dll  10.0.26100.1  Windows NT System Setup
systemcpl.dll  10.0.26100.7920  My System CPL
systemeventsbrokerclient.dll  10.0.26100.1150  system Events Broker Client Library
systemeventsbrokerserver.dll  10.0.26100.5074  System Events Broker
systemsettings.datamodel.dll  10.0.26100.7920  SystemSettings.Datamodel private API
systemsettings.deviceencryptionhandlers.dll  10.0.26100.7920  Device Encryption Setting Handlers
systemsettings.handlers.dll  10.0.26100.7920  System settings common handler group
systemsettings.settingsextensibility.dll  10.0.26100.7920  System Settings Extensibility Handler Implementation
systemsettings.useraccountshandlers.dll  10.0.26100.7920  SystemSettings.UserAccountsHandlers DLL
systemsettingsproxyclientdvcplugin.dll  10.0.26100.7920  System Setting Proxy Client Plugin
systemsettingsthresholdadminflowui.dll  10.0.26100.7920  System Settings Admin Flow XAML UI Implementation
systemsupportinfo.dll  10.0.26100.7309  Microsoft Windows operating system.
t2embed.dll  10.0.26100.7309  Microsoft T2Embed Font Embedding
tabbtn.dll  10.0.26100.1882  Microsoft Tablet PC Buttons Component
tabbtnex.dll  10.0.26100.5074  Microsoft Tablet PC Extended Buttons Component
tabsvc.dll  10.0.26100.7920  Microsoft Text Input Management Service
tapi3.dll  10.0.26100.5074  Microsoft TAPI3
tapi32.dll  10.0.26100.5074  Microsoft® Windows(TM) Telephony API Client DLL
tapilua.dll  10.0.26100.5074  Microsoft® Windows(TM) Phone And Modem Lua Elevation Dll
tapimigplugin.dll  10.0.26100.5074  Microsoft® Windows(TM) TAPI Migration Plugin Dll
tapiperf.dll  10.0.26100.5074  Microsoft® Windows(TM) Telephony Performance Monitor
tapisrv.dll  10.0.26100.8036  Microsoft® Windows(TM) Telephony Server
tapisysprep.dll  10.0.26100.5074  Microsoft® Windows(TM) Telephony Sysprep Work
tapiui.dll  10.0.26100.4202  Microsoft® Windows(TM) Telephony API UI DLL
taskapis.dll  10.0.26100.7309  DLL for TaskRT
taskbar.dll  10.0.26100.7920  Taskbar Dll
taskbarcpl.dll  10.0.26100.7309  Taskbar Control Panel
taskcomp.dll  10.0.26100.4202  Task Scheduler Backward Compatibility Plug-in
taskflowdataengine.dll  10.0.26100.7920  Task Flow Data Engine DLL
taskmanagerdatalayer.dll    
taskschd.dll  10.0.26100.5074  Task Scheduler COM API
taskschdps.dll  10.0.26100.1  Task Scheduler Interfaces Proxy
tbauth.dll  10.0.26100.8036  TBAuth protocol handler
tbs.dll  10.0.26100.7920  TBS
tcbloader.dll  10.0.26100.8037  TCB Loader Library
tcpipcfg.dll  10.0.26100.7920  Network Configuration Objects
tcpmib.dll  10.0.26100.5074  Standard TCP/IP Port Monitor Helper DLL
tcpmon.dll  10.0.26100.7920  Standard TCP/IP Port Monitor DLL
tcpmonui.dll  10.0.26100.7309  Standard TCP/IP Port Monitor UI DLL
tdh.dll  10.0.26100.7019  Event Trace Helper Library
tdhres.dll  10.0.26100.8036  Event Trace Helper Library Resources
tdlmigration.dll  10.0.26100.7309  TDL To TileStore Migrator
telephonyinteractiveuser.dll  10.0.26100.7309  A Telephony DLL that does work for the Interactive User
telephonyinteractiveuserres.dll  10.0.26100.1882  Resource DLL for Telephony Interactive User functions
tempsignedlicenseexchangetask.dll  10.0.26100.1150  TempSignedLicenseExchangeTask Task
termmgr.dll  10.0.26100.5074  Microsoft TAPI3 Terminal Manager
termsrv.dll  10.0.26100.7920  Remote Desktop Session Host Server Remote Connections Manager
tetheringclient.dll  10.0.26100.7920  Tethering Client
tetheringconfigsp.dll  10.0.26100.1150  Tethering Configuration Service Provider
tetheringieprovider.dll  10.0.26100.1150  Microsoft Windows Tethering IE Provider DLL
tetheringmgr.dll  10.0.26100.7309  Microsoft Windows Tethering Manager DLL
tetheringservice.dll  10.0.26100.7920  Tethering Service
tetheringstation.dll  10.0.26100.7309  Microsoft Windows Tethering Station DLL
textinputframework.dll  10.0.26100.7920  "TextInputFramework.DYNLINK"
textinputmethodformatter.dll  10.0.26100.7920  TextInputMethodFormatter DLL
textshaping.dll  10.0.26100.7824  Microsoft Text Shaping Library
themecpl.dll  10.0.26100.7920  Personalization CPL
themes.ssfdownload.scheduledtask.dll  10.0.26100.7705  ThemesSyncedImageDownload Task
themeservice.dll  10.0.26100.7920  Windows Shell Theme Service Dll
themeui.dll  10.0.26100.7920  Windows Theme API
threadpoolwinrt.dll  10.0.26100.1  Windows WinRT Threadpool
threatassessment.dll  1.0.0.221  ThreatAssessment Dynamic Link Library
threatexperiencemanager.dll  5.0.1.1  ThreatExperienceManager
threatintelligence.dll  10.0.26100.7920  Threat Intelligence Engine
threatresponseengine.dll    
thumbcache.dll  10.0.26100.7920  Microsoft Thumbnail Cache
tier2punctuations.dll  10.0.26100.7920  Screen Reader Helper Punctuation DLL
tieringengineproxy.dll  10.0.26100.5074  Storage Tiers Management service proxy
tiledatarepository.dll  10.0.26100.7920  Tile Data Repository
timebrokerclient.dll  10.0.26100.7920  Time Broker Client Library
timebrokerserver.dll  10.0.26100.7920  Time Event Broker
timedatemuicallback.dll  10.0.26100.1  Time Date Control UI Language Change plugin
timesync.dll  10.0.26100.7309  W32Time Sync Library
timesynctask.dll  10.0.26100.1150  Time Synchronization Task
tlscsp.dll  10.0.26100.4202  Microsoft® Remote Desktop Services Cryptographic Utility
tokenbinding.dll  10.0.26100.1150  Token Binding Protocol
tokenbroker.dll  10.0.26100.8036  Token Broker
tokenbrokerui.dll  10.0.26100.7309  Token Broker UI
tpmcertresources.dll  10.0.26100.7920  TpmCertResources
tpmcompc.dll  10.0.26100.1  Computer Chooser Dialog
tpmcoreprovisioning.dll  10.0.26100.7920  TPM Core Provisioning Library
tpmtasks.dll  10.0.26100.8036  TPM Maintenance Tasks
tpmvsc.dll  10.0.26100.7309  Microsoft TPM Virtual Smart Card
tprtdll.dll  10.0.26100.7920  Trusted App Runtime
tquery.dll  7.0.26100.7920  Microsoft Tripoli Query
traffic.dll  10.0.26100.1  Microsoft Traffic Control 1.0 DLL
transcodewallpaper.dll  10.0.26100.7309  Wallpaper Image Transcoder
transfertargets.dll    
transliterationranker.dll  10.0.26100.7309  "TransliterationRanker.DYNLINK"
trie.dll  10.0.26100.7309  Microsoft Trie Dll
trkwks.dll  10.0.26100.4202  Distributed Link Tracking Client
trustedsignalcredprov.dll  10.0.26100.7309  TrustedSignal Credential Provider
tsbyuv.dll  10.0.26100.1150  Toshiba Video Codec
tsf3gip.dll  10.0.26100.7920  "tsf3gip.DYNLINK"
tsgqec.dll  10.0.26100.7309  RD Gateway QEC
tsmf.dll  10.0.26100.7019  RDP MF Plugin
tspkg.dll  10.0.26100.7309  Web Service Security Package
tssessionux.dll  10.0.26100.7309  TS Session UX
tsusbgdcoinstaller.dll  10.0.26100.2894  Remote Desktop Generic USB Driver Coinstaller
tsusbredirectiongrouppolicyextension.dll  10.0.26100.3037  Remote Desktop USB Redirection GP Extension
tsworkspace.dll  10.0.26100.7309  RemoteApp and Desktop Connection Component
ttdloader.dll  1.11.580.0  Time Travel Debugging Runtime Loader
ttdplm.dll  10.0.26100.3624  Time Travel Debugger PLM APIs
ttdrecord.dll  1.11.580.0  Time Travel Debugging Recording Manager
ttdrecordcpu.dll  1.11.580.0  Time Travel Debugging CPU Recorder Runtime
ttlsauth.dll  10.0.26100.7920  EAP TTLS run-time dll
ttlscfg.dll  10.0.26100.7920  EAP TTLS configuration dll
ttlsext.dll  10.0.26100.7705  Windows Extension library for EAP TTLS
tvratings.dll  10.0.26100.1882  Module for managing TV ratings
twext.dll  10.0.26100.7920  Previous Versions property page
twinapi.appcore.dll  10.0.26100.7705  twinapi.appcore
twinapi.dll  10.0.26100.7920  twinapi
twinui.appcore.dll  10.0.26100.7920  TWINUI.APPCORE
twinui.dll  10.0.26100.8036  TWINUI
twinui.pcshell.dll  10.0.26100.8036  Twinui.PCShell
txflog.dll  2001.12.10941.16384  COM+
txfw32.dll  10.0.26100.1  TxF Win32 DLL
tzautoupdate.dll  10.0.26100.7920  Auto Time Zone Updater
tzres.dll  10.0.26100.5074  Time Zones resource DLL
tzsyncres.dll  10.0.26100.2161  TimeZone Sync Resources DLL
ubpm.dll  10.0.26100.7920  Unified Background Process Manager DLL
ucrtbase.dll  10.0.26100.7623  Microsoft® C Runtime Library
ucrtbase_clr0400.dll  14.29.30154.0  Microsoft® C Runtime Library
ucrtbase_enclave.dll  10.0.26100.7623  Microsoft® C Runtime Library
udhisapi.dll  10.0.26100.5074  UPnP Device Host ISAPI Extension
udiapiclient.dll  0.2.708.0  Microsoft Universal Download and Install
udwm.dll  10.0.26100.7920  Microsoft Desktop Window Manager
ueficsp.dll  10.0.26100.1  Windows UefiCsp Resources
uexfat.dll  10.0.26100.1882  eXfat Utility DLL
ufat.dll  10.0.26100.1882  FAT Utility DLL
uiamanager.dll  10.0.26100.7309  UiaManager
uianimation.dll  10.0.26100.7920  Windows Animation Manager
uiautomationcore.dll  7.2.26100.7920  Microsoft UI Automation Core
uicom.dll  10.0.26100.1150  Add/Remove Modems
uieapi.dll  10.0.26100.7920  UIE Api
uimanagerbrokerps.dll  10.0.26100.4202  Microsoft UIManager Broker Proxy Stub
uiomapapi.dll  10.0.26100.7309  Usermode IO Driver Library
uireng.dll  10.0.26100.7309  UI Recording Engine Library
uiribbon.dll  10.0.26100.1  Windows Ribbon Framework
uiribbonres.dll  10.0.26100.1  Windows Ribbon Framework Resources
ulib.dll  10.0.26100.7019  File Utilities Support DLL
umb.dll  10.0.26100.5074  User Mode Bus Driver Interface Dll
umdmxfrm.dll  10.0.26100.1  Unimodem Tranform Module
umpdc.dll  10.0.26100.7019  User Mode Power Dependency Coordinator
umpnpmgr.dll  10.0.26100.5074  User-mode Plug-and-Play Service
umpo.dll  10.0.26100.7920  User-mode Power Service
umpodev.dll  10.0.26100.7920  User-mode Power Device API
umpoext.dll  10.0.26100.7920  User-mode Power Service Extensions
umpo-overrides.dll  10.0.26100.7309  UMPO machine specific overrides for PC
umpowmi.dll  10.0.26100.1150  User-mode Power Service WMI Providers
umrdp.dll  10.0.26100.7019  Remote Desktop Services Device Redirector Service
unattend.dll  10.0.26100.7309  Unattend Library
unenrollhook.dll  10.0.26100.7309  unenrollhook DLL
unifiedconsent.dll  10.0.26100.7920  Unified Consent API implementation
unimdmat.dll  10.0.26100.1150  Unimodem Service Provider AT Mini Driver
unionfsapi.dll  10.0.26100.7705  UnionFS user mode API
uniplat.dll  10.0.26100.1882  Unimodem AT Mini Driver Platform Driver for Windows NT
unistore.dll  10.0.26100.7309  Unified Store
untfs.dll  10.0.26100.1150  NTFS Utility DLL
updateagent.dll  10.0.26100.7920  Update Agent
updatecompression.dll  5.0.1.1  Windows Update Compression Engine
updatecsp.dll  10.0.26100.7309  UpdateCsp
updatepolicy.dll  1451.2601.23012.0  Update Policy Reader
updatereboot.dll  10.0.26100.7309  Microsoft (R) Update Reboot Scenario Native Aggregation Plugin
upnp.dll  10.0.26100.7920  UPnP Control Point API
upnphost.dll  10.0.26100.7920  UPnP Device Host
upprinterinstallscsp.dll  10.0.26100.7920  UPPrinterInstallsCSP
upshared.dll  10.0.26100.7309  UNPShared
urefs.dll  10.0.26100.7920  UREFS Utility DLL
urefsv1.dll  10.0.26100.5074  NTFS Utility DLL
ureg.dll  10.0.26100.1  Registry Utility DLL
url.dll  11.0.26100.1  Internet Shortcut Shell Extension DLL
urlmon.dll  11.0.26100.7920  OLE32 Extensions for Win32
usbcapi.dll  10.0.26100.1150  USB Connector API
usbceip.dll  10.0.26100.7019  USBCEIP Task
usbmon.dll  10.0.26100.7920  Standard Dynamic Printing Port Monitor DLL
usbperf.dll  10.0.26100.1882  USB Performance Objects DLL
usbpmapi.dll  10.0.26100.7920  USB Policy Manager User-Mode Library
usbsettingshandlers.dll  10.0.26100.7920  USB Settings Handlers Implementation
usbtask.dll  10.0.26100.7309  UsbTask
usbui.dll  10.0.26100.1150  USB UI Dll
user32.dll  10.0.26100.7920  Multi-User Windows USER API Client DLL
useraccountcontrolsettings.dll  10.0.26100.7309  UserAccountControlSettings
useractivitybroker.dll  10.0.26100.7309  useractivitybroker
usercpl.dll  10.0.26100.7920  User control panel
userdataaccessres.dll  10.0.26100.1882  Resource DLL for the UserDataAccess stack
userdataaccountapis.dll  10.0.26100.7309  DLL for UserDataAccountsRT
userdatalanguageutil.dll  10.0.26100.1882  Language-related helper functions for user data
userdataplatformhelperutil.dll  10.0.26100.7019  Platform Utilities for data access
userdataservice.dll  10.0.26100.7705  The endpoint for 3rd party APIs to read/write user data
userdatatimeutil.dll  10.0.26100.3775  Time-related helper functions for user data
userdatatypehelperutil.dll  10.0.26100.1882  Type Utilities for data access
userdeviceregistration.dll  10.0.26100.7920  Microsoft Entra User Device Registration WinRT
userdeviceregistration.ngc.dll  10.0.26100.7920  Microsoft Entra User Device Registration WinRT
userenv.dll  10.0.26100.7920  Userenv
userinitext.dll  10.0.26100.7309  UserInit Utility Extension DLL
userlanguageprofilecallback.dll  10.0.26100.7309  MUI Callback for User Language profile changed
usermgr.dll  10.0.26100.7920  UserMgr
usermgrcli.dll  10.0.26100.7920  UserMgr API DLL
usermgrproxy.dll  10.0.26100.7920  UserMgrProxy
usoapi.dll  10.0.26100.7705  Update Session Orchestrator API
usocoreps.dll  10.0.26100.7705  USO Core Worker Proxy Stub
usodocked.dll  10.0.26100.7920  Uso Docked DLL
usosvc.dll  10.0.26100.7920  Update Session Orchestrator Service
usp10.dll  10.0.26100.1  Uniscribe Unicode script processor
ustprov.dll  10.0.26100.1150  User State WMI Provider
utcapi.dll  10.0.26100.7920  Microsoft Diagtrack RPC API surface
utcutil.dll  10.0.26100.7920  Microsoft Windows Telemetry Utils
utildll.dll  10.0.26100.1  WinStation utility support DLL
uudf.dll  10.0.26100.1150  UDF Utility DLL
uvcmodel.dll  10.0.26100.7309  UvcModel
uxframe.dll    
uxinit.dll  10.0.26100.7705  Windows User Experience Session Initialization Dll
uxlib.dll  10.0.26100.1882  Setup Wizard Framework
uxlibres.dll  10.0.26100.1882  UXLib Resources
uxtheme.dll  10.0.26100.7920  Microsoft UxTheme Library
vault.dll  10.0.26100.7309  Windows vault Control Panel
vaultcds.dll  10.0.26100.7309  Vault CDS
vaultcli.dll  10.0.26100.7309  Credential Vault Client Library
vaultroaming.dll  1.0.0.1  Vault Roaming
vaultsvc.dll  10.0.26100.7309  Credential Manager Service
vbsapi.dll  10.0.26100.7920  Windows VBS HVCI API
vbscript.dll  10.0.26100.7920  Microsoft ® VBScript
vbssysprep.dll  10.0.26100.7309  VBS Sysprep
vcardparser.dll  10.0.26100.5074  Supports the parsing of VCard and ICal formatted data
vcruntime140_1_clr0400.dll  14.29.30154.0  Microsoft® C Runtime Library
vcruntime140_clr0400.dll  14.29.30154.0  Microsoft® C Runtime Library
vds_ps.dll  10.0.26100.7920  Microsoft® Virtual Disk Service proxy/stub
vdsbas.dll  10.0.26100.7920  Virtual Disk Service Basic Provider
vdsdyn.dll  10.0.26100.5074  VDS Dynamic Volume Provider, Version 2.1.0.1
vdsutil.dll  10.0.26100.7920  Virtual Disk Service Utility Library
vdsvd.dll  10.0.26100.5074  VDS Virtual Disk Provider, Version 1.0
veinterop.dll  10.0.26100.7705  VTL1 interop dll for OS components
verifier.dll  10.0.26100.1882  Standard application verifier provider dll
version.dll  10.0.26100.1150  Version Checking and File Installation Libraries
vertdll.dll  10.0.26100.7920  VSM enclave runtime DLL
vfuprov.dll  10.0.26100.7309  SRUM provider
vfwwdm32.dll  10.0.26100.1882  VfW MM Driver for WDM Video Capture Devices
vhfum.dll  10.0.26100.1  Virtual HID Framework User-Mode Library
vid.dll  10.0.26100.5074  Microsoft Hyper-V Virtualization Infrastructure Driver Library
videohandlers.dll  10.0.26100.7920  Video Settings Handlers Implementation
vidreszr.dll  10.0.26100.7019  Windows Media Resizer
virtdisk.dll  10.0.26100.5074  Virtual Disk API DLL
virtualmon.dll  10.0.26100.7920  Virtual Printer Monitor
virtualsurroundapo.dll  10.0.26100.7309  VirtualSurround APO
vmapplicationhealthmonitorproxy.dll  10.0.26100.7309  VM Application Health Monitor proxy dll
vmbuspipe.dll  10.0.26100.7920  VmBus User Mode Pipe DLL
vmdevicehost.dll  10.0.26100.7309  Hyper-V Device Virtualization Library
vmictimeprovider.dll  10.0.26100.7309  Virtual Machine Integration Component Time Sync Provider Library
vmrdvcore.dll  10.0.26100.1150  VmRdvCore EndPoints
vocabroaminghandler.dll  10.0.26100.7309  Microsoft Vocabulary Roaming Handler Dll
voiceactivationmanager.dll  10.0.26100.7920  Windows Voice Activation Manager
voiprt.dll  10.0.26100.7309  Voip Runtime
vpnike.dll  10.0.26100.7920  VPNIKE Protocol Engine - Test dll
vpnikeapi.dll  10.0.26100.7462  VPN IKE API's
vpnsohdesktop.dll  10.0.26100.1  VpnSohDesktop.dll
vpnv2csp.dll  10.0.26100.7920  VPNv2CSP
vscmgrps.dll  10.0.26100.3624  Microsoft Virtual Smart Card Manager Proxy/Stub
vss_ps.dll  10.0.26100.1  Microsoft® Volume Shadow Copy Service proxy/stub
vssapi.dll  10.0.26100.7920  Microsoft® Volume Shadow Copy Requestor/Writer Services API DLL
vsstrace.dll  10.0.26100.7920  Microsoft® Volume Shadow Copy Service Tracing Library
vulkan-1.dll  1.3.300.0  Vulkan Loader
w32time.dll  10.0.26100.7920  Windows Time Service
w32topl.dll  10.0.26100.1  Windows NT Topology Maintenance Tool
waasassessment.dll  10.0.26100.7920  WaaS Assessment
waasmedicps.dll  10.0.26100.7309  WaaS Medic Proxy Stub library
waasmedicsvc.dll  10.0.26100.7309  Enables remediation and protection of Windows Update components.
wab32.dll  10.0.26100.7309  Microsoft (R) Contacts DLL
wab32.dll  10.0.26100.7309  Microsoft (R) Contacts DLL
wab32res.dll  10.0.26100.1882  Microsoft (R) Contacts DLL
wab32res.dll  10.0.26100.1882  Microsoft (R) Contacts DLL
wabsyncprovider.dll  10.0.26100.1150  Microsoft Windows Contacts Sync Provider
walletbackgroundserviceproxy.dll  10.0.26100.7309  Wallet Background Proxy
walletproxy.dll  10.0.26100.1  Wallet proxy
walletservice.dll  10.0.26100.7920  Wallet Service
wavemsp.dll  10.0.26100.5074  Microsoft Wave MSP
wbemcomn.dll  10.0.26100.7920  WMI
wbiosrvc.dll  10.0.26100.7920  Windows Biometric Service
wc_storage.dll  10.0.26100.7623  WC_STORAGE.DLL
wci.dll  10.0.26100.1882  Wci user mode API
wcimage.dll  10.0.26100.7623  Windows Container Base Layer Utility Library
wcmapi.dll  10.0.26100.7920  Windows Connection Manager Client API
wcmcsp.dll  10.0.26100.7920  Windows Connection Service Provider DLL
wcmsvc.dll  10.0.26100.7920  Windows Connection Manager Service DLL
wcnapi.dll  10.0.26100.7920  Windows Connect Now - API Helper DLL
wcncsvc.dll  10.0.26100.7920  Windows Connect Now - Config Registrar Service
wcneapauthproxy.dll  10.0.26100.7920  Windows Connect Now - WCN EAP Authenticator Proxy
wcneappeerproxy.dll  10.0.26100.7920  Windows Connect Now - WCN EAP PEER Proxy
wcnnetsh.dll  10.0.26100.1  WCN Netsh Helper DLL
wcnwiz.dll  10.0.26100.7309  Windows Connect Now Wizards
wdc.dll  10.0.26100.7309  Performance Monitor
wdi.dll  10.0.26100.7705  Windows Diagnostic Infrastructure
wdigest.dll  10.0.26100.7705  Microsoft Digest Access
wdscore.dll  10.0.26100.1150  Panther Engine Module
webauthn.dll  10.0.26100.7920  Web Authentication
webcamui.dll  10.0.26100.7705  Microsoft® Windows® Operating System
webcheck.dll  11.0.26100.7309  Web Site Monitor
webclnt.dll  10.0.26100.1150  Web DAV Service DLL
webio.dll  10.0.26100.7920  Web Transfer Protocols API
webplatstorageserver.dll  10.0.26100.7920  "webplatstorageserver.DYNLINK"
webruntimemanager.dll  10.0.26100.7920  Microsoft Edge Manager
webservices.dll  10.0.26100.7920  Windows Web Services Runtime
websocket.dll  10.0.26100.3912  Web Socket API
webthreatdefsvc.dll  10.0.26100.7309  Web Threat Defense Service
webthreatdefusersvc.dll  10.0.26100.7309  Web Threat Defense User Service
wecapi.dll  10.0.26100.1  Event Collector Configuration API
wecsvc.dll  10.0.26100.3323  Event Collector Service
wephostsvc.dll  10.0.26100.1882  WEP Host Service
wer.dll  10.0.26100.7920  Windows Error Reporting DLL
werconcpl.dll  10.0.26100.7309  PRS CPL
wercplsupport.dll  10.0.26100.7309  Problem Reports
werdiagcontroller.dll  10.0.26100.7920  WER Diagnostic Controller
werenc.dll  10.0.26100.7920  Windows Error Reporting Dump Encoding Library
weretw.dll  10.0.26100.7920  WERETW.DLL
wersvc.dll  10.0.26100.7920  Windows Error Reporting Service
werui.dll  10.0.26100.7309  Windows Error Reporting UI DLL
wevtapi.dll  10.0.26100.7309  Eventing Consumption and Configuration API
wevtfwd.dll  10.0.26100.1882  WS-Management Event Forwarding Plug-in
wevtsvc.dll  10.0.26100.7920  Event Logging Service
wfapigp.dll  10.0.26100.7920  Windows Defender Firewall GPO Helper dll
wfdprov.dll  10.0.26100.7920  Private WPS provisioning API DLL for Wi-Fi Direct
wfdsconmgr.dll  10.0.26100.7705  Wi-Fi Direct Services Connection Manager RPC client
wfdsconmgrsvc.dll  10.0.26100.7705  Wi-Fi Direct Services Connection Manager Service
wfhc.dll  10.0.26100.5074  Windows Defender Firewall Helper Class
whealogr.dll  10.0.26100.1  WHEA Troubleshooter
whesvc.dll  10.0.26100.7920  whesvc
whesvc_assets.dll    
whhelper.dll  10.0.26100.7705  Net shell helper DLL for winHttp
wiaaut.dll  10.0.26100.7309  WIA Automation Layer
wiadefui.dll  10.0.26100.5074  WIA Scanner Default UI
wiadss.dll  10.0.26100.7309  WIA TWAIN compatibility layer
wiaextensionhost64.dll  10.0.26100.5074  WIA Extension Host for thunking APIs from 32-bit to 64-bit process
wiarpc.dll  10.0.26100.7309  Windows Image Acquisition RPC client DLL
wiascanprofiles.dll  10.0.26100.5074  Microsoft Windows ScanProfiles
wiaservc.dll  10.0.26100.7920  Still Image Devices Service
wiashext.dll  10.0.26100.5074  Imaging Devices Shell Folder UI
wiatrace.dll  10.0.26100.5074  WIA Tracing
wificloudstore.dll  10.0.26100.7705  Windows WiFi Sync Provider DLL
wificonfigsp.dll  10.0.26100.7920  Wi-Fi ConfigSP Library
wifidatacapabilityhandler.dll  10.0.26100.7309  Windows wifiData Capability Handler
wifidisplay.dll  10.0.26100.7309  Wi-Fi Display DLL
wifinetworkmanager.dll  10.0.26100.7920  Wireless Network Manager Library
wimgapi.dll  10.0.26100.7920  Windows Imaging Library
win32_deviceguard.dll  10.0.26100.7920  DeviceGuard WMI Provider
win32appinventorycsp.dll  10.0.26100.7920  Win32 Application Inventory CSP
win32compatibilityappraisercsp.dll  10.0.26100.7920  Win32CompatibilityAppraiserCSP
win32spl.dll  10.0.26100.7920  Client Side Rendering Print Provider
win32u.dll  10.0.26100.8036  Win32u
winbio.dll  10.0.26100.7705  Windows Biometrics Client API
winbiodatamodel.dll  10.0.26100.7920  Win Bio Enrollment Data Model
winbioext.dll  10.0.26100.7309  Windows Biometrics Client Extension API
winbrand.dll  10.0.26100.7705  Windows Branding Resources
wincorlib.dll  10.0.26100.7920  Microsoft Windows ® WinRT core library
wincredprovider.dll  10.0.26100.7309  wincredprovider DLL
wincredui.dll  10.0.26100.7920  Credential Manager User Internal Interface
windiag.dll  10.0.26100.7920  Windows Diagnostics Framework - Engine
windlp.dll  10.0.26100.7705  Windows Download Platform
windowmanagement.dll  10.0.26100.7623  Window Management
windowmanagementapi.dll  10.0.26100.7309  Window Management API
windows.accountscontrol.dll  10.0.26100.7309  Windows Accounts Control
windows.ai.machinelearning.dll  1.17.2504.1701  Windows Machine Learning Runtime
windows.ai.machinelearning.preview.dll  10.0.26100.1150  WinRT Windows Machine Learning Preview DLL
windows.applicationmodel.background.systemeventsbroker.dll  10.0.26100.7309  Windows Background System Events Broker API Server
windows.applicationmodel.background.timebroker.dll  10.0.26100.1150  Windows Background Time Broker API Server
windows.applicationmodel.conversationalagent.dll  10.0.26100.7920  Windows Voice Agent Services DLL
windows.applicationmodel.conversationalagent.internal.proxystub.dll  10.0.26100.1882  Windows Voice Agent Services Internal Proxy Stub DLL
windows.applicationmodel.conversationalagent.proxystub.dll  10.0.26100.1882  Windows Voice Agent Services Proxy Stub DLL
windows.applicationmodel.core.dll  10.0.26100.7309  Windows Application Model Core API
windows.applicationmodel.datatransfer.dll  10.0.26100.7920  Windows.ApplicationModel.DataTransfer
windows.applicationmodel.dll  10.0.26100.7920  Windows ApplicationModel API Server
windows.applicationmodel.lockscreen.dll  10.0.26100.7920  Windows Lock Application Framework DLL
windows.applicationmodel.store.dll  10.0.26100.7920  Microsoft Store Runtime DLL
windows.applicationmodel.store.preview.dosettings.dll  10.0.26100.7309  Delivery Optimization Settings
windows.applicationmodel.store.testingframework.dll  10.0.26100.7705  Microsoft Store Testing Framework Runtime DLL
windows.applicationmodel.wallet.dll  10.0.26100.7309  Windows ApplicationModel Wallet Runtime DLL
windows.cloudstore.dll  10.0.26100.7920  Cloud Data Store
windows.cloudstore.earlydownloader.dll  10.0.26100.7920  Early Downloader for Cloud Data Store
windows.cloudstore.schema.desktopshell.dll  10.0.26100.7920  Desktop Shell Schema for Cloud Data Store
windows.cloudstore.schema.shell.dll  10.0.26100.7920  Shell Schema for Cloud Data Store
windows.cortana.desktop.dll  10.0.26100.7920  Windows.Cortana.Desktop
windows.cortana.onecore.dll  10.0.26100.7920  Windows.Cortana.OneCore
windows.cortana.proxystub.dll  10.0.26100.1150  Windows.Cortana.ProxyStub
windows.data.activities.dll  10.0.26100.7920  Activities DataModel
windows.data.pdf.dll  10.0.26100.7920  PDF WinRT APIs
windows.devices.background.dll  10.0.26100.7309  Windows.Devices.Background
windows.devices.background.ps.dll  10.0.26100.1882  Windows.Devices.Background Interface Proxy
windows.devices.bluetooth.dll  10.0.26100.7920  Windows.Devices.Bluetooth DLL
windows.devices.custom.dll  10.0.26100.7309  Windows.Devices.Custom
windows.devices.custom.ps.dll  10.0.26100.1882  Windows.Devices.Custom Interface Proxy
windows.devices.enumeration.dll  10.0.26100.7920  Windows.Devices.Enumeration
windows.devices.haptics.dll  10.0.26100.7309  Windows Runtime Haptics DLL
windows.devices.humaninterfacedevice.dll  10.0.26100.7705  Windows.Devices.HumanInterfaceDevice DLL
windows.devices.lights.dll  10.0.26100.7920  Windows Runtime Lights DLL
windows.devices.lowlevel.dll  10.0.26100.5074  Windows.Devices.LowLevel DLL
windows.devices.midi.dll  10.0.26100.7920  Windows Runtime MIDI Device server DLL
windows.devices.perception.dll  10.0.26100.7309  Windows Devices Perception API
windows.devices.picker.dll  10.0.26100.7920  Device Picker
windows.devices.pointofservice.dll  10.0.26100.7462  Windows Runtime PointOfService DLL
windows.devices.portable.dll  10.0.26100.7309  Windows Runtime Portable Devices DLL
windows.devices.printers.dll  10.0.26100.5074  Windows Runtime Devices Printers DLL
windows.devices.printers.extensions.dll  10.0.26100.5074  Windows.Devices.Printers.Extensions
windows.devices.radios.dll  10.0.26100.7920  Windows.Devices.Radios DLL
windows.devices.scanners.dll  10.0.26100.7309  Windows Runtime Devices Scanners DLL
windows.devices.sensors.dll  10.0.26100.7920  Windows Runtime Sensors DLL
windows.devices.serialcommunication.dll  10.0.26100.4202  Windows.Devices.SerialCommunication DLL
windows.devices.smartcards.dll  10.0.26100.8037  Windows Runtime Smart Card API DLL
windows.devices.smartcards.phone.dll  10.0.26100.7705  Windows Runtime Phone Smart Card Api DLL
windows.devices.usb.dll  10.0.26100.7309  Windows Runtime Usb DLL
windows.devices.wifi.dll  10.0.26100.7920  Windows.Devices.WiFi DLL
windows.devices.wifidirect.dll  10.0.26100.7920  Windows.Devices.WiFiDirect DLL
windows.energy.dll  10.0.26100.7920  Windows Energy Runtime DLL
windows.fileexplorer.common.dll  10.0.26100.7920  Windows.FileExplorer.Common
windows.gaming.input.dll  10.0.26100.7920  Windows Gaming Input API
windows.gaming.preview.dll  10.0.26100.7309  Windows Gaming API Preview
windows.gaming.ui.gamebar.dll  10.0.26100.7309  Windows Gaming UI API GameBar
windows.gaming.xboxlive.storage.dll  10.0.26100.4202  Xbox Connected Storage WinRT implementation
windows.globalization.dll  10.0.26100.7309  Windows Globalization
windows.globalization.fontgroups.dll  10.0.26100.1150  Fonts Mapping API
windows.globalization.phonenumberformatting.dll  10.0.26100.7309  Windows Libphonenumber OSS component
windows.graphics.display.brightnessoverride.dll  10.0.26100.7920  Windows Runtime Brightness Override DLL
windows.graphics.display.displayenhancementoverride.dll  10.0.26100.7920  Windows Runtime Display Enhancement Override DLL
windows.graphics.dll  10.0.26100.7920  WinRT Windows Graphics DLL
windows.graphics.printing.3d.dll  10.0.26100.7309  Microsoft Windows Printing Support
windows.graphics.printing.dll  10.0.26100.7920  Microsoft Windows Printing Support
windows.graphics.printing.protectedprint.dll  10.0.26100.7309  Microsoft Windows Protected Print
windows.graphics.printing.workflow.dll  10.0.26100.7920  Microsoft Windows Print Workflow
windows.graphics.printing.workflow.native.dll  10.0.26100.7019  Microsoft Windows Print Workflow Native
windows.help.runtime.dll  10.0.26100.1  
windows.immersiveshell.serviceprovider.dll  10.0.26100.7920  Windows.ImmersiveShell.ServiceProvider
windows.internal.adaptivecards.xamlcardrenderer.dll  10.0.26100.7309  Adaptive Cards Xaml Renderer
windows.internal.capturepicker.desktop.dll  10.0.26100.7920  Capture Picker Desktop
windows.internal.capturepicker.dll  10.0.26100.7309  Capture Picker Experience
windows.internal.devices.bluetooth.dll  10.0.26100.7920  Windows.Internal.Devices.Bluetooth DLL
windows.internal.devices.lights.backlightserver.dll  10.0.26100.7920  Windows.Internal.Devices.Lights.BacklightServer DLL
windows.internal.devices.lights.configuration.dll  10.0.26100.7920  Windows.Internal.Devices.Lights.Configuration DLL
windows.internal.devices.sensors.dll  10.0.26100.7920  Windows Runtime Sensors (Internal) DLL
windows.internal.graphics.display.displaycolormanagement.dll  10.0.26100.7705  Windows Runtime Display Color Management DLL
windows.internal.graphics.display.displayenhancementmanagement.dll  10.0.26100.7309  Windows Runtime Display Enhancement Management DLL
windows.internal.hardwareconfirmator.dll  10.0.26100.7920  Hardware Confirmator
windows.internal.management.dll  10.0.26100.7920  Windows Managent Service DLL
windows.internal.openwithhost.dll  10.0.26100.7920  Open With
windows.internal.openwithhost_winui3.dll  10.0.26100.7920  Open With
windows.internal.platformextension.devicepickerexperience.dll  10.0.26100.7309  In-Proc WinRT server for Windows.Internal.PlatformExtension.DevicePickerExperience
windows.internal.platformextension.miracastbannerexperience.dll  10.0.26100.7309  In-Proc WinRT server for Windows.Internal.PlatformExtension.MiracastBannerExperience
windows.internal.predictionunit.dll  10.0.26100.7309  Prediction Unit
windows.internal.securitymitigationsbroker.dll  10.0.26100.1150  Windows Security Mitigations Broker DLL
windows.internal.shell.broker.dll  10.0.26100.7920  Windows Shell Broker
windows.internal.shell.clouddesktop.transitionscreen.dll    
windows.internal.shell.xamlinputviewhost.dll  10.0.26100.7920  XAML Input View Host DLL
windows.internal.shellcommon.accountscontrolexperience.dll  10.0.26100.7309  Shell Position default shell contract handler
windows.internal.shellcommon.appresolvermodal.dll  10.0.26100.7309  App resolver default shell contract handler
windows.internal.shellcommon.broker.dll  10.0.26100.7824  Windows Shell Common Broker
windows.internal.shellcommon.dll  10.0.26100.7920  Windows.Internal.ShellCommon
windows.internal.shellcommon.filepickerexperiencemem.dll  10.0.26100.7309  File/Folder Open/Save Picker Experience contract handler
windows.internal.shellcommon.printexperience.dll  10.0.26100.7309  Print Experience default shell contract handler
windows.internal.shellcommon.shareexperience.dll  10.0.26100.7920  Share Experience
windows.internal.shellcommon.tokenbrokermodal.dll  10.0.26100.7309  Token broker default shell contract handler
windows.internal.signals.dll  10.0.26100.7309  Windows.Internal.Signals
windows.internal.system.userprofile.dll  10.0.26100.7824  Windows.Internal.System.UserProfile
windows.internal.taskbar.dll  10.0.26100.7920  TaskbarPinningWinRT PCShell
windows.internal.ui.bioenrollment.proxystub.dll  10.0.26100.4202  Bio Enrollment Model Proxy Stub
windows.internal.ui.dialogs.dll  10.0.26100.7920  Windows.Internal.UI.Dialogs.dll
windows.internal.ui.logon.proxystub.dll  10.0.26100.4768  Logon User Experience Proxy Stub
windows.internal.ui.shell.windowtabmanager.dll  10.0.26100.7920  Windows.Internal.UI.Shell.WindowTabManager
windows.internal.waasmedicdocked.dll    
windows.management.enrollmentstatustracking.configprovider.dll  10.0.26100.7705  Implements settings for EnrollmentStatusPage policy tracking.
windows.management.inprocobjects.dll    
windows.management.moderndeployment.configproviders.dll  10.0.26100.7920  Holds configuration settings for access through management.
windows.management.provisioning.proxystub.dll  10.0.26100.3470  Windows Management Provisioning Proxy Stub
windows.management.service.dll  10.0.26100.7705  Windows Management Service DLL
windows.management.update.dll  10.0.26100.7705  Windows.Management.Update DLL
windows.management.workplace.dll  10.0.26100.7309  Windows Runtime MdmPolicy DLL
windows.management.workplace.workplacesettings.dll  10.0.26100.1  Windows Runtime WorkplaceSettings DLL
windows.media.audio.dll  10.0.26100.7309  Windows Runtime Window Media Audio server DLL
windows.media.backgroundmediaplayback.dll  10.0.26100.7920  Windows Media BackgroundMediaPlayback DLL
windows.media.devices.dll  10.0.26100.7920  Windows Runtime media device server DLL
windows.media.dll  10.0.26100.7920  Windows Media Runtime DLL
windows.media.editing.dll  10.0.26100.7705  Windows Media Editing DLL
windows.media.faceanalysis.dll  10.0.26100.5074  Microsoft (R) Face Detection DLL
windows.media.import.dll  10.0.26100.7309  Windows Photo Import API (WinRT/COM)
windows.media.mediacontrol.dll  10.0.26100.7705  Windows Runtime MediaControl server DLL
windows.media.ocr.dll  10.0.26100.7705  Windows OCR Runtime DLL
windows.media.playback.backgroundmediaplayer.dll  10.0.26100.7920  Windows Media Playback BackgroundMediaPlayer DLL
windows.media.playback.mediaplayer.dll  10.0.26100.7920  Windows Media Playback MediaPlayer DLL
windows.media.playback.proxystub.dll  10.0.26100.1150  BackgroundMediaPlayer Proxy Stub DLL
windows.media.protection.playready.dll  10.0.26100.8036  Microsoft PlayReady Client Framework Dll
windows.media.renewal.dll  10.0.26100.7309  Windows Media Renewal DLL
windows.media.speech.dll  10.0.26100.7920  Windows Speech Runtime DLL
windows.media.speech.uxres.dll  10.0.26100.1882  Windows Media Speech UX Resources DLL
windows.media.streaming.dll  10.0.26100.7309  DLNA DLL
windows.media.streaming.ps.dll  10.0.26100.1  DLNA Proxy-Stub DLL
windows.networking.backgroundtransfer.backgroundmanagerpolicy.dll  10.0.26100.7309  Background Transfer Background Manager Policy DLL
windows.networking.backgroundtransfer.contentprefetchtask.dll  10.0.26100.3323  Windows Networking Background Transfer Content Prefetch task DLL
windows.networking.backgroundtransfer.dll  10.0.26100.7309  Windows.Networking.BackgroundTransfer DLL
windows.networking.connectivity.dll  10.0.26100.7920  Windows Networking Connectivity Runtime DLL
windows.networking.dll  10.0.26100.7920  Windows.Networking DLL
windows.networking.hostname.dll  10.0.26100.7920  Windows.Networking.HostName DLL
windows.networking.networkoperators.esim.dll  10.0.26100.7309  ESIM API
windows.networking.networkoperators.hotspotauthentication.dll  10.0.26100.7309  Microsoft Windows Hotspot Authentication API
windows.networking.proximity.dll  10.0.26100.7019  Windows Runtime Proximity API DLL
windows.networking.servicediscovery.dnssd.dll  10.0.26100.1  Windows.Networking.ServiceDiscovery.Dnssd DLL
windows.networking.sockets.pushenabledapplication.dll  10.0.26100.7309  Windows.Networking.Sockets.PushEnabledApplication DLL
windows.networking.ux.eaprequesthandler.dll  10.0.26100.7920  Windows Networking UX EAP Request Handler DLL
windows.networking.vpn.dll  10.0.26100.7920  Windows.Networking.Vpn DLL
windows.networking.xboxlive.proxystub.dll  10.0.26100.1  Windows.Networking.XboxLive Proxy Stub Dll
windows.payments.dll  10.0.26100.7705  Payment Windows Runtime DLL
windows.perception.stub.dll  10.0.26100.7309  Windows Perception Api Stub
windows.security.authentication.identity.provider.dll  10.0.26100.7309  Secondary Factor Authentication Windows Runtime DLL
windows.security.authentication.onlineid.dll  10.0.26100.7920  Windows Runtime OnlineId Authentication DLL
windows.security.authentication.web.core.dll  10.0.26100.8036  Token Broker WinRT API
windows.security.credentials.ui.credentialpicker.dll  10.0.26100.7309  WinRT Credential Picker Server
windows.security.credentials.ui.userconsentverifier.dll  10.0.26100.7309  Windows User Consent Verifier API
windows.security.integrity.dll  10.0.26100.7309  Windows S-Mode and App Control API Server
windows.services.targetedcontent.dll  10.0.26100.7920  Windows.Services.TargetedContent
windows.sharedpc.accountmanager.dll  10.0.26100.7920  SharedPC.AccountManager
windows.sharedpc.credentialprovider.dll  10.0.26100.7309  SharedPC.CredentialProvider
windows.shell.bluelightreduction.dll  10.0.26100.7309  Blue Light Reduction
windows.shell.servicehostbuilder.dll  10.0.26100.7309  Windows.Shell.ServiceHostBuilder
windows.shell.startlayoutpopulationevents.dll  10.0.26100.1  StartLayoutPopulation Instrumentation Description Resources
windows.staterepository.dll  10.0.26100.7920  Windows StateRepository API Server
windows.staterepositorybroker.dll  10.0.26100.7920  Windows StateRepository API Broker
windows.staterepositoryclient.dll  10.0.26100.7920  Windows StateRepository Client API
windows.staterepositorycore.dll  10.0.26100.7920  Windows StateRepository API Core
windows.staterepositoryps.dll  10.0.26100.7920  Windows StateRepository Proxy/Stub Server
windows.staterepositoryupgrade.dll  10.0.26100.7920  Windows StateRepository Upgrade
windows.storage.applicationdata.dll  10.0.26100.7920  Windows Application Data API Server
windows.storage.compression.dll  5.0.1.1  WinRT Compression
windows.storage.dll  10.0.26100.8036  Microsoft WinRT Storage API
windows.storage.onecore.dll  10.0.26100.7309  Microsoft Windows.Storage OneCore API
windows.storage.search.dll  10.0.26100.7920  Windows.Storage.Search
windows.system.diagnostics.dll  10.0.26100.7309  Windows System Diagnostics DLL
windows.system.diagnostics.telemetry.platformtelemetryclient.dll  10.0.26100.7309  Platform Telemetry Client DLL
windows.system.diagnostics.tracereporting.platformdiagnosticactions.dll  10.0.26100.7309  Platform Diagnostic Actions DLL
windows.system.launcher.dll  10.0.26100.7920  Windows.System.Launcher
windows.system.power.thermal.dll  10.0.26100.7920  MPTF User Space Client Interface
windows.system.profile.hardwareid.dll  10.0.26100.8036  Windows System Profile HardwareId DLL
windows.system.profile.platformdiagnosticsandusagedatasettings.dll  10.0.26100.7309  Platform Diagnostics and Usage Settings DLL
windows.system.profile.retailinfo.dll  10.0.26100.7920  Windows.System.Profile.RetailInfo Runtime DLL
windows.system.profile.systemid.dll  10.0.26100.7309  Windows System Profile SystemId DLL
windows.system.profile.systemmanufacturers.dll  10.0.26100.7309  Windows.System.Profile.SystemManufacturers
windows.system.remotedesktop.dll  10.0.26100.7019  Windows System RemoteDesktop Runtime DLL
windows.system.systemmanagement.dll  10.0.26100.7309  Windows Runtime SystemManagement DLL
windows.system.userdeviceassociation.dll  10.0.26100.7309  Windows System User Device Association API
windows.system.userprofile.diagnosticssettings.dll  10.0.26100.7309  Diagnostics Settings DLL
windows.ui.accessibility.dll  10.0.26100.7705  Windows.UI.Accessibility System DLL
windows.ui.appdefaults.dll  10.0.26100.7920  App Defaults UX
windows.ui.biofeedback.dll  10.0.26100.7920  Bio Feedback User Experience
windows.ui.blockedshutdown.dll  10.0.26100.7920  Blocked Shutdown User Experience
windows.ui.core.textinput.dll  10.0.26100.7920  Windows.UI.Core.TextInput dll
windows.ui.cred.dll  10.0.26100.7920  Credential Prompt User Experience
windows.ui.creddialogcontroller.dll  10.0.26100.7920  Credential UX Dialog Controller
windows.ui.dll  10.0.26100.7920  Windows Runtime UI Foundation DLL
windows.ui.fileexplorer.dll  10.0.26100.7920  Windows.UI.FileExplorer
windows.ui.immersive.dll  10.0.26100.7920  WINDOWS.UI.IMMERSIVE
windows.ui.input.inking.analysis.dll    
windows.ui.input.inking.dll  10.0.26100.7309  WinRT Windows Inking DLL
windows.ui.logon.dll  10.0.26100.7920  Logon User Experience
windows.ui.networkuxcontroller.dll  10.0.26100.7309  Network UX Controller
windows.ui.picturepassword.dll  10.0.26100.7309  Picture Password UX
windows.ui.search.dll  10.0.26100.7920  Windows.UI.Search
windows.ui.shell.dll  10.0.26100.7309  Shell UI
windows.ui.shell.internal.adaptivecards.dll  10.0.26100.7824  Windows Adaptive Cards Internal API Server
windows.ui.storage.dll  10.0.26100.7920  Windows Storage UX
windows.ui.xaml.controls.dll  10.0.26100.7309  Windows.UI.Xaml.Controls
windows.ui.xaml.dll  10.0.26100.7920  Windows.UI.Xaml dll
windows.ui.xaml.inkcontrols.dll  10.0.26100.3323  Windows UI XAML InkControls API
windows.ui.xaml.maps.dll  10.0.26100.7920  Windows UI XAML Maps API
windows.ui.xaml.phone.dll  10.0.26100.7705  Windows UI XAML Phone API
windows.ui.xaml.resources.19h1.dll  10.0.26100.1301  Windows.UI.Xaml.Resources.19H1 dll
windows.ui.xaml.resources.21h1.dll  10.0.26100.1301  Windows.UI.Xaml.Resources.21H1 dll
windows.ui.xaml.resources.common.dll  10.0.26100.1882  Windows.UI.Xaml.Resources.Common.dll
windows.ui.xaml.resources.rs1.dll  10.0.26100.1301  Windows.UI.Xaml.Resources.RS1 dll
windows.ui.xaml.resources.rs2.dll  10.0.26100.1301  Windows.UI.Xaml.Resources.RS2 dll
windows.ui.xaml.resources.rs3.dll  10.0.26100.1301  Windows.UI.Xaml.Resources.RS3 dll
windows.ui.xaml.resources.rs4.dll  10.0.26100.1301  Windows.UI.Xaml.Resources.RS4 dll
windows.ui.xaml.resources.rs5.dll  10.0.26100.1301  Windows.UI.Xaml.Resources.RS5 dll
windows.ui.xaml.resources.th.dll  10.0.26100.1301  Windows.UI.Xaml.Resources.TH dll
windows.ui.xaml.resources.win81.dll  10.0.26100.1301  Windows.UI.Xaml.Resources.Win81 dll
windows.ui.xaml.resources.win8rtm.dll  10.0.26100.1301  Windows.UI.Xaml.Resources.Win8Rtm dll
windows.ui.xamlhost.dll  10.0.26100.7920  XAML Host
windows.warp.jitservice.dll  10.0.26100.7309  D3D10Warp JIT Service
windows.web.diagnostics.dll  10.0.26100.7309  Windows.Web.Diagnostics
windows.web.dll  10.0.26100.5074  Web Client DLL
windows.web.http.dll  10.0.26100.7309  Windows.Web.Http DLL
windowsbackupandrestorecsp.dll  10.0.26100.7309  WindowsBackupAndRestoreCSP
windowscodecs.dll  10.0.26100.7920  Microsoft Windows Codecs Library
windowscodecsext.dll  10.0.26100.7705  Microsoft Windows Codecs Extended Library
windowsdefaultheatprocessor.dll  10.0.26100.7309  Microsoft (R) Windows default HEAT processor
windowsinternal.composableshell.display.dll  10.0.26100.7920  WindowsInternal.ComposableShell.Display
windowsinternal.shell.compuiactivation.dll  10.0.26100.7309  ComponentUiLauncher Shellcommon DLL
windowslivelogin.dll  10.0.26100.7309  Microsoft® Account Login Helper
windowsmanagementservicewinrt.proxystub.dll  10.0.26100.3624  WindowsManagementServiceWinRt Proxy Stub
windowsperformancerecordercontrol.dll  10.0.26100.7309  Microsoft Windows Performance Recorder Control Library
windowsprotectedprintconfiguration.dll  10.0.26100.7309  Windows Protected Print Configuration
windowsudk.shellcommon.dll  10.0.26100.8037  Windows Undocked Dev Kit Shellcommon DLL
windowsudkservices.shellcommon.dll  10.0.26100.8037  Windows Undocked Dev Kit Services Shellcommon DLL
winethc.dll  10.0.26100.7309  WinInet Helper Class
winhttp.dll  10.0.26100.7920  Windows HTTP Services
winhttpcom.dll  10.0.26100.7019  Windows COM interface for WinHttp
winhvemulation.dll  10.0.26100.7309  Hyper-V Instruction Emulator User-Mode API Library
winhvplatform.dll  10.0.26100.7920  Hyper-V Hypervisor User-Mode API Library
wini3c.dll  10.0.26100.7920  WinI3C Driver User-mode Library
wininet.dll  11.0.26100.7920  Internet Extensions for Win32
wininetlui.dll  10.0.26100.1882  Provides legacy UI for wininet
wininitext.dll  10.0.26100.7705  WinInit Utility Extension DLL
winipcfile.dll  10.0.26100.7309  Microsoft Active Directory Rights Management Services File API
winipcsecproc.dll  10.0.26100.7309  Microsoft Active Directory Rights Management Services Desktop Security Processor
winipsec.dll  10.0.26100.1  Windows IPsec SPD Client DLL
winlangdb.dll  10.0.26100.7309  Windows Bcp47 Language Database
winlogonext.dll  10.0.26100.7920  WinLogon Utility Extension DLL
winmde.dll  10.0.26100.7920  WinMDE DLL
winml.dll  10.0.26100.1150  Windows Machine Learning Runtime
winmm.dll  10.0.26100.7309  MCI API DLL
winmmbase.dll  10.0.26100.7920  Base Multimedia Extension API DLL
winmsipc.dll  10.0.26100.7309  Microsoft Active Directory Rights Management Services Client
winmsoirmprotector.dll  10.0.26100.1150  Windows Office file format IRM Protector
winnlsres.dll  10.0.26100.4484  NLSBuild resource DLL
winnsi.dll  10.0.26100.7920  Network Store Information RPC interface
winopcirmprotector.dll  10.0.26100.5074  Windows Office file format IRM Protector
winreagent.dll  10.0.26100.7920  Windows Recovery Environment Agent
winrnr.dll  10.0.26100.1882  LDAP RnR Provider DLL
winrscmd.dll  10.0.26100.7019  remtsvc
winrsmgr.dll  10.0.26100.7019  WSMan Shell API
winrssrv.dll  10.0.26100.7019  winrssrv
winrttracing.dll  10.0.26100.1150  Windows Diagnostics Tracing
winsatapi.dll  10.0.26100.7309  Windows System Assessment Tool API
winscard.dll  10.0.26100.7920  Microsoft Smart Card API
winshfhc.dll  10.0.26100.7309  File Risk Estimation
winsku.dll  10.0.26100.7705  Windows SKU Library
winsqlite3.dll  3.51.1.0  SQLite is a software library that implements a self-contained, serverless, zero-configuration, transactional SQL database engine.
winsrpc.dll  10.0.26100.1  WINS RPC LIBRARY
winsrv.dll  10.0.26100.7019  Multi-User Windows Server DLL
winsrvext.dll  10.0.26100.7920  Multi-User Windows Server Extension DLL
winsta.dll  10.0.26100.8036  Winstation Library
winsync.dll  2007.94.26100.1  Synchronization Framework
winsyncmetastore.dll  2007.94.26100.1  Windows Synchronization Metadata Store
winsyncproviders.dll  2007.94.26100.1  Windows Synchronization Provider Framework
wintrust.dll  10.0.26100.8036  Microsoft Trust Verification APIs
wintypes.dll  10.0.26100.7920  Windows Base Types DLL
winuicohabitation.dll    
winusb.dll  10.0.26100.1150  Windows USB Driver User Library
wirednetworkcsp.dll  10.0.26100.5074  WiredNetworkCSP
wirelessnetworkpreferencecsp.dll  10.0.26100.7920  WirelessNetworkPreferenceCSP
wisp.dll  10.0.26100.7920  Microsoft Pen and Touch Input Component
witnesswmiv2provider.dll  10.0.26100.1150  Witness Service WMIv2 Provider
wkscli.dll  10.0.26100.7019  Workstation Service Client DLL
wkspbrokerax.dll  10.0.26100.7309  Microsoft Workspace Broker ActiveX Control
wksprtps.dll  10.0.26100.1  WorkspaceRuntime ProxyStub DLL
wkssvc.dll  10.0.26100.7920  Workstation Service DLL
wlanapi.dll  10.0.26100.7920  Windows WLAN AutoConfig Client Side API DLL
wlancfg.dll  10.0.26100.7920  Wlan Netsh Helper DLL
wlandlg.dll  10.0.26100.5074  Wireless Lan Dialog Wizards
wlangpui.dll  10.0.26100.7920  Wireless Network Policy Management Snap-in
wlanhlp.dll  10.0.26100.7920  Windows Wireless LAN 802.11 Client Side Helper API
wlanmediamanager.dll  10.0.26100.7920  Windows WLAN Media Manager DLL
wlanmsm.dll  10.0.26100.7920  Windows Wireless LAN 802.11 MSM DLL
wlanpref.dll  10.0.26100.5074  Wireless Preferred Networks
wlanradiomanager.dll  10.0.26100.5074  Wlan Radio Manager
wlansec.dll  10.0.26100.7920  Windows Wireless LAN 802.11 MSM Security Module DLL
wlansvc.dll  10.0.26100.7920  Windows WLAN AutoConfig Service DLL
wlansvcpal.dll  10.0.26100.7920  Windows WLAN AutoConfig Service PAL DLL
wlanui.dll  10.0.26100.7309  Wireless Profile UI
wlanutil.dll  10.0.26100.1  Windows Wireless LAN 802.11 Utility DLL
wldap32.dll  10.0.26100.7920  Win32 LDAP API DLL
wldp.dll  10.0.26100.7920  Windows Lockdown Policy
wlgpclnt.dll  10.0.26100.7309  802.11 Group Policy Client
wlidcli.dll  10.0.26100.7920  Microsoft® Account Dynamic Link Library
wlidcredprov.dll  10.0.26100.7824  Microsoft® Account Credential Provider
wlidfdp.dll  10.0.26100.7309  Microsoft® Account Function Discovery Provider
wlidnsp.dll  10.0.26100.7309  Microsoft® Account Namespace Provider
wlidprov.dll  10.0.26100.7309  Microsoft® Account Provider
wlidres.dll  10.0.26100.1  Microsoft® Windows Live ID Resource
wlidsvc.dll  10.0.26100.8036  Microsoft® Account Service
wmadmod.dll  10.0.26100.7019  Windows Media Audio Decoder
wmadmoe.dll  10.0.26100.7019  Windows Media Audio 10 Encoder/Transcoder
wmalfxgfxdsp.dll  10.0.26100.7920  SysFx DSP
wmasf.dll  12.0.26100.7920  Windows Media ASF DLL
wmcodecdspps.dll  10.0.26100.3624  Windows Media CodecDSP Proxy Stub Dll
wmdmlog.dll  12.0.26100.5074  Windows Media Device Manager Logger
wmdmps.dll  12.0.26100.1150  Windows Media Device Manager Proxy Stub
wmdrmsdk.dll  10.0.26100.1  WMDRM backwards compatibility stub
wmerror.dll  12.0.26100.4202  Windows Media Error Definitions (English)
wmi.dll  10.0.26100.1  WMI DC and DP functionality
wmiclnt.dll  10.0.26100.1150  WMI Client API
wmidcom.dll  10.0.26100.1  WMI
wmidx.dll  12.0.26100.7920  Windows Media Indexer DLL
wmiprop.dll  10.0.26100.1  WDM Provider Dynamic Property Page CoInstaller
wmitomi.dll  10.0.26100.1150  CIM Provider Adapter
wmnetmgr.dll  12.0.26100.7920  Windows Media Network Plugin Manager DLL
wmp.dll  12.0.26100.7920  Windows Media Player
wmpdui.dll  12.0.26100.4202  Windows Media Player UI Engine
wmpdxm.dll  12.0.26100.7705  Windows Media Player Extension
wmpeffects.dll  12.0.26100.7705  Windows Media Player Effects
wmphoto.dll  10.0.26100.7019  Windows Media Photo Codec
wmploc.dll  12.0.26100.1882  Windows Media Player Legacy Resources
wmpps.dll  12.0.26100.3624  Windows Media Player Proxy Stub Dll
wmpshell.dll  12.0.26100.7705  Windows Media Player Legacy Launcher
wmsgapi.dll  10.0.26100.8036  WinLogon IPC Client
wmspdmod.dll  10.0.26100.7019  Windows Media Audio Voice Decoder
wmspdmoe.dll  10.0.26100.7019  Windows Media Audio Voice Encoder
wmvcore.dll  12.0.26100.7920  Windows Media Playback/Authoring DLL
wmvdecod.dll  10.0.26100.7920  Windows Media Video Decoder
wmvdspa.dll  10.0.26100.5074  Windows Media Video DSP Components - Advanced
wmvencod.dll  10.0.26100.7309  Windows Media Video 9 Encoder
wmvsdecd.dll  10.0.26100.7019  Windows Media Screen Decoder
wmvsencd.dll  10.0.26100.7019  Windows Media Screen Encoder
wmvxencd.dll  10.0.26100.7309  Windows Media Video Encoder
woftasks.dll  10.0.26100.4484  WIM Boot Tasks
wofutil.dll  10.0.26100.1  Windows Overlay File System Filter user mode API
wordbreakers.dll  10.0.26100.7309  "WordBreakers.DYNLINK"
workfolderscontrol.dll  10.0.26100.7309  Microsoft (C) Work Folders Control Panel
workfoldersgpext.dll  10.0.26100.5074  Microsoft (C) Work Folders Group Policy Client Extension
workfoldersres.dll  6.2.9200.16384  Work Folders Resources
workfoldersshell.dll  10.0.26100.7309  Microsoft (C) Work Folders Shell Extension
workfolderssvc.dll  10.0.26100.7309  Microsoft (C) Work Folders Service
wosc.dll  10.0.26100.8037  Windows OneSettings Client
wow64.dll  10.0.26100.7623  Win32 Emulation on NT64
wow64base.dll  10.0.26100.7623  Win32 Emulation on NT64
wow64con.dll  10.0.26100.7920  Wow64 Console and Win32 API Logging
wow64cpu.dll  10.0.26100.7922  AMD64 Wow64 CPU
wow64win.dll  10.0.26100.7920  Wow64 Console and Win32 API Logging
wpc.dll  10.0.26100.7920  WPC Settings Library
wpcapi.dll  10.0.26100.7920  WpcOtsApi.dll
wpcdesktopmonsvc.dll  10.0.26100.7920  WpcMonSvc.dll
wpcproxystubs.dll  10.0.26100.7309  Windows Parental Controls Proxy Stubs
wpcrefreshtask.dll  10.0.26100.7920  Family Safety Refresh Task
wpcwebfilter.dll  10.0.26100.7920  WpcWebFilter.dll
wpd_ci.dll  10.0.26100.7920  Driver Setup Class Installer for Windows Portable Devices
wpdbusenum.dll  10.0.26100.7920  Portable Device Enumerator
wpdshext.dll  10.0.26100.7920  Portable Devices Shell Extension
wpdshserviceobj.dll  10.0.26100.5074  Windows Portable Device Shell Service Object
wpdsp.dll  10.0.26100.7309  WMDM Service Provider for Windows Portable Devices
wpnapps.dll  10.0.26100.7920  Windows Push Notification Apps
wpnclient.dll  10.0.26100.7920  Windows Push Notifications Client
wpncore.dll  10.0.26100.7920  Windows Push Notification Core
wpninprc.dll  10.0.26100.7309  Windows Push Notification InProc
wpnprv.dll  10.0.26100.7920  Windows Push Notification Platform Connection Provider
wpnservice.dll  10.0.26100.7309  Windows Push Notification System Service
wpnsruprov.dll  10.0.26100.7705  SRUM provider for WPN
wpnuserservice.dll  10.0.26100.7309  Windows Push Notification User Service
wpportinglibrary.dll  10.0.26100.1  <d> DLL
wpprecorderum.dll  10.0.26100.7309  "WppRecorderUM.DYNLINK"
wptaskscheduler.dll  10.0.26100.3323  WP Task Scheduler DLL
wpx.dll  10.0.26100.7623  Windows Provisioning XML
ws2_32.dll  10.0.26100.7623  Windows Socket 2.0 32-Bit DLL
ws2help.dll  10.0.26100.7623  Windows Socket 2.0 Helper for Windows NT
wsaifabrichost.dll  10.0.26100.7920  WSAIFabricSvc
wscapi.dll  10.0.26100.7309  Windows Security Center API
wscinterop.dll  10.0.26100.3323  Windows Health Center WSC Interop
wscisvif.dll  10.0.26100.1882  Windows Security Center ISV API
wsclient.dll  10.0.26100.1  Microsoft Store Licensing Client
wscproxystub.dll  10.0.26100.1882  Windows Security Center ISV Proxy Stub
wscsvc.dll  10.0.26100.7309  Windows Security Center Service
wsdapi.dll  10.0.26100.7920  Web Services for Devices API DLL
wsdchngr.dll  10.0.26100.7705  WSD Challenge Component
wsdprintproxy.dll  10.0.26100.5074  Function Discovery Printer Proxy Dll
wsdproviderutil.dll  10.0.26100.5074  WsdProviderUtil dll
wsdscanproxy.dll  10.0.26100.5074  Function Discovery WSD Scanner Proxy Dll
wsecedit.dll  10.0.26100.7920  Security Configuration UI Module
wsepno.dll  7.0.26100.7309  Profile notification support for Windows Search Service
wshbth.dll  10.0.26100.5074  Windows Sockets Helper DLL
wshcon.dll  10.0.26100.7920  Microsoft ® Windows Script Controller
wshelper.dll  10.0.26100.4484  Winsock Net shell helper DLL for winsock
wshext.dll  10.0.26100.4768  Microsoft ® Shell Extension for Windows Script Host
wshhyperv.dll  10.0.26100.1  Hyper-V Winsock2 Helper DLL
wship6.dll  10.0.26100.1  Winsock2 Helper DLL (TL/IPv6)
wshqos.dll  10.0.26100.1150  QoS Winsock2 Helper DLL
wshrm.dll  10.0.26100.4202  Windows Sockets Helper DLL for PGM
wshtcpip.dll  10.0.26100.1  Winsock2 Helper DLL (TL/IPv4)
wshunix.dll  10.0.26100.1  AF_UNIX Winsock2 Helper DLL
wslapi.dll  10.0.26100.7309  Windows Subsystem for Linux API
wsmagent.dll  10.0.26100.7309  WinRM Agent
wsmanmigrationplugin.dll  10.0.26100.7309  WinRM Migration Plugin
wsmauto.dll  10.0.26100.7309  WSMAN Automation
wsmplpxy.dll  10.0.26100.7309  wsmplpxy
wsmres.dll  10.0.26100.7309  WSMan Resource DLL
wsmsvc.dll  10.0.26100.7920  WSMan Service
wsmwmipl.dll  10.0.26100.7309  WSMAN WMI Provider
wsnmp32.dll  10.0.26100.1150  Microsoft WinSNMP v2.0 Manager API
wsock32.dll  10.0.26100.1  Windows Socket 32-Bit DLL
wsp_fs.dll  10.0.26100.7920  Windows Storage Provider for FileShare management
wsp_health.dll  10.0.26100.7920  Windows Storage Provider for Health Agent API
wsp_sr.dll  10.0.26100.1882  Windows Storage Provider for Storage Replication management
wsplib.dll  10.0.26100.8036  WSP decode library
wtdccm.dll    
wtdhost.dll  10.0.26100.1882  WTD Framework Host Client
wtdsensor.dll  10.0.26100.1150  WTD Framework Sensor Client
wtsapi32.dll  10.0.26100.7920  Windows Remote Desktop Session Host Server SDK APIs
wuapi.dll  1451.2601.23012.0  Windows Update Client API
wuaueng.dll  1451.2601.23012.0  Windows Update Agent
wuceffects.dll  10.0.26100.7920  Microsoft Composition Effects
wudfcoinstaller.dll  10.0.26100.7309  Windows Driver Foundation - User-mode Platform Device Co-Installer
wudfplatform.dll  10.0.26100.7705  Windows Driver Foundation - User-mode Platform Library
wudfsmcclassext.dll  10.0.26100.7019  Smart Card Class Extension
wudfx.dll  10.0.26100.7309  WDF:UMDF Framework Library
wudfx02000.dll  10.0.26100.7920  WDF:UMDF Framework Library
wudriver.dll  10.0.26100.7920  Windows Update WUDriver Stub
wups.dll  1451.2601.23012.0  Windows Update client proxy stub
wups2.dll  1451.2601.23012.0  Windows Update client proxy stub 2
wusys.dll  10.0.26100.7920  Windows Update System Library
wvc.dll  1.0.0.1  Windows Visual Components
wwaapi.dll  10.0.26100.7309  Microsoft Web Application Host API library
wwaext.dll  10.0.26100.7309  Microsoft Web Application Host Extension library
wwanapi.dll  10.0.26100.7920  Mbnapi
wwancfg.dll  10.0.26100.7920  MBN Netsh Helper DLL
wwanprfl.dll  10.0.26100.7309  WWAN Profile Operations Binary
wwanprotdim.dll  10.0.26100.7920  WWAN Device Interface Module
wwanradiomanager.dll  10.0.26100.7309  Wwan Radio Manager
wwansvc.dll  10.0.26100.7920  WWAN Auto Config Service
wwapi.dll  10.0.26100.7920  WWAN API
xamltilerender.dll  10.0.26100.7824  "XamlTileRender.DYNLINK"
xaudio2_8.dll  10.0.26100.1  XAudio2 Game Audio API
xaudio2_9.dll  10.0.26100.7019  XAudio2 Game Audio API
xblauthmanager.dll  10.0.26100.7920  Xbox Live Auth Manager
xblauthmanagerproxy.dll  10.0.26100.7309  XblAuthManagerProxy
xblauthtokenbrokerext.dll  10.0.26100.7309  Xbox Live Token Broker Extension
xblgamesave.dll  10.0.26100.7920  Xbox Live Game Save Service
xblgamesaveext.dll  10.0.26100.7309  Microsoft XblGameSave Extension API
xblgamesaveproxy.dll  10.0.26100.4202  Xbox Live Game Save Service Proxies and Stubs
xboxgipradiomanager.dll  10.0.26100.5074  Xbox GIP Radio Manager
xboxgipsvc.dll  10.0.26100.7309  Xbox Gip Management Service
xboxgipsynthetic.dll    
xboxnetapisvc.dll  10.0.26100.5074  Xbox Live Networking Service
xinput1_4.dll  10.0.26100.7920  Microsoft Common Controller API
xinput9_1_0.dll  10.0.26100.1  XNA Common Controller
xinputuap.dll  10.0.26100.7309  Microsoft Common Controller API
xmlfilter.dll  2008.0.26100.7309  XML Filter
xmllite.dll  10.0.26100.7309  Microsoft XmlLite Library
xmlprovi.dll  10.0.26100.5074  Network Provisioning Service Client API
xolehlp.dll  2001.12.10941.16384  Microsoft Distributed Transaction Coordinator Helper APIs DLL
xpsdocumenttargetprint.dll  10.0.26100.7920  XPS DocumentTargetPrint DLL
xpsgdiconverter.dll  10.0.26100.7309  XPS to GDI Converter
xpsprint.dll  10.0.26100.7920  XPS Printing DLL
xpspushlayer.dll  10.0.26100.7309  Xps Push Layer Component
xpsrasterservice.dll  10.0.26100.7309  XPS Rasterization Service Component
xpsservices.dll  10.0.26100.7920  Xps Object Model in memory creation and deserialization
xpstopclmconverter.dll  10.0.26100.7705  XPS to PCLm Converter
xpstopwgrconverter.dll  10.0.26100.7309  XPS to PWGR Converter
xpstotiffconverter.dll  10.0.26100.7309  XPS To TIFF Converter
xwizards.dll  10.0.26100.5074  Extensible Wizards Manager Module
xwreg.dll  10.0.26100.1882  Extensible Wizard Registration Manager Module
xwtpdui.dll  10.0.26100.1882  Extensible Wizard Type Plugin for DUI
xwtpw32.dll  10.0.26100.1882  Extensible Wizard Type Plugin for Win32
zipcontainer.dll  10.0.26100.7019  Zip Container DLL
zipfldr.dll  10.0.26100.7920  Compressed (zipped) Folders
ztrace_maps.dll  10.0.26100.1882  ZTrace Event Resources


Certificates
 
[ Certificate Authorities / Microsoft Windows Hardware Compatibility ]
 
Certificate Properties:
Version  V3
Signature Algorithm  MD5 RSA (1.2.840.113549.1.1.4)
Serial Number  A0 69 FE 8F 9A 3F D1 11 8B 19
Validity  10/1/1997 - 12/31/2002
MD5 Hash  09C254BDE4EA50F26D1497F29C51AF6D
SHA1 Hash  109F1CAED645BB78B3EA2B94C0697C740733031C
 
Issuer Properties:
Organizational Unit  Copyright (c) 1997 Microsoft Corp.
Organizational Unit  Microsoft Corporation
 
Subject Properties:
Organizational Unit  Copyright (c) 1997 Microsoft Corp.
Organizational Unit  Microsoft Windows Hardware Compatibility Intermediate CA
Organizational Unit  Microsoft Corporation
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Certificate Authorities / Root Agency ]
 
Certificate Properties:
Version  V3
Signature Algorithm  MD5 RSA (1.2.840.113549.1.1.4)
Serial Number  F4 35 5C AA D4 B8 CF 11 8A 64 00 AA 00 6C 37 06
Validity  5/28/1996 - 12/31/2039
MD5 Hash  C0A723F0DA35026B21EDB17597F1D470
SHA1 Hash  FEE449EE0E3965A5246F000E87FDE2A065FD89D4
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Certificate Authorities / www.verisign.com/CPS Incorp.by Ref. LIABILITY LTD.(c)97 VeriSign ]
 
Certificate Properties:
Version  V3
Signature Algorithm  SHA1 RSA (1.2.840.113549.1.1.5)
Serial Number  8F 07 93 3F 23 98 60 92 0F 2F D0 B4 BA EB FC 46
Validity  4/16/1997 - 10/24/2016
MD5 Hash  ACD80EA27BB72CE700DC22724A5F1E92
SHA1 Hash  D559A586669B08F46A30A133F8A9ED3D038E2EA8
 
Issuer Properties:
Organization  VeriSign, Inc.
Country  United States
 
Subject Properties:
Organization  VeriSign Trust Network
Organizational Unit  VeriSign, Inc.
Organizational Unit  VeriSign International Server CA - Class 3
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / DigiCert ]
 
Certificate Properties:
Version  V3
Signature Algorithm  SHA1 RSA (1.2.840.113549.1.1.5)
Serial Number  39 30 F0 1B FC 60 E5 8F FE 46 D8 17 E5 E0 E7 0C
Validity  11/9/2006 - 11/9/2031
MD5 Hash  87CE0B7B2A0E4900E158719B37A89372
SHA1 Hash  0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43
 
Issuer Properties:
Organization  DigiCert Inc
Organizational Unit  www.digicert.com
Country  United States
 
Subject Properties:
Organization  DigiCert Inc
Organizational Unit  www.digicert.com
Country  United States
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / Microsoft Authenticode(tm) Root ]
 
Certificate Properties:
Version  V3
Signature Algorithm  MD5 RSA (1.2.840.113549.1.1.4)
Serial Number  01
Validity  1/1/1995 - 12/31/1999
MD5 Hash  DC6D6FAF897CDD17332FB5BA9035E9CE
SHA1 Hash  7F88CD7223F3C813818C994614A89C99FA3B5247
 
Issuer Properties:
Organization  MSFT
Country  United States
 
Subject Properties:
Organization  MSFT
Country  United States
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / Microsoft ECC Product Root Certificate Authority 2018 ]
 
Certificate Properties:
Version  V3
Signature Algorithm  1.2.840.10045.4.3.3
Serial Number  85 EC 99 B9 7B 67 53 40 8F CD 7C DC 66 26 98 14
Validity  2/27/2018 - 2/27/2043
MD5 Hash  1F124EDE13E06A023CD7C09A4F48C3D6
SHA1 Hash  06F1AA330B927B753A40E68CDF22E34BCBEF3352
 
Issuer Properties:
Organization  Microsoft Corporation
Country  United States
Locality Name  Redmond
State/Province  Washington
 
Subject Properties:
Organization  Microsoft Corporation
Country  United States
Locality Name  Redmond
State/Province  Washington
 
Public Key Properties:
Public Key Algorithm  1.2.840.10045.2.1
 
[ Root Certificates / Microsoft ECC TS Root Certificate Authority 2018 ]
 
Certificate Properties:
Version  V3
Signature Algorithm  1.2.840.10045.4.3.3
Serial Number  45 82 12 41 AF EF B4 47 B0 D1 7E 64 E1 75 38 15
Validity  2/27/2018 - 2/27/2043
MD5 Hash  37942958862A06E6BBCFD7AB59C7F23C
SHA1 Hash  31F9FC8BA3805986B721EA7295C65B3A44534274
 
Issuer Properties:
Organization  Microsoft Corporation
Country  United States
Locality Name  Redmond
State/Province  Washington
 
Subject Properties:
Organization  Microsoft Corporation
Country  United States
Locality Name  Redmond
State/Province  Washington
 
Public Key Properties:
Public Key Algorithm  1.2.840.10045.2.1
 
[ Root Certificates / Microsoft Root Authority ]
 
Certificate Properties:
Version  V3
Signature Algorithm  MD5 RSA (1.2.840.113549.1.1.4)
Serial Number  40 DF EC 63 F6 3E D1 11 88 3C 3C 8B 00 C1 00
Validity  1/10/1997 - 12/31/2020
MD5 Hash  2A954ECA79B2874573D92D90BAF99FB6
SHA1 Hash  A43489159A520F0D93D032CCAF37E7FE20A8B419
 
Issuer Properties:
Organizational Unit  Copyright (c) 1997 Microsoft Corp.
Organizational Unit  Microsoft Corporation
 
Subject Properties:
Organizational Unit  Copyright (c) 1997 Microsoft Corp.
Organizational Unit  Microsoft Corporation
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / Microsoft Root Certificate Authority 2010 ]
 
Certificate Properties:
Version  V3
Signature Algorithm  SHA256 RSA (1.2.840.113549.1.1.11)
Serial Number  AA 39 43 6B 58 9B 9A 44 AC 44 BA BF 25 3A CC 28
Validity  6/23/2010 - 6/23/2035
MD5 Hash  A266BB7DCC38A562631361BBF61DD11B
SHA1 Hash  3B1EFD3A66EA28B16697394703A72CA340A05BD5
 
Issuer Properties:
Organization  Microsoft Corporation
Country  United States
Locality Name  Redmond
State/Province  Washington
 
Subject Properties:
Organization  Microsoft Corporation
Country  United States
Locality Name  Redmond
State/Province  Washington
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / Microsoft Root Certificate Authority 2011 ]
 
Certificate Properties:
Version  V3
Signature Algorithm  SHA256 RSA (1.2.840.113549.1.1.11)
Serial Number  44 E1 42 6C D6 69 B5 43 96 B2 9F FC B5 C8 8B 3F
Validity  3/22/2011 - 3/22/2036
MD5 Hash  CE0490D5E56C34A5AE0BE98BE581185D
SHA1 Hash  8F43288AD272F3103B6FB1428485EA3014C0BCFE
 
Issuer Properties:
Organization  Microsoft Corporation
Country  United States
Locality Name  Redmond
State/Province  Washington
 
Subject Properties:
Organization  Microsoft Corporation
Country  United States
Locality Name  Redmond
State/Province  Washington
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / Microsoft Root Certificate Authority ]
 
Certificate Properties:
Version  V3
Signature Algorithm  SHA1 RSA (1.2.840.113549.1.1.5)
Serial Number  65 2E 13 07 F4 58 73 4C AD A5 A0 4A A1 16 AD 79
Validity  5/9/2001 - 5/9/2021
MD5 Hash  E1C07EA0AABBD4B77B84C228117808A7
SHA1 Hash  CDD4EEAE6000AC7F40C3802C171E30148030C072
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / Microsoft Time Stamp Root Certificate Authority 2014 ]
 
Certificate Properties:
Version  V3
Signature Algorithm  SHA256 RSA (1.2.840.113549.1.1.11)
Serial Number  66 74 E2 3E 34 53 E9 45 90 32 93 22 43 7A D6 2F
Validity  10/22/2014 - 10/22/2039
MD5 Hash  34F72698D70E231F8DC45B57F118A44B
SHA1 Hash  0119E81BE9A14CD8E22F40AC118C687ECBA3F4D8
 
Issuer Properties:
Organization  Microsoft Corporation
Country  United States
Locality Name  Redmond
State/Province  Washington
 
Subject Properties:
Organization  Microsoft Corporation
Country  United States
Locality Name  Redmond
State/Province  Washington
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / Microsoft Timestamp Root ]
 
Certificate Properties:
Version  V1
Signature Algorithm  MD5 RSA (1.2.840.113549.1.1.4)
Serial Number  01
Validity  5/13/1997 - 12/30/1999
MD5 Hash  556EBEF54C1D7C0360C43418BC9649C1
SHA1 Hash  245C97DF7514E7CF2DF8BE72AE957B9E04741E85
 
Issuer Properties:
Organization  Microsoft Trust Network
Organizational Unit  Microsoft Corporation
Organizational Unit  Microsoft Time Stamping Service Root
 
Subject Properties:
Organization  Microsoft Trust Network
Organizational Unit  Microsoft Corporation
Organizational Unit  Microsoft Time Stamping Service Root
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / Symantec Enterprise Mobile Root for Microsoft ]
 
Certificate Properties:
Version  V3
Signature Algorithm  SHA256 RSA (1.2.840.113549.1.1.11)
Serial Number  CE D8 F4 BD A9 29 66 0F 7B 90 BF 9E 2F 55 6B 0F
Validity  3/14/2012 - 3/14/2032
MD5 Hash  71D0A5FF2D59741694BEE37D1E5C860B
SHA1 Hash  92B46C76E13054E104F230517E6E504D43AB10B5
 
Issuer Properties:
Organization  Symantec Corporation
Country  United States
 
Subject Properties:
Organization  Symantec Corporation
Country  United States
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / Thawte Timestamping CA ]
 
Certificate Properties:
Version  V3
Signature Algorithm  MD5 RSA (1.2.840.113549.1.1.4)
Serial Number  00
Validity  12/31/1996 - 12/31/2020
MD5 Hash  7F667A71D3EB6978209A51149D83DA20
SHA1 Hash  BE36A4562FB2EE05DBB3D32323ADF445084ED656
 
Issuer Properties:
Organization  Thawte
Organizational Unit  Thawte Certification
Country  South Africa
Locality Name  Durbanville
State/Province  Western Cape
 
Subject Properties:
Organization  Thawte
Organizational Unit  Thawte Certification
Country  South Africa
Locality Name  Durbanville
State/Province  Western Cape
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / VeriSign Class 3 Primary CA ]
 
Certificate Properties:
Version  V1
Signature Algorithm  MD2 RSA (1.2.840.113549.1.1.2)
Serial Number  32 02 24 A4 19 3E 11 A5 CF 0E E8 3A F3 FD 9E E4 00
Validity  1/28/1996 - 1/7/2004
MD5 Hash  782A02DFDB2E14D5A75F0ADFB68E9C5D
SHA1 Hash  4F65566336DB6598581D584A596C87934D5F2AB4
 
Issuer Properties:
Organization  VeriSign, Inc.
Country  United States
 
Subject Properties:
Organization  VeriSign, Inc.
Country  United States
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / VeriSign Class 3 Public Primary CA ]
 
Certificate Properties:
Version  V1
Signature Algorithm  MD2 RSA (1.2.840.113549.1.1.2)
Serial Number  BF BA CC 03 7B CA 38 B6 34 29 D9 10 1D E4 BA 70
Validity  1/28/1996 - 8/1/2028
MD5 Hash  10FC635DF6263E0DF325BE5F79CD6767
SHA1 Hash  742C3192E607E424EB4549542BE1BBC53E6174E2
 
Issuer Properties:
Organization  VeriSign, Inc.
Country  United States
 
Subject Properties:
Organization  VeriSign, Inc.
Country  United States
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)
 
[ Root Certificates / VeriSign Time Stamping CA ]
 
Certificate Properties:
Version  V1
Signature Algorithm  MD5 RSA (1.2.840.113549.1.1.4)
Serial Number  A3 DC 5D 15 5F 73 5D A5 1C 59 82 8C 38 D2 19 4A
Validity  5/11/1997 - 1/7/2004
MD5 Hash  EBB04F1D3A2E372F1DDA6E27D6B680FA
SHA1 Hash  18F7C1FCC3090203FD5BAA2F861A754976C8DD25
 
Issuer Properties:
Organization  VeriSign Trust Network
Organizational Unit  VeriSign, Inc.
Organizational Unit  VeriSign Time Stamping Service Root
Organizational Unit  NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
 
Subject Properties:
Organization  VeriSign Trust Network
Organizational Unit  VeriSign, Inc.
Organizational Unit  VeriSign Time Stamping Service Root
Organizational Unit  NO LIABILITY ACCEPTED, (c)97 VeriSign, Inc.
 
Public Key Properties:
Public Key Algorithm  RSA (1.2.840.113549.1.1.1)


UpTime
 
Current Session:
Last Shutdown Time  12/30/1899
Last Boot Time  12/30/1899
Current Time  7/13/2026 5:31:51 PM
UpTime  0 sec (0 days, 0 hours, 0 min, 0 sec)
 
UpTime Statistics:
First Boot Time  12/30/1899
First Shutdown Time  12/30/1899
Total UpTime  0 sec (0 days, 0 hours, 0 min, 0 sec)
Total DownTime  0 sec (0 days, 0 hours, 0 min, 0 sec)
Longest UpTime  0 sec (0 days, 0 hours, 0 min, 0 sec)
Longest DownTime  0 sec (0 days, 0 hours, 0 min, 0 sec)
Total Reboots  0
 
Bluescreen Statistics:
Total Bluescreens  0
 
Information:
Information  The above statistics are based on System Event Log entries


Share
 
Share Name  Type  Remark  Local Path
ADMIN$  Folder  Remote Admin  C:\WINDOWS
C$  Folder  Default share  C:\
IPC$  IPC  Remote IPC  


Account Security
 
Account Security Properties:
Computer Role  Primary
Domain Name  DESKTOP-M1V6K8T
Primary Domain Controller  Not Specified
Forced Logoff Time  Disabled
Min / Max Password Age  0 / 42 days
Minimum Password Length  0 chars
Password History Length  Disabled
Lockout Threshold  10 attempts
Lockout Duration  10 min
Lockout Observation Window  10 min


Logon
 
User  Full Name  Logon Server  Logon Domain
Marius    DESKTOP-M1V6K8T  DESKTOP-M1V6K8T
Marius    DESKTOP-M1V6K8T  DESKTOP-M1V6K8T


Users
 
[ Administrator ]
 
User Properties:
User Name  Administrator
Full Name  Administrator
Comment  Built-in account for administering the computer/domain
Member Of Groups  Administrators
Logon Count  0
Disk Quota  -
 
User Features:
Logon Script Executed  Yes
Account Disabled  Yes
Locked Out User  No
Home Folder Required  No
Password Required  Yes
Read-Only Password  No
Password Never Expires  Yes
 
[ DefaultAccount ]
 
User Properties:
User Name  DefaultAccount
Full Name  DefaultAccount
Comment  A user account managed by the system.
Member Of Groups  System Managed Accounts Group
Logon Count  0
Disk Quota  -
 
User Features:
Logon Script Executed  Yes
Account Disabled  Yes
Locked Out User  No
Home Folder Required  No
Password Required  No
Read-Only Password  No
Password Never Expires  Yes
 
[ Guest ]
 
User Properties:
User Name  Guest
Full Name  Guest
Comment  Built-in account for guest access to the computer/domain
Member Of Groups  Guests
Logon Count  0
Disk Quota  -
 
User Features:
Logon Script Executed  Yes
Account Disabled  Yes
Locked Out User  No
Home Folder Required  No
Password Required  No
Read-Only Password  Yes
Password Never Expires  Yes
 
[ Marius ]
 
User Properties:
User Name  Marius
Full Name  Marius
Member Of Groups  Administrators
Logon Count  3
Disk Quota  -
 
User Features:
Logon Script Executed  Yes
Account Disabled  No
Locked Out User  No
Home Folder Required  No
Password Required  No
Read-Only Password  No
Password Never Expires  Yes
 
[ WDAGUtilityAccount ]
 
User Properties:
User Name  WDAGUtilityAccount
Full Name  WDAGUtilityAccount
Comment  A user account managed and used by the system for Windows Defender Application Guard scenarios.
Logon Count  0
Disk Quota  -
 
User Features:
Logon Script Executed  Yes
Account Disabled  Yes
Locked Out User  No
Home Folder Required  No
Password Required  Yes
Read-Only Password  No
Password Never Expires  No


Local Groups
 
[ Administrators ]
 
Local Group Properties:
Comment  Administrators have complete and unrestricted access to the computer/domain
 
Group Members:
Administrator  
Marius  
 
[ Device Owners ]
 
Local Group Properties:
Comment  Members of this group can change system-wide settings.
 
[ Distributed COM Users ]
 
Local Group Properties:
Comment  Members are allowed to launch, activate and use Distributed COM objects on this machine.
 
[ Event Log Readers ]
 
Local Group Properties:
Comment  Members of this group can read event logs from local machine
 
[ Guests ]
 
Local Group Properties:
Comment  Guests have the same access as members of the Users group by default, except for the Guest account which is further restricted
 
Group Members:
Guest  
 
[ Hyper-V Administrators ]
 
Local Group Properties:
Comment  Members of this group have complete and unrestricted access to all features of Hyper-V.
 
[ IIS_IUSRS ]
 
Local Group Properties:
Comment  Built-in group used by Internet Information Services.
 
Group Members:
IUSR  
 
[ OpenSSH Users ]
 
Local Group Properties:
Comment  Members of this group may connect to this computer using SSH.
 
[ Performance Log Users ]
 
Local Group Properties:
Comment  Members of this group may schedule logging of performance counters, enable trace providers, and collect event traces both locally and via remote access to this computer
 
[ Performance Monitor Users ]
 
Local Group Properties:
Comment  Members of this group can access performance counter data locally and remotely
 
[ Remote Management Users ]
 
Local Group Properties:
Comment  Members of this group can access WMI resources over management protocols (such as WS-Management via the Windows Remote Management service). This applies only to WMI namespaces that grant access to the user.
 
[ System Managed Accounts Group ]
 
Local Group Properties:
Comment  Members of this group are managed by the system.
 
Group Members:
DefaultAccount  
 
[ User Mode Hardware Operators ]
 
Local Group Properties:
Comment  Members of this group may operate hardware from user mode.
 
[ Users ]
 
Local Group Properties:
Comment  Users are prevented from making accidental or intentional system-wide changes and can run most applications
 
Group Members:
Authenticated Users  
INTERACTIVE  


Global Groups
 
[ None ]
 
Global Group Properties:
Comment  Ordinary users
 
Group Members:
Administrator  
DefaultAccount  
Guest  
Marius  
WDAGUtilityAccount  


Windows Video
 
[ Microsoft Basic Display Adapter ]
 
Video Adapter Properties:
Device Description  Microsoft Basic Display Adapter
Adapter String  Microsoft Basic Display Adapter
Device ID  PCI\CC_0300
Driver Date  6/20/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  display.inf
INF Section  MSBDA


GPU
 
[ Integrated: Intel Arrow Lake-HX/S - Integrated Graphics Controller ]
 
Graphics Processor Properties:
Video Adapter  Intel Arrow Lake-HX/S - Integrated Graphics Controller
GPU Code Name  Arrow Lake-HX/S
PCI Device  8086-7D67 / 103C-8D17 (Rev 06)
Process Technology  5 nm
Bus Type  Integrated
GPU Clock  250 MHz
GPU Clock (Turbo)  250 - 1800 MHz
RAMDAC Clock  350 MHz
WDDM Version  WDDM 1.3
 
Architecture:
Architecture  Intel Gen12.7
 
Utilization:
Dynamic Memory  0 MB
 
Graphics Processor Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/products/chipsets
Driver Download  https://www.intel.com/support/graphics
Driver Update  http://www.aida64.com/goto/?p=drvupdates


Monitor
 
[ Lenovo ThinkVision P24h-10 ]
 
Monitor Properties:
Monitor Name  Lenovo ThinkVision P24h-10
Monitor ID  LEN61AE
Model  P24h-10
Monitor Type  23.8" IPS LCD (WQHD)
Manufacture Date  Week 16 / 2019
Serial Number  291616843009
Max. Visible Display Size  527 mm x 296 mm (23.8")
Picture Aspect Ratio  16:9
Brightness  300 cd/m2
Contrast Ratio  1000:1
Viewing Angles  178/178°
Input Connectors  HDMI, DisplayPort
Horizontal Frequency  30 - 112 kHz
Vertical Frequency  49 - 76 Hz
Maximum Pixel Clock  300 MHz
Maximum Resolution  2560 x 1440
Pixel Density  123 ppi
Gamma  2.20
DPMS Mode Support  Active-Off
 
Supported Video Modes:
640 x 480  60 Hz
720 x 400  70 Hz
800 x 600  60 Hz
1024 x 768  60 Hz
1280 x 1024  60 Hz
1440 x 900  60 Hz
1600 x 900  60 Hz
1680 x 1050  60 Hz
1920 x 1080  60 Hz
1920 x 1080  Pixel Clock: 148.50 MHz
1920 x 1200  60 Hz
2560 x 1440  Pixel Clock: 241.50 MHz


Desktop
 
Desktop Properties:
Device Technology  Raster Display
Resolution  1920 x 1080
Color Depth  32-bit
Color Planes  1
Font Resolution  96 dpi (100 %)
Text Scaling Factor  100 %
Taskbar Button Combining  Always, hide labels
Pixel Width / Height  36 / 36
Pixel Diagonal  51
Vertical Refresh Rate  64 Hz
Desktop Wallpaper  C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\DesktopSpotlight\Assets\Images\image_1.jpg
 
Desktop Effects:
Combo-Box Animation  Enabled
Dark Mode  Disabled
Drop Shadow Effect  Enabled
Flat Menu Effect  Enabled
Font Smoothing  Enabled
ClearType  Enabled
Full Window Dragging  Enabled
Gradient Window Title Bars  Enabled
Hide Menu Access Keys  Enabled
Hot Tracking Effect  Enabled
Icon Title Wrapping  Enabled
List-Box Smooth Scrolling  Enabled
Menu Animation  Enabled
Menu Fade Effect  Enabled
Minimize/Restore Animation  Enabled
Mouse Cursor Shadow  Disabled
Selection Fade Effect  Enabled
ShowSounds Accessibility Feature  Disabled
Small Taskbar Buttons  Disabled
Taskbar Button Badges  Enabled
Taskbar Locked  Yes
ToolTip Animation  Enabled
ToolTip Fade Effect  Enabled
Windows Aero  Enabled
Windows Plus! Extension  Disabled


Multi-Monitor
 
Device ID  Primary  Upper Left Corner  Bottom Right Corner
\\.\DISPLAY1  Yes  (0,0)  (1920,1080)


Video Modes
 
Resolution  Color Depth  Refresh Rate
1920 x 1080  32-bit  64 Hz


OpenGL
 
OpenGL Properties:
Vendor  Microsoft Corporation
Renderer  GDI Generic
Version  1.1.0
OpenGL DLL  10.0.26100.7920(WinBuild.160101.0800)
Sub-Pixel Precision  3-bit
Max Viewport Size  16384 x 16384
Max Clipping Planes  6
Max Display-List Nesting Level  64
Max Evaluator Order  30
Max Light Sources  8
Max Pixel Map Table Size  65536
 
OpenGL Compliancy:
OpenGL 1.1  Yes (100%)
OpenGL 1.2  No (12%)
OpenGL 1.3  No (0%)
OpenGL 1.4  No (0%)
OpenGL 1.5  No (0%)
OpenGL 2.0  No (0%)
OpenGL 2.1  No (0%)
OpenGL 3.0  No (0%)
OpenGL 3.1  No (0%)
OpenGL 3.2  No (0%)
OpenGL 3.3  No (0%)
OpenGL 4.0  No (0%)
OpenGL 4.1  No (0%)
OpenGL 4.2  No (0%)
OpenGL 4.3  No (0%)
OpenGL 4.4  No (0%)
OpenGL 4.5  No (0%)
OpenGL 4.6  No (0%)
 
Max Stack Depth:
Attribute Stack  16
Client Attribute Stack  16
Modelview Matrix Stack  32
Name Stack  128
Projection Matrix Stack  10
Texture Matrix Stack  10
 
OpenGL Extensions:
Total / Supported Extensions  1101 / 3
GL_3DFX_multisample  Not Supported
GL_3DFX_tbuffer  Not Supported
GL_3DFX_texture_compression_FXT1  Not Supported
GL_3DL_direct_texture_access2  Not Supported
GL_3Dlabs_multisample_transparency_id  Not Supported
GL_3Dlabs_multisample_transparency_range  Not Supported
GL_AMD_blend_minmax_factor  Not Supported
GL_AMD_compressed_3DC_texture  Not Supported
GL_AMD_compressed_ATC_texture  Not Supported
GL_AMD_conservative_depth  Not Supported
GL_AMD_debug_output  Not Supported
GL_AMD_depth_clamp_separate  Not Supported
GL_AMD_draw_buffers_blend  Not Supported
GL_AMD_framebuffer_sample_positions  Not Supported
GL_AMD_gcn_shader  Not Supported
GL_AMD_gpu_shader_half_float  Not Supported
GL_AMD_gpu_shader_half_float_fetch  Not Supported
GL_AMD_gpu_shader_half_float2  Not Supported
GL_AMD_gpu_shader_int16  Not Supported
GL_AMD_gpu_shader_int64  Not Supported
GL_AMD_interleaved_elements  Not Supported
GL_AMD_multi_draw_indirect  Not Supported
GL_AMD_name_gen_delete  Not Supported
GL_AMD_occlusion_query_event  Not Supported
GL_AMD_performance_monitor  Not Supported
GL_AMD_pinned_memory  Not Supported
GL_AMD_program_binary_Z400  Not Supported
GL_AMD_query_buffer_object  Not Supported
GL_AMD_sample_positions  Not Supported
GL_AMD_seamless_cubemap_per_texture  Not Supported
GL_AMD_shader_atomic_counter_ops  Not Supported
GL_AMD_shader_stencil_export  Not Supported
GL_AMD_shader_stencil_value_export  Not Supported
GL_AMD_shader_trace  Not Supported
GL_AMD_shader_trinary_minmax  Not Supported
GL_AMD_sparse_texture  Not Supported
GL_AMD_sparse_texture_pool  Not Supported
GL_AMD_stencil_operation_extended  Not Supported
GL_AMD_texture_compression_dxt6  Not Supported
GL_AMD_texture_compression_dxt7  Not Supported
GL_AMD_texture_cube_map_array  Not Supported
GL_AMD_texture_texture4  Not Supported
GL_AMD_texture_tile_pool  Not Supported
GL_AMD_transform_feedback3_lines_triangles  Not Supported
GL_AMD_transform_feedback4  Not Supported
GL_AMD_vertex_shader_layer  Not Supported
GL_AMD_vertex_shader_tessellator  Not Supported
GL_AMD_vertex_shader_viewport_index  Not Supported
GL_AMDX_debug_output  Not Supported
GL_AMDX_name_gen_delete  Not Supported
GL_AMDX_random_access_target  Not Supported
GL_AMDX_vertex_shader_tessellator  Not Supported
GL_ANDROID_extension_pack_es31a  Not Supported
GL_ANGLE_depth_texture  Not Supported
GL_ANGLE_framebuffer_blit  Not Supported
GL_ANGLE_framebuffer_multisample  Not Supported
GL_ANGLE_instanced_arrays  Not Supported
GL_ANGLE_pack_reverse_row_order  Not Supported
GL_ANGLE_program_binary  Not Supported
GL_ANGLE_texture_compression_dxt1  Not Supported
GL_ANGLE_texture_compression_dxt3  Not Supported
GL_ANGLE_texture_compression_dxt5  Not Supported
GL_ANGLE_texture_usage  Not Supported
GL_ANGLE_translated_shader_source  Not Supported
GL_APPLE_aux_depth_stencil  Not Supported
GL_APPLE_client_storage  Not Supported
GL_APPLE_copy_texture_levels  Not Supported
GL_APPLE_element_array  Not Supported
GL_APPLE_fence  Not Supported
GL_APPLE_float_pixels  Not Supported
GL_APPLE_flush_buffer_range  Not Supported
GL_APPLE_flush_render  Not Supported
GL_APPLE_framebuffer_multisample  Not Supported
GL_APPLE_object_purgeable  Not Supported
GL_APPLE_packed_pixel  Not Supported
GL_APPLE_packed_pixels  Not Supported
GL_APPLE_pixel_buffer  Not Supported
GL_APPLE_rgb_422  Not Supported
GL_APPLE_row_bytes  Not Supported
GL_APPLE_specular_vector  Not Supported
GL_APPLE_sync  Not Supported
GL_APPLE_texture_2D_limited_npot  Not Supported
GL_APPLE_texture_format_BGRA8888  Not Supported
GL_APPLE_texture_max_level  Not Supported
GL_APPLE_texture_range  Not Supported
GL_APPLE_transform_hint  Not Supported
GL_APPLE_vertex_array_object  Not Supported
GL_APPLE_vertex_array_range  Not Supported
GL_APPLE_vertex_point_size  Not Supported
GL_APPLE_vertex_program_evaluators  Not Supported
GL_APPLE_ycbcr_422  Not Supported
GL_ARB_arrays_of_arrays  Not Supported
GL_ARB_base_instance  Not Supported
GL_ARB_bindless_texture  Not Supported
GL_ARB_blend_func_extended  Not Supported
GL_ARB_buffer_storage  Not Supported
GL_ARB_cl_event  Not Supported
GL_ARB_clear_buffer_object  Not Supported
GL_ARB_clear_texture  Not Supported
GL_ARB_clip_control  Not Supported
GL_ARB_color_buffer_float  Not Supported
GL_ARB_compatibility  Not Supported
GL_ARB_compressed_texture_pixel_storage  Not Supported
GL_ARB_compute_shader  Not Supported
GL_ARB_compute_variable_group_size  Not Supported
GL_ARB_conditional_render_inverted  Not Supported
GL_ARB_conservative_depth  Not Supported
GL_ARB_context_flush_control  Not Supported
GL_ARB_copy_buffer  Not Supported
GL_ARB_copy_image  Not Supported
GL_ARB_cull_distance  Not Supported
GL_ARB_debug_group  Not Supported
GL_ARB_debug_label  Not Supported
GL_ARB_debug_output  Not Supported
GL_ARB_debug_output2  Not Supported
GL_ARB_depth_buffer_float  Not Supported
GL_ARB_depth_clamp  Not Supported
GL_ARB_depth_texture  Not Supported
GL_ARB_derivative_control  Not Supported
GL_ARB_direct_state_access  Not Supported
GL_ARB_draw_buffers  Not Supported
GL_ARB_draw_buffers_blend  Not Supported
GL_ARB_draw_elements_base_vertex  Not Supported
GL_ARB_draw_indirect  Not Supported
GL_ARB_draw_instanced  Not Supported
GL_ARB_enhanced_layouts  Not Supported
GL_ARB_ES2_compatibility  Not Supported
GL_ARB_ES3_1_compatibility  Not Supported
GL_ARB_ES3_2_compatibility  Not Supported
GL_ARB_ES3_compatibility  Not Supported
GL_ARB_explicit_attrib_location  Not Supported
GL_ARB_explicit_uniform_location  Not Supported
GL_ARB_fragment_coord_conventions  Not Supported
GL_ARB_fragment_layer_viewport  Not Supported
GL_ARB_fragment_program  Not Supported
GL_ARB_fragment_program_shadow  Not Supported
GL_ARB_fragment_shader  Not Supported
GL_ARB_fragment_shader_interlock  Not Supported
GL_ARB_framebuffer_no_attachments  Not Supported
GL_ARB_framebuffer_object  Not Supported
GL_ARB_framebuffer_sRGB  Not Supported
GL_ARB_geometry_shader4  Not Supported
GL_ARB_get_program_binary  Not Supported
GL_ARB_get_texture_sub_image  Not Supported
GL_ARB_gl_spirv  Not Supported
GL_ARB_gpu_shader_fp64  Not Supported
GL_ARB_gpu_shader_int64  Not Supported
GL_ARB_gpu_shader5  Not Supported
GL_ARB_half_float_pixel  Not Supported
GL_ARB_half_float_vertex  Not Supported
GL_ARB_imaging  Not Supported
GL_ARB_indirect_parameters  Not Supported
GL_ARB_instanced_arrays  Not Supported
GL_ARB_internalformat_query  Not Supported
GL_ARB_internalformat_query2  Not Supported
GL_ARB_invalidate_subdata  Not Supported
GL_ARB_make_current_read  Not Supported
GL_ARB_map_buffer_alignment  Not Supported
GL_ARB_map_buffer_range  Not Supported
GL_ARB_matrix_palette  Not Supported
GL_ARB_multi_bind  Not Supported
GL_ARB_multi_draw_indirect  Not Supported
GL_ARB_multisample  Not Supported
GL_ARB_multitexture  Not Supported
GL_ARB_occlusion_query  Not Supported
GL_ARB_occlusion_query2  Not Supported
GL_ARB_parallel_shader_compile  Not Supported
GL_ARB_pipeline_statistics_query  Not Supported
GL_ARB_pixel_buffer_object  Not Supported
GL_ARB_point_parameters  Not Supported
GL_ARB_point_sprite  Not Supported
GL_ARB_polygon_offset_clamp  Not Supported
GL_ARB_post_depth_coverage  Not Supported
GL_ARB_program_interface_query  Not Supported
GL_ARB_provoking_vertex  Not Supported
GL_ARB_query_buffer_object  Not Supported
GL_ARB_robust_buffer_access_behavior  Not Supported
GL_ARB_robustness  Not Supported
GL_ARB_robustness_isolation  Not Supported
GL_ARB_sample_locations  Not Supported
GL_ARB_sample_shading  Not Supported
GL_ARB_sampler_objects  Not Supported
GL_ARB_seamless_cube_map  Not Supported
GL_ARB_seamless_cubemap_per_texture  Not Supported
GL_ARB_separate_shader_objects  Not Supported
GL_ARB_shader_atomic_counter_ops  Not Supported
GL_ARB_shader_atomic_counters  Not Supported
GL_ARB_shader_ballot  Not Supported
GL_ARB_shader_bit_encoding  Not Supported
GL_ARB_shader_clock  Not Supported
GL_ARB_shader_draw_parameters  Not Supported
GL_ARB_shader_group_vote  Not Supported
GL_ARB_shader_image_load_store  Not Supported
GL_ARB_shader_image_size  Not Supported
GL_ARB_shader_objects  Not Supported
GL_ARB_shader_precision  Not Supported
GL_ARB_shader_stencil_export  Not Supported
GL_ARB_shader_storage_buffer_object  Not Supported
GL_ARB_shader_subroutine  Not Supported
GL_ARB_shader_texture_image_samples  Not Supported
GL_ARB_shader_texture_lod  Not Supported
GL_ARB_shader_viewport_layer_array  Not Supported
GL_ARB_shading_language_100  Not Supported
GL_ARB_shading_language_120  Not Supported
GL_ARB_shading_language_420pack  Not Supported
GL_ARB_shading_language_include  Not Supported
GL_ARB_shading_language_packing  Not Supported
GL_ARB_shadow  Not Supported
GL_ARB_shadow_ambient  Not Supported
GL_ARB_sparse_buffer  Not Supported
GL_ARB_sparse_texture  Not Supported
GL_ARB_sparse_texture_clamp  Not Supported
GL_ARB_sparse_texture2  Not Supported
GL_ARB_spirv_extensions  Not Supported
GL_ARB_stencil_texturing  Not Supported
GL_ARB_swap_buffers  Not Supported
GL_ARB_sync  Not Supported
GL_ARB_tessellation_shader  Not Supported
GL_ARB_texture_barrier  Not Supported
GL_ARB_texture_border_clamp  Not Supported
GL_ARB_texture_buffer_object  Not Supported
GL_ARB_texture_buffer_object_rgb32  Not Supported
GL_ARB_texture_buffer_range  Not Supported
GL_ARB_texture_compression  Not Supported
GL_ARB_texture_compression_bptc  Not Supported
GL_ARB_texture_compression_rgtc  Not Supported
GL_ARB_texture_compression_rtgc  Not Supported
GL_ARB_texture_cube_map  Not Supported
GL_ARB_texture_cube_map_array  Not Supported
GL_ARB_texture_env_add  Not Supported
GL_ARB_texture_env_combine  Not Supported
GL_ARB_texture_env_crossbar  Not Supported
GL_ARB_texture_env_dot3  Not Supported
GL_ARB_texture_filter_anisotropic  Not Supported
GL_ARB_texture_filter_minmax  Not Supported
GL_ARB_texture_float  Not Supported
GL_ARB_texture_gather  Not Supported
GL_ARB_texture_mirror_clamp_to_edge  Not Supported
GL_ARB_texture_mirrored_repeat  Not Supported
GL_ARB_texture_multisample  Not Supported
GL_ARB_texture_multisample_no_array  Not Supported
GL_ARB_texture_non_power_of_two  Not Supported
GL_ARB_texture_query_levels  Not Supported
GL_ARB_texture_query_lod  Not Supported
GL_ARB_texture_rectangle  Not Supported
GL_ARB_texture_rg  Not Supported
GL_ARB_texture_rgb10_a2ui  Not Supported
GL_ARB_texture_snorm  Not Supported
GL_ARB_texture_stencil8  Not Supported
GL_ARB_texture_storage  Not Supported
GL_ARB_texture_storage_multisample  Not Supported
GL_ARB_texture_swizzle  Not Supported
GL_ARB_texture_view  Not Supported
GL_ARB_timer_query  Not Supported
GL_ARB_transform_feedback  Not Supported
GL_ARB_transform_feedback_instanced  Not Supported
GL_ARB_transform_feedback_overflow_query  Not Supported
GL_ARB_transform_feedback2  Not Supported
GL_ARB_transform_feedback3  Not Supported
GL_ARB_transpose_matrix  Not Supported
GL_ARB_uber_buffers  Not Supported
GL_ARB_uber_mem_image  Not Supported
GL_ARB_uber_vertex_array  Not Supported
GL_ARB_uniform_buffer_object  Not Supported
GL_ARB_vertex_array_bgra  Not Supported
GL_ARB_vertex_array_object  Not Supported
GL_ARB_vertex_attrib_64bit  Not Supported
GL_ARB_vertex_attrib_binding  Not Supported
GL_ARB_vertex_blend  Not Supported
GL_ARB_vertex_buffer_object  Not Supported
GL_ARB_vertex_program  Not Supported
GL_ARB_vertex_shader  Not Supported
GL_ARB_vertex_type_10f_11f_11f_rev  Not Supported
GL_ARB_vertex_type_2_10_10_10_rev  Not Supported
GL_ARB_viewport_array  Not Supported
GL_ARB_window_pos  Not Supported
GL_ARM_mali_program_binary  Not Supported
GL_ARM_mali_shader_binary  Not Supported
GL_ARM_rgba8  Not Supported
GL_ARM_shader_framebuffer_fetch  Not Supported
GL_ARM_shader_framebuffer_fetch_depth_stencil  Not Supported
GL_ATI_array_rev_comps_in_4_bytes  Not Supported
GL_ATI_blend_equation_separate  Not Supported
GL_ATI_blend_weighted_minmax  Not Supported
GL_ATI_draw_buffers  Not Supported
GL_ATI_element_array  Not Supported
GL_ATI_envmap_bumpmap  Not Supported
GL_ATI_fragment_shader  Not Supported
GL_ATI_lock_texture  Not Supported
GL_ATI_map_object_buffer  Not Supported
GL_ATI_meminfo  Not Supported
GL_ATI_pixel_format_float  Not Supported
GL_ATI_pn_triangles  Not Supported
GL_ATI_point_cull_mode  Not Supported
GL_ATI_separate_stencil  Not Supported
GL_ATI_shader_texture_lod  Not Supported
GL_ATI_text_fragment_shader  Not Supported
GL_ATI_texture_compression_3dc  Not Supported
GL_ATI_texture_env_combine3  Not Supported
GL_ATI_texture_float  Not Supported
GL_ATI_texture_mirror_once  Not Supported
GL_ATI_vertex_array_object  Not Supported
GL_ATI_vertex_attrib_array_object  Not Supported
GL_ATI_vertex_blend  Not Supported
GL_ATI_vertex_shader  Not Supported
GL_ATI_vertex_streams  Not Supported
GL_ATIX_pn_triangles  Not Supported
GL_ATIX_texture_env_combine3  Not Supported
GL_ATIX_texture_env_route  Not Supported
GL_ATIX_vertex_shader_output_point_size  Not Supported
GL_Autodesk_facet_normal  Not Supported
GL_Autodesk_valid_back_buffer_hint  Not Supported
GL_CR_bounding_box  Not Supported
GL_CR_cursor_position  Not Supported
GL_CR_head_spu_name  Not Supported
GL_CR_performance_info  Not Supported
GL_CR_print_string  Not Supported
GL_CR_readback_barrier_size  Not Supported
GL_CR_saveframe  Not Supported
GL_CR_server_id_sharing  Not Supported
GL_CR_server_matrix  Not Supported
GL_CR_state_parameter  Not Supported
GL_CR_synchronization  Not Supported
GL_CR_tile_info  Not Supported
GL_CR_tilesort_info  Not Supported
GL_CR_window_size  Not Supported
GL_DIMD_YUV  Not Supported
GL_DMP_shader_binary  Not Supported
GL_EXT_422_pixels  Not Supported
GL_EXT_abgr  Not Supported
GL_EXT_bgra  Supported
GL_EXT_bindable_uniform  Not Supported
GL_EXT_blend_color  Not Supported
GL_EXT_blend_equation_separate  Not Supported
GL_EXT_blend_func_separate  Not Supported
GL_EXT_blend_logic_op  Not Supported
GL_EXT_blend_minmax  Not Supported
GL_EXT_blend_subtract  Not Supported
GL_EXT_Cg_shader  Not Supported
GL_EXT_clip_control  Not Supported
GL_EXT_clip_volume_hint  Not Supported
GL_EXT_cmyka  Not Supported
GL_EXT_color_buffer_float  Not Supported
GL_EXT_color_buffer_half_float  Not Supported
GL_EXT_color_matrix  Not Supported
GL_EXT_color_subtable  Not Supported
GL_EXT_color_table  Not Supported
GL_EXT_compiled_vertex_array  Not Supported
GL_EXT_convolution  Not Supported
GL_EXT_convolution_border_modes  Not Supported
GL_EXT_coordinate_frame  Not Supported
GL_EXT_copy_buffer  Not Supported
GL_EXT_copy_image  Not Supported
GL_EXT_copy_texture  Not Supported
GL_EXT_cull_vertex  Not Supported
GL_EXT_debug_label  Not Supported
GL_EXT_debug_marker  Not Supported
GL_EXT_depth_bounds_test  Not Supported
GL_EXT_depth_buffer_float  Not Supported
GL_EXT_direct_state_access  Not Supported
GL_EXT_discard_framebuffer  Not Supported
GL_EXT_disjoint_timer_query  Not Supported
GL_EXT_draw_buffers  Not Supported
GL_EXT_draw_buffers_indexed  Not Supported
GL_EXT_draw_buffers2  Not Supported
GL_EXT_draw_indirect  Not Supported
GL_EXT_draw_instanced  Not Supported
GL_EXT_draw_range_elements  Not Supported
GL_EXT_fog_coord  Not Supported
GL_EXT_fog_function  Not Supported
GL_EXT_fog_offset  Not Supported
GL_EXT_frag_depth  Not Supported
GL_EXT_fragment_lighting  Not Supported
GL_EXT_framebuffer_blit  Not Supported
GL_EXT_framebuffer_multisample  Not Supported
GL_EXT_framebuffer_multisample_blit_scaled  Not Supported
GL_EXT_framebuffer_object  Not Supported
GL_EXT_framebuffer_sRGB  Not Supported
GL_EXT_generate_mipmap  Not Supported
GL_EXT_geometry_point_size  Not Supported
GL_EXT_geometry_shader  Not Supported
GL_EXT_geometry_shader4  Not Supported
GL_EXT_glx_stereo_tree  Not Supported
GL_EXT_gpu_program_parameters  Not Supported
GL_EXT_gpu_shader_fp64  Not Supported
GL_EXT_gpu_shader4  Not Supported
GL_EXT_gpu_shader5  Not Supported
GL_EXT_histogram  Not Supported
GL_EXT_import_sync_object  Not Supported
GL_EXT_index_array_formats  Not Supported
GL_EXT_index_func  Not Supported
GL_EXT_index_material  Not Supported
GL_EXT_index_texture  Not Supported
GL_EXT_instanced_arrays  Not Supported
GL_EXT_interlace  Not Supported
GL_EXT_light_texture  Not Supported
GL_EXT_map_buffer_range  Not Supported
GL_EXT_memory_object  Not Supported
GL_EXT_memory_object_win32  Not Supported
GL_EXT_misc_attribute  Not Supported
GL_EXT_multi_draw_arrays  Not Supported
GL_EXT_multisample  Not Supported
GL_EXT_multisampled_render_to_texture  Not Supported
GL_EXT_multiview_draw_buffers  Not Supported
GL_EXT_multiview_texture_multisample  Not Supported
GL_EXT_multiview_timer_query  Not Supported
GL_EXT_nonuniform_qualifier  Not Supported
GL_EXT_occlusion_query_boolean  Not Supported
GL_EXT_packed_depth_stencil  Not Supported
GL_EXT_packed_float  Not Supported
GL_EXT_packed_pixels  Not Supported
GL_EXT_packed_pixels_12  Not Supported
GL_EXT_paletted_texture  Supported
GL_EXT_pixel_buffer_object  Not Supported
GL_EXT_pixel_format  Not Supported
GL_EXT_pixel_texture  Not Supported
GL_EXT_pixel_transform  Not Supported
GL_EXT_pixel_transform_color_table  Not Supported
GL_EXT_point_parameters  Not Supported
GL_EXT_polygon_offset  Not Supported
GL_EXT_polygon_offset_clamp  Not Supported
GL_EXT_post_depth_coverage  Not Supported
GL_EXT_primitive_bounding_box  Not Supported
GL_EXT_provoking_vertex  Not Supported
GL_EXT_pvrtc_sRGB  Not Supported
GL_EXT_raster_multisample  Not Supported
GL_EXT_read_format_bgra  Not Supported
GL_EXT_rescale_normal  Not Supported
GL_EXT_robustness  Not Supported
GL_EXT_scene_marker  Not Supported
GL_EXT_secondary_color  Not Supported
GL_EXT_semaphore  Not Supported
GL_EXT_semaphore_win32  Not Supported
GL_EXT_separate_shader_objects  Not Supported
GL_EXT_separate_specular_color  Not Supported
GL_EXT_shader_atomic_counters  Not Supported
GL_EXT_shader_framebuffer_fetch  Not Supported
GL_EXT_shader_image_load_formatted  Not Supported
GL_EXT_shader_image_load_store  Not Supported
GL_EXT_shader_implicit_conversions  Not Supported
GL_EXT_shader_integer_mix  Not Supported
GL_EXT_shader_io_blocks  Not Supported
GL_EXT_shader_pixel_local_storage  Not Supported
GL_EXT_shader_subroutine  Not Supported
GL_EXT_shader_texture_lod  Not Supported
GL_EXT_shadow_funcs  Not Supported
GL_EXT_shadow_samplers  Not Supported
GL_EXT_shared_texture_palette  Not Supported
GL_EXT_sparse_texture2  Not Supported
GL_EXT_sRGB  Not Supported
GL_EXT_sRGB_write_control  Not Supported
GL_EXT_static_vertex_array  Not Supported
GL_EXT_stencil_clear_tag  Not Supported
GL_EXT_stencil_two_side  Not Supported
GL_EXT_stencil_wrap  Not Supported
GL_EXT_subtexture  Not Supported
GL_EXT_swap_control  Not Supported
GL_EXT_tessellation_point_size  Not Supported
GL_EXT_tessellation_shader  Not Supported
GL_EXT_texgen_reflection  Not Supported
GL_EXT_texture  Not Supported
GL_EXT_texture_array  Not Supported
GL_EXT_texture_border_clamp  Not Supported
GL_EXT_texture_buffer  Not Supported
GL_EXT_texture_buffer_object  Not Supported
GL_EXT_texture_buffer_object_rgb32  Not Supported
GL_EXT_texture_color_table  Not Supported
GL_EXT_texture_compression_bptc  Not Supported
GL_EXT_texture_compression_dxt1  Not Supported
GL_EXT_texture_compression_latc  Not Supported
GL_EXT_texture_compression_rgtc  Not Supported
GL_EXT_texture_compression_s3tc  Not Supported
GL_EXT_texture_cube_map  Not Supported
GL_EXT_texture_cube_map_array  Not Supported
GL_EXT_texture_edge_clamp  Not Supported
GL_EXT_texture_env  Not Supported
GL_EXT_texture_env_add  Not Supported
GL_EXT_texture_env_combine  Not Supported
GL_EXT_texture_env_dot3  Not Supported
GL_EXT_texture_filter_anisotropic  Not Supported
GL_EXT_texture_filter_minmax  Not Supported
GL_EXT_texture_format_BGRA8888  Not Supported
GL_EXT_texture_integer  Not Supported
GL_EXT_texture_lod  Not Supported
GL_EXT_texture_lod_bias  Not Supported
GL_EXT_texture_mirror_clamp  Not Supported
GL_EXT_texture_object  Not Supported
GL_EXT_texture_perturb_normal  Not Supported
GL_EXT_texture_rectangle  Not Supported
GL_EXT_texture_rg  Not Supported
GL_EXT_texture_shadow_lod  Not Supported
GL_EXT_texture_shared_exponent  Not Supported
GL_EXT_texture_snorm  Not Supported
GL_EXT_texture_sRGB  Not Supported
GL_EXT_texture_sRGB_decode  Not Supported
GL_EXT_texture_sRGB_R8  Not Supported
GL_EXT_texture_sRGB_RG8  Not Supported
GL_EXT_texture_storage  Not Supported
GL_EXT_texture_swizzle  Not Supported
GL_EXT_texture_type_2_10_10_10_REV  Not Supported
GL_EXT_texture_view  Not Supported
GL_EXT_texture3D  Not Supported
GL_EXT_texture4D  Not Supported
GL_EXT_timer_query  Not Supported
GL_EXT_transform_feedback  Not Supported
GL_EXT_transform_feedback2  Not Supported
GL_EXT_transform_feedback3  Not Supported
GL_EXT_unpack_subimage  Not Supported
GL_EXT_vertex_array  Not Supported
GL_EXT_vertex_array_bgra  Not Supported
GL_EXT_vertex_array_set  Not Supported
GL_EXT_vertex_array_setXXX  Not Supported
GL_EXT_vertex_attrib_64bit  Not Supported
GL_EXT_vertex_shader  Not Supported
GL_EXT_vertex_weighting  Not Supported
GL_EXT_win32_keyed_mutex  Not Supported
GL_EXT_window_rectangles  Not Supported
GL_EXT_x11_sync_object  Not Supported
GL_EXTX_framebuffer_mixed_formats  Not Supported
GL_EXTX_packed_depth_stencil  Not Supported
GL_FGL_lock_texture  Not Supported
GL_FJ_shader_binary_GCCSO  Not Supported
GL_GL2_geometry_shader  Not Supported
GL_GREMEDY_frame_terminator  Not Supported
GL_GREMEDY_string_marker  Not Supported
GL_HP_convolution_border_modes  Not Supported
GL_HP_image_transform  Not Supported
GL_HP_occlusion_test  Not Supported
GL_HP_texture_lighting  Not Supported
GL_I3D_argb  Not Supported
GL_I3D_color_clamp  Not Supported
GL_I3D_interlace_read  Not Supported
GL_IBM_clip_check  Not Supported
GL_IBM_cull_vertex  Not Supported
GL_IBM_load_named_matrix  Not Supported
GL_IBM_multi_draw_arrays  Not Supported
GL_IBM_multimode_draw_arrays  Not Supported
GL_IBM_occlusion_cull  Not Supported
GL_IBM_pixel_filter_hint  Not Supported
GL_IBM_rasterpos_clip  Not Supported
GL_IBM_rescale_normal  Not Supported
GL_IBM_static_data  Not Supported
GL_IBM_texture_clamp_nodraw  Not Supported
GL_IBM_texture_mirrored_repeat  Not Supported
GL_IBM_vertex_array_lists  Not Supported
GL_IBM_YCbCr  Not Supported
GL_IMG_multisampled_render_to_texture  Not Supported
GL_IMG_program_binary  Not Supported
GL_IMG_read_format  Not Supported
GL_IMG_sgx_binary  Not Supported
GL_IMG_shader_binary  Not Supported
GL_IMG_texture_compression_pvrtc  Not Supported
GL_IMG_texture_compression_pvrtc2  Not Supported
GL_IMG_texture_env_enhanced_fixed_function  Not Supported
GL_IMG_texture_format_BGRA8888  Not Supported
GL_IMG_user_clip_plane  Not Supported
GL_IMG_vertex_program  Not Supported
GL_INGR_blend_func_separate  Not Supported
GL_INGR_color_clamp  Not Supported
GL_INGR_interlace_read  Not Supported
GL_INGR_multiple_palette  Not Supported
GL_INTEL_coarse_fragment_shader  Not Supported
GL_INTEL_compute_shader_lane_shift  Not Supported
GL_INTEL_conservative_rasterization  Not Supported
GL_INTEL_fragment_shader_ordering  Not Supported
GL_INTEL_fragment_shader_span_sharing  Not Supported
GL_INTEL_framebuffer_CMAA  Not Supported
GL_INTEL_image_serialize  Not Supported
GL_INTEL_map_texture  Not Supported
GL_INTEL_multi_rate_fragment_shader  Not Supported
GL_INTEL_parallel_arrays  Not Supported
GL_INTEL_performance_queries  Not Supported
GL_INTEL_performance_query  Not Supported
GL_INTEL_texture_scissor  Not Supported
GL_KHR_blend_equation_advanced  Not Supported
GL_KHR_blend_equation_advanced_coherent  Not Supported
GL_KHR_context_flush_control  Not Supported
GL_KHR_debug  Not Supported
GL_KHR_no_error  Not Supported
GL_KHR_parallel_shader_compile  Not Supported
GL_KHR_robust_buffer_access_behavior  Not Supported
GL_KHR_robustness  Not Supported
GL_KHR_shader_subgroup  Not Supported
GL_KHR_shader_subgroup_arithmetic  Not Supported
GL_KHR_shader_subgroup_ballot  Not Supported
GL_KHR_shader_subgroup_basic  Not Supported
GL_KHR_shader_subgroup_clustered  Not Supported
GL_KHR_shader_subgroup_quad  Not Supported
GL_KHR_shader_subgroup_shuffle  Not Supported
GL_KHR_shader_subgroup_shuffle_relative  Not Supported
GL_KHR_shader_subgroup_vote  Not Supported
GL_KHR_texture_compression_astc_hdr  Not Supported
GL_KHR_texture_compression_astc_ldr  Not Supported
GL_KHR_vulkan_glsl  Not Supported
GL_KTX_buffer_region  Not Supported
GL_MESA_pack_invert  Not Supported
GL_MESA_program_debug  Not Supported
GL_MESA_resize_buffers  Not Supported
GL_MESA_texture_array  Not Supported
GL_MESA_texture_signed_rgba  Not Supported
GL_MESA_window_pos  Not Supported
GL_MESA_ycbcr_texture  Not Supported
GL_MESAX_texture_float  Not Supported
GL_MESAX_texture_stack  Not Supported
GL_MTX_fragment_shader  Not Supported
GL_MTX_precision_dpi  Not Supported
GL_NV_3dvision_settings  Not Supported
GL_NV_alpha_test  Not Supported
GL_NV_alpha_to_coverage_dither_control  Not Supported
GL_NV_bgr  Not Supported
GL_NV_bindless_multi_draw_indirect  Not Supported
GL_NV_bindless_multi_draw_indirect_count  Not Supported
GL_NV_bindless_texture  Not Supported
GL_NV_blend_equation_advanced  Not Supported
GL_NV_blend_equation_advanced_coherent  Not Supported
GL_NV_blend_minmax  Not Supported
GL_NV_blend_minmax_factor  Not Supported
GL_NV_blend_square  Not Supported
GL_NV_centroid_sample  Not Supported
GL_NV_clip_space_w_scaling  Not Supported
GL_NV_command_list  Not Supported
GL_NV_complex_primitives  Not Supported
GL_NV_compute_program5  Not Supported
GL_NV_compute_shader_derivatives  Not Supported
GL_NV_conditional_render  Not Supported
GL_NV_conservative_raster  Not Supported
GL_NV_conservative_raster_dilate  Not Supported
GL_NV_conservative_raster_pre_snap  Not Supported
GL_NV_conservative_raster_pre_snap_triangles  Not Supported
GL_NV_conservative_raster_underestimation  Not Supported
GL_NV_copy_buffer  Not Supported
GL_NV_copy_depth_to_color  Not Supported
GL_NV_copy_image  Not Supported
GL_NV_coverage_sample  Not Supported
GL_NV_deep_texture3D  Not Supported
GL_NV_depth_buffer_float  Not Supported
GL_NV_depth_clamp  Not Supported
GL_NV_depth_nonlinear  Not Supported
GL_NV_depth_range_unclamped  Not Supported
GL_NV_draw_buffers  Not Supported
GL_NV_draw_instanced  Not Supported
GL_NV_draw_texture  Not Supported
GL_NV_draw_vulkan_image  Not Supported
GL_NV_EGL_stream_consumer_external  Not Supported
GL_NV_ES1_1_compatibility  Not Supported
GL_NV_ES3_1_compatibility  Not Supported
GL_NV_evaluators  Not Supported
GL_NV_explicit_attrib_location  Not Supported
GL_NV_explicit_multisample  Not Supported
GL_NV_fbo_color_attachments  Not Supported
GL_NV_feature_query  Not Supported
GL_NV_fence  Not Supported
GL_NV_fill_rectangle  Not Supported
GL_NV_float_buffer  Not Supported
GL_NV_fog_distance  Not Supported
GL_NV_fragdepth  Not Supported
GL_NV_fragment_coverage_to_color  Not Supported
GL_NV_fragment_program  Not Supported
GL_NV_fragment_program_option  Not Supported
GL_NV_fragment_program2  Not Supported
GL_NV_fragment_program4  Not Supported
GL_NV_fragment_shader_barycentric  Not Supported
GL_NV_fragment_shader_interlock  Not Supported
GL_NV_framebuffer_blit  Not Supported
GL_NV_framebuffer_mixed_samples  Not Supported
GL_NV_framebuffer_multisample  Not Supported
GL_NV_framebuffer_multisample_coverage  Not Supported
GL_NV_framebuffer_multisample_ex  Not Supported
GL_NV_generate_mipmap_sRGB  Not Supported
GL_NV_geometry_program4  Not Supported
GL_NV_geometry_shader_passthrough  Not Supported
GL_NV_geometry_shader4  Not Supported
GL_NV_gpu_multicast  Not Supported
GL_NV_gpu_program_fp64  Not Supported
GL_NV_gpu_program_multiview  Not Supported
GL_NV_gpu_program4  Not Supported
GL_NV_gpu_program4_1  Not Supported
GL_NV_gpu_program5  Not Supported
GL_NV_gpu_program5_mem_extended  Not Supported
GL_NV_gpu_shader5  Not Supported
GL_NV_half_float  Not Supported
GL_NV_instanced_arrays  Not Supported
GL_NV_internalformat_sample_query  Not Supported
GL_NV_light_max_exponent  Not Supported
GL_NV_memory_attachment  Not Supported
GL_NV_memory_object_sparse  Not Supported
GL_NV_mesh_shader  Not Supported
GL_NV_multisample_coverage  Not Supported
GL_NV_multisample_filter_hint  Not Supported
GL_NV_non_square_matrices  Not Supported
GL_NV_occlusion_query  Not Supported
GL_NV_pack_subimage  Not Supported
GL_NV_packed_depth_stencil  Not Supported
GL_NV_packed_float  Not Supported
GL_NV_packed_float_linear  Not Supported
GL_NV_parameter_buffer_object  Not Supported
GL_NV_parameter_buffer_object2  Not Supported
GL_NV_path_rendering  Not Supported
GL_NV_path_rendering_shared_edge  Not Supported
GL_NV_pixel_buffer_object  Not Supported
GL_NV_pixel_data_range  Not Supported
GL_NV_platform_binary  Not Supported
GL_NV_point_sprite  Not Supported
GL_NV_present_video  Not Supported
GL_NV_primitive_restart  Not Supported
GL_NV_primitive_shading_rate  Not Supported
GL_NV_query_resource  Not Supported
GL_NV_query_resource_tag  Not Supported
GL_NV_read_buffer  Not Supported
GL_NV_read_buffer_front  Not Supported
GL_NV_read_depth  Not Supported
GL_NV_read_depth_stencil  Not Supported
GL_NV_read_stencil  Not Supported
GL_NV_register_combiners  Not Supported
GL_NV_register_combiners2  Not Supported
GL_NV_representative_fragment_test  Not Supported
GL_NV_robustness_video_memory_purge  Not Supported
GL_NV_sample_locations  Not Supported
GL_NV_sample_mask_override_coverage  Not Supported
GL_NV_scissor_exclusive  Not Supported
GL_NV_shader_atomic_counters  Not Supported
GL_NV_shader_atomic_float  Not Supported
GL_NV_shader_atomic_float64  Not Supported
GL_NV_shader_atomic_fp16_vector  Not Supported
GL_NV_shader_atomic_int64  Not Supported
GL_NV_shader_buffer_load  Not Supported
GL_NV_shader_buffer_store  Not Supported
GL_NV_shader_storage_buffer_object  Not Supported
GL_NV_shader_subgroup_partitioned  Not Supported
GL_NV_shader_texture_footprint  Not Supported
GL_NV_shader_thread_group  Not Supported
GL_NV_shader_thread_shuffle  Not Supported
GL_NV_shading_rate_image  Not Supported
GL_NV_shadow_samplers_array  Not Supported
GL_NV_shadow_samplers_cube  Not Supported
GL_NV_sRGB_formats  Not Supported
GL_NV_stereo_view_rendering  Not Supported
GL_NV_tessellation_program5  Not Supported
GL_NV_texgen_emboss  Not Supported
GL_NV_texgen_reflection  Not Supported
GL_NV_texture_array  Not Supported
GL_NV_texture_barrier  Not Supported
GL_NV_texture_border_clamp  Not Supported
GL_NV_texture_compression_latc  Not Supported
GL_NV_texture_compression_s3tc  Not Supported
GL_NV_texture_compression_s3tc_update  Not Supported
GL_NV_texture_compression_vtc  Not Supported
GL_NV_texture_dirty_tile_map  Not Supported
GL_NV_texture_env_combine4  Not Supported
GL_NV_texture_expand_normal  Not Supported
GL_NV_texture_lod_clamp  Not Supported
GL_NV_texture_multisample  Not Supported
GL_NV_texture_npot_2D_mipmap  Not Supported
GL_NV_texture_rectangle  Not Supported
GL_NV_texture_rectangle_compressed  Not Supported
GL_NV_texture_shader  Not Supported
GL_NV_texture_shader2  Not Supported
GL_NV_texture_shader3  Not Supported
GL_NV_timeline_semaphore  Not Supported
GL_NV_timer_query  Not Supported
GL_NV_transform_feedback  Not Supported
GL_NV_transform_feedback2  Not Supported
GL_NV_uniform_buffer_std430_layout  Not Supported
GL_NV_uniform_buffer_unified_memory  Not Supported
GL_NV_vdpau_interop  Not Supported
GL_NV_vertex_array_range  Not Supported
GL_NV_vertex_array_range2  Not Supported
GL_NV_vertex_attrib_64bit  Not Supported
GL_NV_vertex_attrib_integer_64bit  Not Supported
GL_NV_vertex_buffer_unified_memory  Not Supported
GL_NV_vertex_program  Not Supported
GL_NV_vertex_program1_1  Not Supported
GL_NV_vertex_program2  Not Supported
GL_NV_vertex_program2_option  Not Supported
GL_NV_vertex_program3  Not Supported
GL_NV_vertex_program4  Not Supported
GL_NV_video_capture  Not Supported
GL_NV_viewport_array2  Not Supported
GL_NV_viewport_swizzle  Not Supported
GL_NVX_blend_equation_advanced_multi_draw_buffers  Not Supported
GL_NVX_conditional_render  Not Supported
GL_NVX_flush_hold  Not Supported
GL_NVX_gpu_memory_info  Not Supported
GL_NVX_gpu_multicast2  Not Supported
GL_NVX_instanced_arrays  Not Supported
GL_NVX_linked_gpu_multicast  Not Supported
GL_NVX_multigpu_info  Not Supported
GL_NVX_nvenc_interop  Not Supported
GL_NVX_progress_fence  Not Supported
GL_NVX_shader_thread_group  Not Supported
GL_NVX_shader_thread_shuffle  Not Supported
GL_NVX_shared_sync_object  Not Supported
GL_NVX_sysmem_buffer  Not Supported
GL_NVX_ycrcb  Not Supported
GL_OES_blend_equation_separate  Not Supported
GL_OES_blend_func_separate  Not Supported
GL_OES_blend_subtract  Not Supported
GL_OES_byte_coordinates  Not Supported
GL_OES_compressed_EAC_R11_signed_texture  Not Supported
GL_OES_compressed_EAC_R11_unsigned_texture  Not Supported
GL_OES_compressed_EAC_RG11_signed_texture  Not Supported
GL_OES_compressed_EAC_RG11_unsigned_texture  Not Supported
GL_OES_compressed_ETC1_RGB8_texture  Not Supported
GL_OES_compressed_ETC2_punchthroughA_RGBA8_texture  Not Supported
GL_OES_compressed_ETC2_punchthroughA_sRGB8_alpha_texture  Not Supported
GL_OES_compressed_ETC2_RGB8_texture  Not Supported
GL_OES_compressed_ETC2_RGBA8_texture  Not Supported
GL_OES_compressed_ETC2_sRGB8_alpha8_texture  Not Supported
GL_OES_compressed_ETC2_sRGB8_texture  Not Supported
GL_OES_compressed_paletted_texture  Not Supported
GL_OES_conditional_query  Not Supported
GL_OES_depth_texture  Not Supported
GL_OES_depth_texture_cube_map  Not Supported
GL_OES_depth24  Not Supported
GL_OES_depth32  Not Supported
GL_OES_draw_texture  Not Supported
GL_OES_EGL_image  Not Supported
GL_OES_EGL_image_external  Not Supported
GL_OES_EGL_sync  Not Supported
GL_OES_element_index_uint  Not Supported
GL_OES_extended_matrix_palette  Not Supported
GL_OES_fbo_render_mipmap  Not Supported
GL_OES_fixed_point  Not Supported
GL_OES_fragment_precision_high  Not Supported
GL_OES_framebuffer_object  Not Supported
GL_OES_get_program_binary  Not Supported
GL_OES_mapbuffer  Not Supported
GL_OES_matrix_get  Not Supported
GL_OES_matrix_palette  Not Supported
GL_OES_packed_depth_stencil  Not Supported
GL_OES_point_size_array  Not Supported
GL_OES_point_sprite  Not Supported
GL_OES_query_matrix  Not Supported
GL_OES_read_format  Not Supported
GL_OES_required_internalformat  Not Supported
GL_OES_rgb8_rgba8  Not Supported
GL_OES_sample_shading  Not Supported
GL_OES_sample_variables  Not Supported
GL_OES_shader_image_atomic  Not Supported
GL_OES_shader_multisample_interpolation  Not Supported
GL_OES_single_precision  Not Supported
GL_OES_standard_derivatives  Not Supported
GL_OES_stencil_wrap  Not Supported
GL_OES_stencil1  Not Supported
GL_OES_stencil4  Not Supported
GL_OES_stencil8  Not Supported
GL_OES_surfaceless_context  Not Supported
GL_OES_texture_3D  Not Supported
GL_OES_texture_compression_astc  Not Supported
GL_OES_texture_cube_map  Not Supported
GL_OES_texture_env_crossbar  Not Supported
GL_OES_texture_float  Not Supported
GL_OES_texture_float_linear  Not Supported
GL_OES_texture_half_float  Not Supported
GL_OES_texture_half_float_linear  Not Supported
GL_OES_texture_mirrored_repeat  Not Supported
GL_OES_texture_npot  Not Supported
GL_OES_texture_stencil8  Not Supported
GL_OES_texture_storage_multisample_2d_array  Not Supported
GL_OES_vertex_array_object  Not Supported
GL_OES_vertex_half_float  Not Supported
GL_OES_vertex_type_10_10_10_2  Not Supported
GL_OML_interlace  Not Supported
GL_OML_resample  Not Supported
GL_OML_subsample  Not Supported
GL_OVR_multiview  Not Supported
GL_OVR_multiview2  Not Supported
GL_PGI_misc_hints  Not Supported
GL_PGI_vertex_hints  Not Supported
GL_QCOM_alpha_test  Not Supported
GL_QCOM_binning_control  Not Supported
GL_QCOM_driver_control  Not Supported
GL_QCOM_extended_get  Not Supported
GL_QCOM_extended_get2  Not Supported
GL_QCOM_perfmon_global_mode  Not Supported
GL_QCOM_tiled_rendering  Not Supported
GL_QCOM_writeonly_rendering  Not Supported
GL_REND_screen_coordinates  Not Supported
GL_S3_performance_analyzer  Not Supported
GL_S3_s3tc  Not Supported
GL_S3_texture_float_linear  Not Supported
GL_S3_texture_half_float_linear  Not Supported
GL_SGI_color_matrix  Not Supported
GL_SGI_color_table  Not Supported
GL_SGI_compiled_vertex_array  Not Supported
GL_SGI_cull_vertex  Not Supported
GL_SGI_index_array_formats  Not Supported
GL_SGI_index_func  Not Supported
GL_SGI_index_material  Not Supported
GL_SGI_index_texture  Not Supported
GL_SGI_make_current_read  Not Supported
GL_SGI_texture_add_env  Not Supported
GL_SGI_texture_color_table  Not Supported
GL_SGI_texture_edge_clamp  Not Supported
GL_SGI_texture_lod  Not Supported
GL_SGIS_color_range  Not Supported
GL_SGIS_detail_texture  Not Supported
GL_SGIS_fog_function  Not Supported
GL_SGIS_generate_mipmap  Not Supported
GL_SGIS_multisample  Not Supported
GL_SGIS_multitexture  Not Supported
GL_SGIS_pixel_texture  Not Supported
GL_SGIS_point_line_texgen  Not Supported
GL_SGIS_sharpen_texture  Not Supported
GL_SGIS_texture_border_clamp  Not Supported
GL_SGIS_texture_color_mask  Not Supported
GL_SGIS_texture_edge_clamp  Not Supported
GL_SGIS_texture_filter4  Not Supported
GL_SGIS_texture_lod  Not Supported
GL_SGIS_texture_select  Not Supported
GL_SGIS_texture4D  Not Supported
GL_SGIX_async  Not Supported
GL_SGIX_async_histogram  Not Supported
GL_SGIX_async_pixel  Not Supported
GL_SGIX_blend_alpha_minmax  Not Supported
GL_SGIX_clipmap  Not Supported
GL_SGIX_convolution_accuracy  Not Supported
GL_SGIX_depth_pass_instrument  Not Supported
GL_SGIX_depth_texture  Not Supported
GL_SGIX_flush_raster  Not Supported
GL_SGIX_fog_offset  Not Supported
GL_SGIX_fog_texture  Not Supported
GL_SGIX_fragment_specular_lighting  Not Supported
GL_SGIX_framezoom  Not Supported
GL_SGIX_instruments  Not Supported
GL_SGIX_interlace  Not Supported
GL_SGIX_ir_instrument1  Not Supported
GL_SGIX_list_priority  Not Supported
GL_SGIX_pbuffer  Not Supported
GL_SGIX_pixel_texture  Not Supported
GL_SGIX_pixel_texture_bits  Not Supported
GL_SGIX_reference_plane  Not Supported
GL_SGIX_resample  Not Supported
GL_SGIX_shadow  Not Supported
GL_SGIX_shadow_ambient  Not Supported
GL_SGIX_sprite  Not Supported
GL_SGIX_subsample  Not Supported
GL_SGIX_tag_sample_buffer  Not Supported
GL_SGIX_texture_add_env  Not Supported
GL_SGIX_texture_coordinate_clamp  Not Supported
GL_SGIX_texture_lod_bias  Not Supported
GL_SGIX_texture_multi_buffer  Not Supported
GL_SGIX_texture_range  Not Supported
GL_SGIX_texture_scale_bias  Not Supported
GL_SGIX_vertex_preclip  Not Supported
GL_SGIX_vertex_preclip_hint  Not Supported
GL_SGIX_ycrcb  Not Supported
GL_SGIX_ycrcb_subsample  Not Supported
GL_SUN_convolution_border_modes  Not Supported
GL_SUN_global_alpha  Not Supported
GL_SUN_mesh_array  Not Supported
GL_SUN_multi_draw_arrays  Not Supported
GL_SUN_read_video_pixels  Not Supported
GL_SUN_slice_accum  Not Supported
GL_SUN_triangle_list  Not Supported
GL_SUN_vertex  Not Supported
GL_SUNX_constant_data  Not Supported
GL_VIV_shader_binary  Not Supported
GL_WGL_ARB_extensions_string  Not Supported
GL_WGL_EXT_extensions_string  Not Supported
GL_WGL_EXT_swap_control  Not Supported
GL_WIN_phong_shading  Not Supported
GL_WIN_specular_fog  Not Supported
GL_WIN_swap_hint  Supported
GLU_EXT_nurbs_tessellator  Not Supported
GLU_EXT_object_space_tess  Not Supported
GLU_SGI_filter4_parameters  Not Supported
GLX_AMD_gpu_association  Not Supported
GLX_ARB_create_context  Not Supported
GLX_ARB_create_context_no_error  Not Supported
GLX_ARB_create_context_profile  Not Supported
GLX_ARB_create_context_robustness  Not Supported
GLX_ARB_fbconfig_float  Not Supported
GLX_ARB_framebuffer_sRGB  Not Supported
GLX_ARB_get_proc_address  Not Supported
GLX_ARB_multisample  Not Supported
GLX_ARB_robustness_application_isolation  Not Supported
GLX_ARB_robustness_share_group_isolation  Not Supported
GLX_ARB_vertex_buffer_object  Not Supported
GLX_EXT_buffer_age  Not Supported
GLX_EXT_create_context_es_profile  Not Supported
GLX_EXT_create_context_es2_profile  Not Supported
GLX_EXT_fbconfig_packed_float  Not Supported
GLX_EXT_framebuffer_sRGB  Not Supported
GLX_EXT_import_context  Not Supported
GLX_EXT_scene_marker  Not Supported
GLX_EXT_swap_control  Not Supported
GLX_EXT_swap_control_tear  Not Supported
GLX_EXT_texture_from_pixmap  Not Supported
GLX_EXT_visual_info  Not Supported
GLX_EXT_visual_rating  Not Supported
GLX_INTEL_swap_event  Not Supported
GLX_MESA_agp_offset  Not Supported
GLX_MESA_copy_sub_buffer  Not Supported
GLX_MESA_multithread_makecurrent  Not Supported
GLX_MESA_pixmap_colormap  Not Supported
GLX_MESA_query_renderer  Not Supported
GLX_MESA_release_buffers  Not Supported
GLX_MESA_set_3dfx_mode  Not Supported
GLX_MESA_swap_control  Not Supported
GLX_NV_copy_image  Not Supported
GLX_NV_delay_before_swap  Not Supported
GLX_NV_float_buffer  Not Supported
GLX_NV_multisample_coverage  Not Supported
GLX_NV_present_video  Not Supported
GLX_NV_swap_group  Not Supported
GLX_NV_video_capture  Not Supported
GLX_NV_video_out  Not Supported
GLX_NV_video_output  Not Supported
GLX_OML_interlace  Not Supported
GLX_OML_swap_method  Not Supported
GLX_OML_sync_control  Not Supported
GLX_SGI_cushion  Not Supported
GLX_SGI_make_current_read  Not Supported
GLX_SGI_swap_control  Not Supported
GLX_SGI_video_sync  Not Supported
GLX_SGIS_blended_overlay  Not Supported
GLX_SGIS_color_range  Not Supported
GLX_SGIS_multisample  Not Supported
GLX_SGIX_dm_buffer  Not Supported
GLX_SGIX_fbconfig  Not Supported
GLX_SGIX_hyperpipe  Not Supported
GLX_SGIX_pbuffer  Not Supported
GLX_SGIX_swap_barrier  Not Supported
GLX_SGIX_swap_group  Not Supported
GLX_SGIX_video_resize  Not Supported
GLX_SGIX_video_source  Not Supported
GLX_SGIX_visual_select_group  Not Supported
GLX_SUN_get_transparent_index  Not Supported
GLX_SUN_video_resize  Not Supported
WGL_3DFX_gamma_control  Not Supported
WGL_3DFX_multisample  Not Supported
WGL_3DL_stereo_control  Not Supported
WGL_AMD_gpu_association  Not Supported
WGL_AMDX_gpu_association  Not Supported
WGL_ARB_buffer_region  Not Supported
WGL_ARB_context_flush_control  Not Supported
WGL_ARB_create_context  Not Supported
WGL_ARB_create_context_no_error  Not Supported
WGL_ARB_create_context_profile  Not Supported
WGL_ARB_create_context_robustness  Not Supported
WGL_ARB_extensions_string  Not Supported
WGL_ARB_framebuffer_sRGB  Not Supported
WGL_ARB_make_current_read  Not Supported
WGL_ARB_multisample  Not Supported
WGL_ARB_pbuffer  Not Supported
WGL_ARB_pixel_format  Not Supported
WGL_ARB_pixel_format_float  Not Supported
WGL_ARB_render_texture  Not Supported
WGL_ARB_robustness_application_isolation  Not Supported
WGL_ARB_robustness_share_group_isolation  Not Supported
WGL_ATI_pbuffer_memory_hint  Not Supported
WGL_ATI_pixel_format_float  Not Supported
WGL_ATI_render_texture_rectangle  Not Supported
WGL_EXT_buffer_region  Not Supported
WGL_EXT_colorspace  Not Supported
WGL_EXT_create_context_es_profile  Not Supported
WGL_EXT_create_context_es2_profile  Not Supported
WGL_EXT_depth_float  Not Supported
WGL_EXT_display_color_table  Not Supported
WGL_EXT_extensions_string  Not Supported
WGL_EXT_framebuffer_sRGB  Not Supported
WGL_EXT_framebuffer_sRGBWGL_ARB_create_context  Not Supported
WGL_EXT_gamma_control  Not Supported
WGL_EXT_make_current_read  Not Supported
WGL_EXT_multisample  Not Supported
WGL_EXT_pbuffer  Not Supported
WGL_EXT_pixel_format  Not Supported
WGL_EXT_pixel_format_packed_float  Not Supported
WGL_EXT_render_texture  Not Supported
WGL_EXT_swap_control  Not Supported
WGL_EXT_swap_control_tear  Not Supported
WGL_EXT_swap_interval  Not Supported
WGL_I3D_digital_video_control  Not Supported
WGL_I3D_gamma  Not Supported
WGL_I3D_genlock  Not Supported
WGL_I3D_image_buffer  Not Supported
WGL_I3D_swap_frame_lock  Not Supported
WGL_I3D_swap_frame_usage  Not Supported
WGL_INTEL_cl_sharing  Not Supported
WGL_MTX_video_preview  Not Supported
WGL_NV_bridged_display  Not Supported
WGL_NV_copy_image  Not Supported
WGL_NV_delay_before_swap  Not Supported
WGL_NV_DX_interop  Not Supported
WGL_NV_DX_interop2  Not Supported
WGL_NV_float_buffer  Not Supported
WGL_NV_gpu_affinity  Not Supported
WGL_NV_multigpu_context  Not Supported
WGL_NV_multisample_coverage  Not Supported
WGL_NV_present_video  Not Supported
WGL_NV_render_depth_texture  Not Supported
WGL_NV_render_texture_rectangle  Not Supported
WGL_NV_swap_group  Not Supported
WGL_NV_texture_rectangle  Not Supported
WGL_NV_vertex_array_range  Not Supported
WGL_NV_video_capture  Not Supported
WGL_NV_video_output  Not Supported
WGL_NVX_DX_interop  Not Supported
WGL_OML_sync_control  Not Supported
WGL_S3_cl_sharing  Not Supported
 
Supported Compressed Texture Formats:
RGB DXT1  Not Supported
RGBA DXT1  Not Supported
RGBA DXT3  Not Supported
RGBA DXT5  Not Supported
RGB FXT1  Not Supported
RGBA FXT1  Not Supported
3Dc  Not Supported


Fonts
 
Font Family  Type  Style  Character Set  Char. Size  Char. Weight
@Malgun Gothic Semilight  Swiss  Regular  Baltic  31 x 43  30 %
@Malgun Gothic Semilight  Swiss  Regular  CHINESE_BIG5  31 x 43  30 %
@Malgun Gothic Semilight  Swiss  Regular  CHINESE_GB2312  31 x 43  30 %
@Malgun Gothic Semilight  Swiss  Regular  Cyrillic  31 x 43  30 %
@Malgun Gothic Semilight  Swiss  Regular  Greek  31 x 43  30 %
@Malgun Gothic Semilight  Swiss  Regular  Hangul(Johab)  31 x 43  30 %
@Malgun Gothic Semilight  Swiss  Regular  Hangul  31 x 43  30 %
@Malgun Gothic Semilight  Swiss  Regular  Hebrew  31 x 43  30 %
@Malgun Gothic Semilight  Swiss  Regular  Japanese  31 x 43  30 %
@Malgun Gothic Semilight  Swiss  Regular  Turkish  31 x 43  30 %
@Malgun Gothic Semilight  Swiss  Regular  Vietnamese  31 x 43  30 %
@Malgun Gothic Semilight  Swiss  Regular  Western  31 x 43  30 %
@Malgun Gothic  Swiss  Regular  Hangul  15 x 43  40 %
@Malgun Gothic  Swiss  Regular  Western  15 x 43  40 %
@Microsoft JhengHei Light  Swiss  Regular  CHINESE_BIG5  32 x 43  29 %
@Microsoft JhengHei Light  Swiss  Regular  Greek  32 x 43  29 %
@Microsoft JhengHei Light  Swiss  Regular  Western  32 x 43  29 %
@Microsoft JhengHei UI Light  Swiss  Regular  CHINESE_BIG5  32 x 41  29 %
@Microsoft JhengHei UI Light  Swiss  Regular  Greek  32 x 41  29 %
@Microsoft JhengHei UI Light  Swiss  Regular  Western  32 x 41  29 %
@Microsoft JhengHei UI  Swiss  Regular  CHINESE_BIG5  15 x 41  40 %
@Microsoft JhengHei UI  Swiss  Regular  Greek  15 x 41  40 %
@Microsoft JhengHei UI  Swiss  Regular  Western  15 x 41  40 %
@Microsoft JhengHei  Swiss  Regular  CHINESE_BIG5  15 x 43  40 %
@Microsoft JhengHei  Swiss  Regular  Greek  15 x 43  40 %
@Microsoft JhengHei  Swiss  Regular  Western  15 x 43  40 %
@Microsoft YaHei Light  Swiss  Regular  Central European  15 x 41  29 %
@Microsoft YaHei Light  Swiss  Regular  CHINESE_GB2312  15 x 41  29 %
@Microsoft YaHei Light  Swiss  Regular  Cyrillic  15 x 41  29 %
@Microsoft YaHei Light  Swiss  Regular  Greek  15 x 41  29 %
@Microsoft YaHei Light  Swiss  Regular  Turkish  15 x 41  29 %
@Microsoft YaHei Light  Swiss  Regular  Western  15 x 41  29 %
@Microsoft YaHei UI Light  Swiss  Regular  Central European  15 x 42  29 %
@Microsoft YaHei UI Light  Swiss  Regular  CHINESE_GB2312  15 x 42  29 %
@Microsoft YaHei UI Light  Swiss  Regular  Cyrillic  15 x 42  29 %
@Microsoft YaHei UI Light  Swiss  Regular  Greek  15 x 42  29 %
@Microsoft YaHei UI Light  Swiss  Regular  Turkish  15 x 42  29 %
@Microsoft YaHei UI Light  Swiss  Regular  Western  15 x 42  29 %
@Microsoft YaHei UI  Swiss  Regular  Central European  15 x 41  40 %
@Microsoft YaHei UI  Swiss  Regular  CHINESE_GB2312  15 x 41  40 %
@Microsoft YaHei UI  Swiss  Regular  Cyrillic  15 x 41  40 %
@Microsoft YaHei UI  Swiss  Regular  Greek  15 x 41  40 %
@Microsoft YaHei UI  Swiss  Regular  Turkish  15 x 41  40 %
@Microsoft YaHei UI  Swiss  Regular  Western  15 x 41  40 %
@Microsoft YaHei  Swiss  Regular  Central European  15 x 42  40 %
@Microsoft YaHei  Swiss  Regular  CHINESE_GB2312  15 x 42  40 %
@Microsoft YaHei  Swiss  Regular  Cyrillic  15 x 42  40 %
@Microsoft YaHei  Swiss  Regular  Greek  15 x 42  40 %
@Microsoft YaHei  Swiss  Regular  Turkish  15 x 42  40 %
@Microsoft YaHei  Swiss  Regular  Western  15 x 42  40 %
@MingLiU_HKSCS-ExtB  Roman  Regular  CHINESE_BIG5  16 x 32  40 %
@MingLiU_HKSCS-ExtB  Roman  Regular  Western  16 x 32  40 %
@MingLiU_MSCS-ExtB  Roman  Regular  CHINESE_BIG5  16 x 32  40 %
@MingLiU_MSCS-ExtB  Roman  Regular  Western  16 x 32  40 %
@MingLiU-ExtB  Roman  Regular  CHINESE_BIG5  16 x 32  40 %
@MingLiU-ExtB  Roman  Regular  Western  16 x 32  40 %
@MS Gothic  Modern  Regular  Baltic  16 x 32  40 %
@MS Gothic  Modern  Regular  Central European  16 x 32  40 %
@MS Gothic  Modern  Regular  Cyrillic  16 x 32  40 %
@MS Gothic  Modern  Regular  Greek  16 x 32  40 %
@MS Gothic  Modern  Regular  Japanese  16 x 32  40 %
@MS Gothic  Modern  Regular  Turkish  16 x 32  40 %
@MS Gothic  Modern  Regular  Western  16 x 32  40 %
@MS PGothic  Swiss  Regular  Baltic  13 x 32  40 %
@MS PGothic  Swiss  Regular  Central European  13 x 32  40 %
@MS PGothic  Swiss  Regular  Cyrillic  13 x 32  40 %
@MS PGothic  Swiss  Regular  Greek  13 x 32  40 %
@MS PGothic  Swiss  Regular  Japanese  13 x 32  40 %
@MS PGothic  Swiss  Regular  Turkish  13 x 32  40 %
@MS PGothic  Swiss  Regular  Western  13 x 32  40 %
@MS UI Gothic  Swiss  Regular  Baltic  13 x 32  40 %
@MS UI Gothic  Swiss  Regular  Central European  13 x 32  40 %
@MS UI Gothic  Swiss  Regular  Cyrillic  13 x 32  40 %
@MS UI Gothic  Swiss  Regular  Greek  13 x 32  40 %
@MS UI Gothic  Swiss  Regular  Japanese  13 x 32  40 %
@MS UI Gothic  Swiss  Regular  Turkish  13 x 32  40 %
@MS UI Gothic  Swiss  Regular  Western  13 x 32  40 %
@NSimSun  Modern  Regular  CHINESE_GB2312  16 x 32  40 %
@NSimSun  Modern  Regular  Western  16 x 32  40 %
@PMingLiU-ExtB  Roman  Regular  CHINESE_BIG5  16 x 32  40 %
@PMingLiU-ExtB  Roman  Regular  Western  16 x 32  40 %
@SimSun  Special  Regular  CHINESE_GB2312  16 x 32  40 %
@SimSun  Special  Regular  Western  16 x 32  40 %
@SimSun-ExtB  Modern  Regular  CHINESE_GB2312  16 x 32  40 %
@SimSun-ExtB  Modern  Regular  Western  16 x 32  40 %
@SimSun-ExtG  Modern  Regular  CHINESE_GB2312  16 x 32  40 %
@SimSun-ExtG  Modern  Regular  Western  16 x 32  40 %
@Yu Gothic Light  Swiss  Regular  Baltic  31 x 41  30 %
@Yu Gothic Light  Swiss  Regular  Central European  31 x 41  30 %
@Yu Gothic Light  Swiss  Regular  Cyrillic  31 x 41  30 %
@Yu Gothic Light  Swiss  Regular  Greek  31 x 41  30 %
@Yu Gothic Light  Swiss  Regular  Japanese  31 x 41  30 %
@Yu Gothic Light  Swiss  Regular  Turkish  31 x 41  30 %
@Yu Gothic Light  Swiss  Regular  Western  31 x 41  30 %
@Yu Gothic Medium  Swiss  Regular  Baltic  31 x 41  50 %
@Yu Gothic Medium  Swiss  Regular  Central European  31 x 41  50 %
@Yu Gothic Medium  Swiss  Regular  Cyrillic  31 x 41  50 %
@Yu Gothic Medium  Swiss  Regular  Greek  31 x 41  50 %
@Yu Gothic Medium  Swiss  Regular  Japanese  31 x 41  50 %
@Yu Gothic Medium  Swiss  Regular  Turkish  31 x 41  50 %
@Yu Gothic Medium  Swiss  Regular  Western  31 x 41  50 %
@Yu Gothic UI Light  Swiss  Regular  Baltic  17 x 43  30 %
@Yu Gothic UI Light  Swiss  Regular  Central European  17 x 43  30 %
@Yu Gothic UI Light  Swiss  Regular  Cyrillic  17 x 43  30 %
@Yu Gothic UI Light  Swiss  Regular  Greek  17 x 43  30 %
@Yu Gothic UI Light  Swiss  Regular  Japanese  17 x 43  30 %
@Yu Gothic UI Light  Swiss  Regular  Turkish  17 x 43  30 %
@Yu Gothic UI Light  Swiss  Regular  Western  17 x 43  30 %
@Yu Gothic UI Semibold  Swiss  Regular  Baltic  19 x 43  60 %
@Yu Gothic UI Semibold  Swiss  Regular  Central European  19 x 43  60 %
@Yu Gothic UI Semibold  Swiss  Regular  Cyrillic  19 x 43  60 %
@Yu Gothic UI Semibold  Swiss  Regular  Greek  19 x 43  60 %
@Yu Gothic UI Semibold  Swiss  Regular  Japanese  19 x 43  60 %
@Yu Gothic UI Semibold  Swiss  Regular  Turkish  19 x 43  60 %
@Yu Gothic UI Semibold  Swiss  Regular  Western  19 x 43  60 %
@Yu Gothic UI Semilight  Swiss  Regular  Baltic  17 x 43  35 %
@Yu Gothic UI Semilight  Swiss  Regular  Central European  17 x 43  35 %
@Yu Gothic UI Semilight  Swiss  Regular  Cyrillic  17 x 43  35 %
@Yu Gothic UI Semilight  Swiss  Regular  Greek  17 x 43  35 %
@Yu Gothic UI Semilight  Swiss  Regular  Japanese  17 x 43  35 %
@Yu Gothic UI Semilight  Swiss  Regular  Turkish  17 x 43  35 %
@Yu Gothic UI Semilight  Swiss  Regular  Western  17 x 43  35 %
@Yu Gothic UI  Swiss  Regular  Baltic  17 x 43  40 %
@Yu Gothic UI  Swiss  Regular  Central European  17 x 43  40 %
@Yu Gothic UI  Swiss  Regular  Cyrillic  17 x 43  40 %
@Yu Gothic UI  Swiss  Regular  Greek  17 x 43  40 %
@Yu Gothic UI  Swiss  Regular  Japanese  17 x 43  40 %
@Yu Gothic UI  Swiss  Regular  Turkish  17 x 43  40 %
@Yu Gothic UI  Swiss  Regular  Western  17 x 43  40 %
@Yu Gothic  Swiss  Regular  Baltic  31 x 41  40 %
@Yu Gothic  Swiss  Regular  Central European  31 x 41  40 %
@Yu Gothic  Swiss  Regular  Cyrillic  31 x 41  40 %
@Yu Gothic  Swiss  Regular  Greek  31 x 41  40 %
@Yu Gothic  Swiss  Regular  Japanese  31 x 41  40 %
@Yu Gothic  Swiss  Regular  Turkish  31 x 41  40 %
@Yu Gothic  Swiss  Regular  Western  31 x 41  40 %
Arial Black  Swiss  Regular  Baltic  18 x 45  90 %
Arial Black  Swiss  Regular  Central European  18 x 45  90 %
Arial Black  Swiss  Regular  Cyrillic  18 x 45  90 %
Arial Black  Swiss  Regular  Greek  18 x 45  90 %
Arial Black  Swiss  Regular  Turkish  18 x 45  90 %
Arial Black  Swiss  Regular  Western  18 x 45  90 %
Arial  Swiss  Regular  Arabic  14 x 36  40 %
Arial  Swiss  Regular  Baltic  14 x 36  40 %
Arial  Swiss  Regular  Central European  14 x 36  40 %
Arial  Swiss  Regular  Cyrillic  14 x 36  40 %
Arial  Swiss  Regular  Greek  14 x 36  40 %
Arial  Swiss  Regular  Hebrew  14 x 36  40 %
Arial  Swiss  Regular  Turkish  14 x 36  40 %
Arial  Swiss  Regular  Vietnamese  14 x 36  40 %
Arial  Swiss  Regular  Western  14 x 36  40 %
Bahnschrift Condensed  Swiss  Condensed  Baltic  18 x 38  40 %
Bahnschrift Condensed  Swiss  Condensed  Central European  18 x 38  40 %
Bahnschrift Condensed  Swiss  Condensed  Cyrillic  18 x 38  40 %
Bahnschrift Condensed  Swiss  Condensed  Greek  18 x 38  40 %
Bahnschrift Condensed  Swiss  Condensed  Turkish  18 x 38  40 %
Bahnschrift Condensed  Swiss  Condensed  Vietnamese  18 x 38  40 %
Bahnschrift Condensed  Swiss  Condensed  Western  18 x 38  40 %
Bahnschrift Light Condensed  Swiss  Light Condensed  Baltic  18 x 38  30 %
Bahnschrift Light Condensed  Swiss  Light Condensed  Central European  18 x 38  30 %
Bahnschrift Light Condensed  Swiss  Light Condensed  Cyrillic  18 x 38  30 %
Bahnschrift Light Condensed  Swiss  Light Condensed  Greek  18 x 38  30 %
Bahnschrift Light Condensed  Swiss  Light Condensed  Turkish  18 x 38  30 %
Bahnschrift Light Condensed  Swiss  Light Condensed  Vietnamese  18 x 38  30 %
Bahnschrift Light Condensed  Swiss  Light Condensed  Western  18 x 38  30 %
Bahnschrift Light SemiCondensed  Swiss  Light SemiCondensed  Baltic  18 x 38  30 %
Bahnschrift Light SemiCondensed  Swiss  Light SemiCondensed  Central European  18 x 38  30 %
Bahnschrift Light SemiCondensed  Swiss  Light SemiCondensed  Cyrillic  18 x 38  30 %
Bahnschrift Light SemiCondensed  Swiss  Light SemiCondensed  Greek  18 x 38  30 %
Bahnschrift Light SemiCondensed  Swiss  Light SemiCondensed  Turkish  18 x 38  30 %
Bahnschrift Light SemiCondensed  Swiss  Light SemiCondensed  Vietnamese  18 x 38  30 %
Bahnschrift Light SemiCondensed  Swiss  Light SemiCondensed  Western  18 x 38  30 %
Bahnschrift Light  Swiss  Light  Baltic  18 x 38  30 %
Bahnschrift Light  Swiss  Light  Central European  18 x 38  30 %
Bahnschrift Light  Swiss  Light  Cyrillic  18 x 38  30 %
Bahnschrift Light  Swiss  Light  Greek  18 x 38  30 %
Bahnschrift Light  Swiss  Light  Turkish  18 x 38  30 %
Bahnschrift Light  Swiss  Light  Vietnamese  18 x 38  30 %
Bahnschrift Light  Swiss  Light  Western  18 x 38  30 %
Bahnschrift SemiBold Condensed  Swiss  SemiBold Condensed  Baltic  18 x 38  60 %
Bahnschrift SemiBold Condensed  Swiss  SemiBold Condensed  Central European  18 x 38  60 %
Bahnschrift SemiBold Condensed  Swiss  SemiBold Condensed  Cyrillic  18 x 38  60 %
Bahnschrift SemiBold Condensed  Swiss  SemiBold Condensed  Greek  18 x 38  60 %
Bahnschrift SemiBold Condensed  Swiss  SemiBold Condensed  Turkish  18 x 38  60 %
Bahnschrift SemiBold Condensed  Swiss  SemiBold Condensed  Vietnamese  18 x 38  60 %
Bahnschrift SemiBold Condensed  Swiss  SemiBold Condensed  Western  18 x 38  60 %
Bahnschrift SemiBold SemiConden  Swiss  SemiBold SemiCondensed  Baltic  18 x 38  60 %
Bahnschrift SemiBold SemiConden  Swiss  SemiBold SemiCondensed  Central European  18 x 38  60 %
Bahnschrift SemiBold SemiConden  Swiss  SemiBold SemiCondensed  Cyrillic  18 x 38  60 %
Bahnschrift SemiBold SemiConden  Swiss  SemiBold SemiCondensed  Greek  18 x 38  60 %
Bahnschrift SemiBold SemiConden  Swiss  SemiBold SemiCondensed  Turkish  18 x 38  60 %
Bahnschrift SemiBold SemiConden  Swiss  SemiBold SemiCondensed  Vietnamese  18 x 38  60 %
Bahnschrift SemiBold SemiConden  Swiss  SemiBold SemiCondensed  Western  18 x 38  60 %
Bahnschrift SemiBold  Swiss  SemiBold  Baltic  18 x 38  60 %
Bahnschrift SemiBold  Swiss  SemiBold  Central European  18 x 38  60 %
Bahnschrift SemiBold  Swiss  SemiBold  Cyrillic  18 x 38  60 %
Bahnschrift SemiBold  Swiss  SemiBold  Greek  18 x 38  60 %
Bahnschrift SemiBold  Swiss  SemiBold  Turkish  18 x 38  60 %
Bahnschrift SemiBold  Swiss  SemiBold  Vietnamese  18 x 38  60 %
Bahnschrift SemiBold  Swiss  SemiBold  Western  18 x 38  60 %
Bahnschrift SemiCondensed  Swiss  SemiCondensed  Baltic  18 x 38  40 %
Bahnschrift SemiCondensed  Swiss  SemiCondensed  Central European  18 x 38  40 %
Bahnschrift SemiCondensed  Swiss  SemiCondensed  Cyrillic  18 x 38  40 %
Bahnschrift SemiCondensed  Swiss  SemiCondensed  Greek  18 x 38  40 %
Bahnschrift SemiCondensed  Swiss  SemiCondensed  Turkish  18 x 38  40 %
Bahnschrift SemiCondensed  Swiss  SemiCondensed  Vietnamese  18 x 38  40 %
Bahnschrift SemiCondensed  Swiss  SemiCondensed  Western  18 x 38  40 %
Bahnschrift SemiLight Condensed  Swiss  SemiLight Condensed  Baltic  18 x 38  35 %
Bahnschrift SemiLight Condensed  Swiss  SemiLight Condensed  Central European  18 x 38  35 %
Bahnschrift SemiLight Condensed  Swiss  SemiLight Condensed  Cyrillic  18 x 38  35 %
Bahnschrift SemiLight Condensed  Swiss  SemiLight Condensed  Greek  18 x 38  35 %
Bahnschrift SemiLight Condensed  Swiss  SemiLight Condensed  Turkish  18 x 38  35 %
Bahnschrift SemiLight Condensed  Swiss  SemiLight Condensed  Vietnamese  18 x 38  35 %
Bahnschrift SemiLight Condensed  Swiss  SemiLight Condensed  Western  18 x 38  35 %
Bahnschrift SemiLight SemiConde  Swiss  SemiLight SemiCondensed  Baltic  18 x 38  35 %
Bahnschrift SemiLight SemiConde  Swiss  SemiLight SemiCondensed  Central European  18 x 38  35 %
Bahnschrift SemiLight SemiConde  Swiss  SemiLight SemiCondensed  Cyrillic  18 x 38  35 %
Bahnschrift SemiLight SemiConde  Swiss  SemiLight SemiCondensed  Greek  18 x 38  35 %
Bahnschrift SemiLight SemiConde  Swiss  SemiLight SemiCondensed  Turkish  18 x 38  35 %
Bahnschrift SemiLight SemiConde  Swiss  SemiLight SemiCondensed  Vietnamese  18 x 38  35 %
Bahnschrift SemiLight SemiConde  Swiss  SemiLight SemiCondensed  Western  18 x 38  35 %
Bahnschrift SemiLight  Swiss  SemiLight  Baltic  18 x 38  35 %
Bahnschrift SemiLight  Swiss  SemiLight  Central European  18 x 38  35 %
Bahnschrift SemiLight  Swiss  SemiLight  Cyrillic  18 x 38  35 %
Bahnschrift SemiLight  Swiss  SemiLight  Greek  18 x 38  35 %
Bahnschrift SemiLight  Swiss  SemiLight  Turkish  18 x 38  35 %
Bahnschrift SemiLight  Swiss  SemiLight  Vietnamese  18 x 38  35 %
Bahnschrift SemiLight  Swiss  SemiLight  Western  18 x 38  35 %
Bahnschrift  Swiss  Regular  Baltic  18 x 38  40 %
Bahnschrift  Swiss  Regular  Central European  18 x 38  40 %
Bahnschrift  Swiss  Regular  Cyrillic  18 x 38  40 %
Bahnschrift  Swiss  Regular  Greek  18 x 38  40 %
Bahnschrift  Swiss  Regular  Turkish  18 x 38  40 %
Bahnschrift  Swiss  Regular  Vietnamese  18 x 38  40 %
Bahnschrift  Swiss  Regular  Western  18 x 38  40 %
Calibri Light  Swiss  Regular  Arabic  17 x 39  30 %
Calibri Light  Swiss  Regular  Baltic  17 x 39  30 %
Calibri Light  Swiss  Regular  Central European  17 x 39  30 %
Calibri Light  Swiss  Regular  Cyrillic  17 x 39  30 %
Calibri Light  Swiss  Regular  Greek  17 x 39  30 %
Calibri Light  Swiss  Regular  Hebrew  17 x 39  30 %
Calibri Light  Swiss  Regular  Turkish  17 x 39  30 %
Calibri Light  Swiss  Regular  Vietnamese  17 x 39  30 %
Calibri Light  Swiss  Regular  Western  17 x 39  30 %
Calibri  Swiss  Regular  Arabic  17 x 39  40 %
Calibri  Swiss  Regular  Baltic  17 x 39  40 %
Calibri  Swiss  Regular  Central European  17 x 39  40 %
Calibri  Swiss  Regular  Cyrillic  17 x 39  40 %
Calibri  Swiss  Regular  Greek  17 x 39  40 %
Calibri  Swiss  Regular  Hebrew  17 x 39  40 %
Calibri  Swiss  Regular  Turkish  17 x 39  40 %
Calibri  Swiss  Regular  Vietnamese  17 x 39  40 %
Calibri  Swiss  Regular  Western  17 x 39  40 %
Cambria Math  Roman  Regular  Baltic  20 x 179  40 %
Cambria Math  Roman  Regular  Central European  20 x 179  40 %
Cambria Math  Roman  Regular  Cyrillic  20 x 179  40 %
Cambria Math  Roman  Regular  Greek  20 x 179  40 %
Cambria Math  Roman  Regular  Turkish  20 x 179  40 %
Cambria Math  Roman  Regular  Vietnamese  20 x 179  40 %
Cambria Math  Roman  Regular  Western  20 x 179  40 %
Cambria  Roman  Regular  Baltic  20 x 38  40 %
Cambria  Roman  Regular  Central European  20 x 38  40 %
Cambria  Roman  Regular  Cyrillic  20 x 38  40 %
Cambria  Roman  Regular  Greek  20 x 38  40 %
Cambria  Roman  Regular  Turkish  20 x 38  40 %
Cambria  Roman  Regular  Vietnamese  20 x 38  40 %
Cambria  Roman  Regular  Western  20 x 38  40 %
Candara Light  Swiss  Regular  Baltic  17 x 39  40 %
Candara Light  Swiss  Regular  Central European  17 x 39  40 %
Candara Light  Swiss  Regular  Cyrillic  17 x 39  40 %
Candara Light  Swiss  Regular  Greek  17 x 39  40 %
Candara Light  Swiss  Regular  Turkish  17 x 39  40 %
Candara Light  Swiss  Regular  Vietnamese  17 x 39  40 %
Candara Light  Swiss  Regular  Western  17 x 39  40 %
Candara  Swiss  Regular  Baltic  17 x 39  40 %
Candara  Swiss  Regular  Central European  17 x 39  40 %
Candara  Swiss  Regular  Cyrillic  17 x 39  40 %
Candara  Swiss  Regular  Greek  17 x 39  40 %
Candara  Swiss  Regular  Turkish  17 x 39  40 %
Candara  Swiss  Regular  Vietnamese  17 x 39  40 %
Candara  Swiss  Regular  Western  17 x 39  40 %
Cascadia Code ExtraLight  Modern  ExtraLight  Arabic  19 x 42  20 %
Cascadia Code ExtraLight  Modern  ExtraLight  Baltic  19 x 42  20 %
Cascadia Code ExtraLight  Modern  ExtraLight  Central European  19 x 42  20 %
Cascadia Code ExtraLight  Modern  ExtraLight  Cyrillic  19 x 42  20 %
Cascadia Code ExtraLight  Modern  ExtraLight  Greek  19 x 42  20 %
Cascadia Code ExtraLight  Modern  ExtraLight  Hebrew  19 x 42  20 %
Cascadia Code ExtraLight  Modern  ExtraLight  Turkish  19 x 42  20 %
Cascadia Code ExtraLight  Modern  ExtraLight  Vietnamese  19 x 42  20 %
Cascadia Code ExtraLight  Modern  ExtraLight  Western  19 x 42  20 %
Cascadia Code Light  Modern  Light  Arabic  19 x 42  30 %
Cascadia Code Light  Modern  Light  Baltic  19 x 42  30 %
Cascadia Code Light  Modern  Light  Central European  19 x 42  30 %
Cascadia Code Light  Modern  Light  Cyrillic  19 x 42  30 %
Cascadia Code Light  Modern  Light  Greek  19 x 42  30 %
Cascadia Code Light  Modern  Light  Hebrew  19 x 42  30 %
Cascadia Code Light  Modern  Light  Turkish  19 x 42  30 %
Cascadia Code Light  Modern  Light  Vietnamese  19 x 42  30 %
Cascadia Code Light  Modern  Light  Western  19 x 42  30 %
Cascadia Code SemiBold  Modern  SemiBold  Arabic  19 x 42  60 %
Cascadia Code SemiBold  Modern  SemiBold  Baltic  19 x 42  60 %
Cascadia Code SemiBold  Modern  SemiBold  Central European  19 x 42  60 %
Cascadia Code SemiBold  Modern  SemiBold  Cyrillic  19 x 42  60 %
Cascadia Code SemiBold  Modern  SemiBold  Greek  19 x 42  60 %
Cascadia Code SemiBold  Modern  SemiBold  Hebrew  19 x 42  60 %
Cascadia Code SemiBold  Modern  SemiBold  Turkish  19 x 42  60 %
Cascadia Code SemiBold  Modern  SemiBold  Vietnamese  19 x 42  60 %
Cascadia Code SemiBold  Modern  SemiBold  Western  19 x 42  60 %
Cascadia Code SemiLight  Modern  SemiLight  Arabic  19 x 42  35 %
Cascadia Code SemiLight  Modern  SemiLight  Baltic  19 x 42  35 %
Cascadia Code SemiLight  Modern  SemiLight  Central European  19 x 42  35 %
Cascadia Code SemiLight  Modern  SemiLight  Cyrillic  19 x 42  35 %
Cascadia Code SemiLight  Modern  SemiLight  Greek  19 x 42  35 %
Cascadia Code SemiLight  Modern  SemiLight  Hebrew  19 x 42  35 %
Cascadia Code SemiLight  Modern  SemiLight  Turkish  19 x 42  35 %
Cascadia Code SemiLight  Modern  SemiLight  Vietnamese  19 x 42  35 %
Cascadia Code SemiLight  Modern  SemiLight  Western  19 x 42  35 %
Cascadia Code  Modern  Regular  Arabic  19 x 42  40 %
Cascadia Code  Modern  Regular  Baltic  19 x 42  40 %
Cascadia Code  Modern  Regular  Central European  19 x 42  40 %
Cascadia Code  Modern  Regular  Cyrillic  19 x 42  40 %
Cascadia Code  Modern  Regular  Greek  19 x 42  40 %
Cascadia Code  Modern  Regular  Hebrew  19 x 42  40 %
Cascadia Code  Modern  Regular  Turkish  19 x 42  40 %
Cascadia Code  Modern  Regular  Vietnamese  19 x 42  40 %
Cascadia Code  Modern  Regular  Western  19 x 42  40 %
Cascadia Mono ExtraLight  Modern  ExtraLight  Arabic  19 x 42  20 %
Cascadia Mono ExtraLight  Modern  ExtraLight  Baltic  19 x 42  20 %
Cascadia Mono ExtraLight  Modern  ExtraLight  Central European  19 x 42  20 %
Cascadia Mono ExtraLight  Modern  ExtraLight  Cyrillic  19 x 42  20 %
Cascadia Mono ExtraLight  Modern  ExtraLight  Greek  19 x 42  20 %
Cascadia Mono ExtraLight  Modern  ExtraLight  Hebrew  19 x 42  20 %
Cascadia Mono ExtraLight  Modern  ExtraLight  Turkish  19 x 42  20 %
Cascadia Mono ExtraLight  Modern  ExtraLight  Vietnamese  19 x 42  20 %
Cascadia Mono ExtraLight  Modern  ExtraLight  Western  19 x 42  20 %
Cascadia Mono Light  Modern  Light  Arabic  19 x 42  30 %
Cascadia Mono Light  Modern  Light  Baltic  19 x 42  30 %
Cascadia Mono Light  Modern  Light  Central European  19 x 42  30 %
Cascadia Mono Light  Modern  Light  Cyrillic  19 x 42  30 %
Cascadia Mono Light  Modern  Light  Greek  19 x 42  30 %
Cascadia Mono Light  Modern  Light  Hebrew  19 x 42  30 %
Cascadia Mono Light  Modern  Light  Turkish  19 x 42  30 %
Cascadia Mono Light  Modern  Light  Vietnamese  19 x 42  30 %
Cascadia Mono Light  Modern  Light  Western  19 x 42  30 %
Cascadia Mono SemiBold  Modern  SemiBold  Arabic  19 x 42  60 %
Cascadia Mono SemiBold  Modern  SemiBold  Baltic  19 x 42  60 %
Cascadia Mono SemiBold  Modern  SemiBold  Central European  19 x 42  60 %
Cascadia Mono SemiBold  Modern  SemiBold  Cyrillic  19 x 42  60 %
Cascadia Mono SemiBold  Modern  SemiBold  Greek  19 x 42  60 %
Cascadia Mono SemiBold  Modern  SemiBold  Hebrew  19 x 42  60 %
Cascadia Mono SemiBold  Modern  SemiBold  Turkish  19 x 42  60 %
Cascadia Mono SemiBold  Modern  SemiBold  Vietnamese  19 x 42  60 %
Cascadia Mono SemiBold  Modern  SemiBold  Western  19 x 42  60 %
Cascadia Mono SemiLight  Modern  SemiLight  Arabic  19 x 42  35 %
Cascadia Mono SemiLight  Modern  SemiLight  Baltic  19 x 42  35 %
Cascadia Mono SemiLight  Modern  SemiLight  Central European  19 x 42  35 %
Cascadia Mono SemiLight  Modern  SemiLight  Cyrillic  19 x 42  35 %
Cascadia Mono SemiLight  Modern  SemiLight  Greek  19 x 42  35 %
Cascadia Mono SemiLight  Modern  SemiLight  Hebrew  19 x 42  35 %
Cascadia Mono SemiLight  Modern  SemiLight  Turkish  19 x 42  35 %
Cascadia Mono SemiLight  Modern  SemiLight  Vietnamese  19 x 42  35 %
Cascadia Mono SemiLight  Modern  SemiLight  Western  19 x 42  35 %
Cascadia Mono  Modern  Regular  Arabic  19 x 42  40 %
Cascadia Mono  Modern  Regular  Baltic  19 x 42  40 %
Cascadia Mono  Modern  Regular  Central European  19 x 42  40 %
Cascadia Mono  Modern  Regular  Cyrillic  19 x 42  40 %
Cascadia Mono  Modern  Regular  Greek  19 x 42  40 %
Cascadia Mono  Modern  Regular  Hebrew  19 x 42  40 %
Cascadia Mono  Modern  Regular  Turkish  19 x 42  40 %
Cascadia Mono  Modern  Regular  Vietnamese  19 x 42  40 %
Cascadia Mono  Modern  Regular  Western  19 x 42  40 %
Comic Sans MS  Script  Regular  Baltic  15 x 45  40 %
Comic Sans MS  Script  Regular  Central European  15 x 45  40 %
Comic Sans MS  Script  Regular  Cyrillic  15 x 45  40 %
Comic Sans MS  Script  Regular  Greek  15 x 45  40 %
Comic Sans MS  Script  Regular  Turkish  15 x 45  40 %
Comic Sans MS  Script  Regular  Western  15 x 45  40 %
Consolas  Modern  Regular  Baltic  18 x 37  40 %
Consolas  Modern  Regular  Central European  18 x 37  40 %
Consolas  Modern  Regular  Cyrillic  18 x 37  40 %
Consolas  Modern  Regular  Greek  18 x 37  40 %
Consolas  Modern  Regular  Turkish  18 x 37  40 %
Consolas  Modern  Regular  Vietnamese  18 x 37  40 %
Consolas  Modern  Regular  Western  18 x 37  40 %
Constantia  Roman  Regular  Baltic  17 x 39  40 %
Constantia  Roman  Regular  Central European  17 x 39  40 %
Constantia  Roman  Regular  Cyrillic  17 x 39  40 %
Constantia  Roman  Regular  Greek  17 x 39  40 %
Constantia  Roman  Regular  Turkish  17 x 39  40 %
Constantia  Roman  Regular  Vietnamese  17 x 39  40 %
Constantia  Roman  Regular  Western  17 x 39  40 %
Corbel Light  Swiss  Regular  Baltic  16 x 39  30 %
Corbel Light  Swiss  Regular  Central European  16 x 39  30 %
Corbel Light  Swiss  Regular  Cyrillic  16 x 39  30 %
Corbel Light  Swiss  Regular  Greek  16 x 39  30 %
Corbel Light  Swiss  Regular  Turkish  16 x 39  30 %
Corbel Light  Swiss  Regular  Vietnamese  16 x 39  30 %
Corbel Light  Swiss  Regular  Western  16 x 39  30 %
Corbel  Swiss  Regular  Baltic  17 x 39  40 %
Corbel  Swiss  Regular  Central European  17 x 39  40 %
Corbel  Swiss  Regular  Cyrillic  17 x 39  40 %
Corbel  Swiss  Regular  Greek  17 x 39  40 %
Corbel  Swiss  Regular  Turkish  17 x 39  40 %
Corbel  Swiss  Regular  Vietnamese  17 x 39  40 %
Corbel  Swiss  Regular  Western  17 x 39  40 %
Courier New  Modern  Regular  Arabic  19 x 36  40 %
Courier New  Modern  Regular  Baltic  19 x 36  40 %
Courier New  Modern  Regular  Central European  19 x 36  40 %
Courier New  Modern  Regular  Cyrillic  19 x 36  40 %
Courier New  Modern  Regular  Greek  19 x 36  40 %
Courier New  Modern  Regular  Hebrew  19 x 36  40 %
Courier New  Modern  Regular  Turkish  19 x 36  40 %
Courier New  Modern  Regular  Vietnamese  19 x 36  40 %
Courier New  Modern  Regular  Western  19 x 36  40 %
Courier  Modern    Western  8 x 13  40 %
Ebrima  Special  Regular  Baltic  19 x 43  40 %
Ebrima  Special  Regular  Central European  19 x 43  40 %
Ebrima  Special  Regular  Turkish  19 x 43  40 %
Ebrima  Special  Regular  Western  19 x 43  40 %
Fixedsys  Modern    Western  8 x 15  40 %
Franklin Gothic Medium  Swiss  Regular  Baltic  14 x 36  40 %
Franklin Gothic Medium  Swiss  Regular  Central European  14 x 36  40 %
Franklin Gothic Medium  Swiss  Regular  Cyrillic  14 x 36  40 %
Franklin Gothic Medium  Swiss  Regular  Greek  14 x 36  40 %
Franklin Gothic Medium  Swiss  Regular  Turkish  14 x 36  40 %
Franklin Gothic Medium  Swiss  Regular  Western  14 x 36  40 %
Gabriola  Decorative  Regular  Baltic  16 x 59  40 %
Gabriola  Decorative  Regular  Central European  16 x 59  40 %
Gabriola  Decorative  Regular  Cyrillic  16 x 59  40 %
Gabriola  Decorative  Regular  Greek  16 x 59  40 %
Gabriola  Decorative  Regular  Turkish  16 x 59  40 %
Gabriola  Decorative  Regular  Western  16 x 59  40 %
Gadugi  Swiss  Regular  Western  21 x 43  40 %
Georgia  Roman  Regular  Baltic  14 x 36  40 %
Georgia  Roman  Regular  Central European  14 x 36  40 %
Georgia  Roman  Regular  Cyrillic  14 x 36  40 %
Georgia  Roman  Regular  Greek  14 x 36  40 %
Georgia  Roman  Regular  Turkish  14 x 36  40 %
Georgia  Roman  Regular  Western  14 x 36  40 %
Impact  Swiss  Regular  Baltic  19 x 39  40 %
Impact  Swiss  Regular  Central European  19 x 39  40 %
Impact  Swiss  Regular  Cyrillic  19 x 39  40 %
Impact  Swiss  Regular  Greek  19 x 39  40 %
Impact  Swiss  Regular  Turkish  19 x 39  40 %
Impact  Swiss  Regular  Western  19 x 39  40 %
Ink Free  Script  Regular  Baltic  18 x 40  40 %
Ink Free  Script  Regular  Central European  18 x 40  40 %
Ink Free  Script  Regular  Cyrillic  18 x 40  40 %
Ink Free  Script  Regular  Greek  18 x 40  40 %
Ink Free  Script  Regular  Turkish  18 x 40  40 %
Ink Free  Script  Regular  Vietnamese  18 x 40  40 %
Ink Free  Script  Regular  Western  18 x 40  40 %
Javanese Text  Special  Regular  Western  26 x 73  40 %
Leelawadee UI Semilight  Swiss  Regular  Thai  17 x 43  35 %
Leelawadee UI Semilight  Swiss  Regular  Vietnamese  17 x 43  35 %
Leelawadee UI Semilight  Swiss  Regular  Western  17 x 43  35 %
Leelawadee UI  Swiss  Regular  Thai  17 x 43  40 %
Leelawadee UI  Swiss  Regular  Vietnamese  17 x 43  40 %
Leelawadee UI  Swiss  Regular  Western  17 x 43  40 %
Lucida Console  Modern  Regular  Central European  19 x 32  40 %
Lucida Console  Modern  Regular  Cyrillic  19 x 32  40 %
Lucida Console  Modern  Regular  Greek  19 x 32  40 %
Lucida Console  Modern  Regular  Turkish  19 x 32  40 %
Lucida Console  Modern  Regular  Western  19 x 32  40 %
Lucida Sans Unicode  Swiss  Regular  Baltic  16 x 49  40 %
Lucida Sans Unicode  Swiss  Regular  Central European  16 x 49  40 %
Lucida Sans Unicode  Swiss  Regular  Cyrillic  16 x 49  40 %
Lucida Sans Unicode  Swiss  Regular  Greek  16 x 49  40 %
Lucida Sans Unicode  Swiss  Regular  Hebrew  16 x 49  40 %
Lucida Sans Unicode  Swiss  Regular  Turkish  16 x 49  40 %
Lucida Sans Unicode  Swiss  Regular  Western  16 x 49  40 %
Malgun Gothic Semilight  Swiss  Regular  Baltic  31 x 43  30 %
Malgun Gothic Semilight  Swiss  Regular  CHINESE_BIG5  31 x 43  30 %
Malgun Gothic Semilight  Swiss  Regular  CHINESE_GB2312  31 x 43  30 %
Malgun Gothic Semilight  Swiss  Regular  Cyrillic  31 x 43  30 %
Malgun Gothic Semilight  Swiss  Regular  Greek  31 x 43  30 %
Malgun Gothic Semilight  Swiss  Regular  Hangul(Johab)  31 x 43  30 %
Malgun Gothic Semilight  Swiss  Regular  Hangul  31 x 43  30 %
Malgun Gothic Semilight  Swiss  Regular  Hebrew  31 x 43  30 %
Malgun Gothic Semilight  Swiss  Regular  Japanese  31 x 43  30 %
Malgun Gothic Semilight  Swiss  Regular  Turkish  31 x 43  30 %
Malgun Gothic Semilight  Swiss  Regular  Vietnamese  31 x 43  30 %
Malgun Gothic Semilight  Swiss  Regular  Western  31 x 43  30 %
Malgun Gothic  Swiss  Regular  Hangul  15 x 43  40 %
Malgun Gothic  Swiss  Regular  Western  15 x 43  40 %
Marlett  Special  Regular  Symbol  31 x 32  50 %
Microsoft Himalaya  Special  Regular  Western  13 x 32  40 %
Microsoft JhengHei Light  Swiss  Regular  CHINESE_BIG5  32 x 43  29 %
Microsoft JhengHei Light  Swiss  Regular  Greek  32 x 43  29 %
Microsoft JhengHei Light  Swiss  Regular  Western  32 x 43  29 %
Microsoft JhengHei UI Light  Swiss  Regular  CHINESE_BIG5  32 x 41  29 %
Microsoft JhengHei UI Light  Swiss  Regular  Greek  32 x 41  29 %
Microsoft JhengHei UI Light  Swiss  Regular  Western  32 x 41  29 %
Microsoft JhengHei UI  Swiss  Regular  CHINESE_BIG5  15 x 41  40 %
Microsoft JhengHei UI  Swiss  Regular  Greek  15 x 41  40 %
Microsoft JhengHei UI  Swiss  Regular  Western  15 x 41  40 %
Microsoft JhengHei  Swiss  Regular  CHINESE_BIG5  15 x 43  40 %
Microsoft JhengHei  Swiss  Regular  Greek  15 x 43  40 %
Microsoft JhengHei  Swiss  Regular  Western  15 x 43  40 %
Microsoft New Tai Lue  Swiss  Regular  Western  19 x 42  40 %
Microsoft PhagsPa  Swiss  Regular  Western  24 x 41  40 %
Microsoft Sans Serif  Swiss  Regular  Arabic  14 x 36  40 %
Microsoft Sans Serif  Swiss  Regular  Baltic  14 x 36  40 %
Microsoft Sans Serif  Swiss  Regular  Central European  14 x 36  40 %
Microsoft Sans Serif  Swiss  Regular  Cyrillic  14 x 36  40 %
Microsoft Sans Serif  Swiss  Regular  Greek  14 x 36  40 %
Microsoft Sans Serif  Swiss  Regular  Hebrew  14 x 36  40 %
Microsoft Sans Serif  Swiss  Regular  Thai  14 x 36  40 %
Microsoft Sans Serif  Swiss  Regular  Turkish  14 x 36  40 %
Microsoft Sans Serif  Swiss  Regular  Vietnamese  14 x 36  40 %
Microsoft Sans Serif  Swiss  Regular  Western  14 x 36  40 %
Microsoft Tai Le  Swiss  Regular  Western  19 x 41  40 %
Microsoft YaHei Light  Swiss  Regular  Central European  15 x 41  29 %
Microsoft YaHei Light  Swiss  Regular  CHINESE_GB2312  15 x 41  29 %
Microsoft YaHei Light  Swiss  Regular  Cyrillic  15 x 41  29 %
Microsoft YaHei Light  Swiss  Regular  Greek  15 x 41  29 %
Microsoft YaHei Light  Swiss  Regular  Turkish  15 x 41  29 %
Microsoft YaHei Light  Swiss  Regular  Western  15 x 41  29 %
Microsoft YaHei UI Light  Swiss  Regular  Central European  15 x 42  29 %
Microsoft YaHei UI Light  Swiss  Regular  CHINESE_GB2312  15 x 42  29 %
Microsoft YaHei UI Light  Swiss  Regular  Cyrillic  15 x 42  29 %
Microsoft YaHei UI Light  Swiss  Regular  Greek  15 x 42  29 %
Microsoft YaHei UI Light  Swiss  Regular  Turkish  15 x 42  29 %
Microsoft YaHei UI Light  Swiss  Regular  Western  15 x 42  29 %
Microsoft YaHei UI  Swiss  Regular  Central European  15 x 41  40 %
Microsoft YaHei UI  Swiss  Regular  CHINESE_GB2312  15 x 41  40 %
Microsoft YaHei UI  Swiss  Regular  Cyrillic  15 x 41  40 %
Microsoft YaHei UI  Swiss  Regular  Greek  15 x 41  40 %
Microsoft YaHei UI  Swiss  Regular  Turkish  15 x 41  40 %
Microsoft YaHei UI  Swiss  Regular  Western  15 x 41  40 %
Microsoft YaHei  Swiss  Regular  Central European  15 x 42  40 %
Microsoft YaHei  Swiss  Regular  CHINESE_GB2312  15 x 42  40 %
Microsoft YaHei  Swiss  Regular  Cyrillic  15 x 42  40 %
Microsoft YaHei  Swiss  Regular  Greek  15 x 42  40 %
Microsoft YaHei  Swiss  Regular  Turkish  15 x 42  40 %
Microsoft YaHei  Swiss  Regular  Western  15 x 42  40 %
Microsoft Yi Baiti  Script  Regular  Western  21 x 32  40 %
MingLiU_HKSCS-ExtB  Roman  Regular  CHINESE_BIG5  16 x 32  40 %
MingLiU_HKSCS-ExtB  Roman  Regular  Western  16 x 32  40 %
MingLiU_MSCS-ExtB  Roman  Regular  CHINESE_BIG5  16 x 32  40 %
MingLiU_MSCS-ExtB  Roman  Regular  Western  16 x 32  40 %
MingLiU-ExtB  Roman  Regular  CHINESE_BIG5  16 x 32  40 %
MingLiU-ExtB  Roman  Regular  Western  16 x 32  40 %
Modern  Modern    OEM/DOS  19 x 37  40 %
Mongolian Baiti  Script  Regular  Western  14 x 34  40 %
MS Gothic  Modern  Regular  Baltic  16 x 32  40 %
MS Gothic  Modern  Regular  Central European  16 x 32  40 %
MS Gothic  Modern  Regular  Cyrillic  16 x 32  40 %
MS Gothic  Modern  Regular  Greek  16 x 32  40 %
MS Gothic  Modern  Regular  Japanese  16 x 32  40 %
MS Gothic  Modern  Regular  Turkish  16 x 32  40 %
MS Gothic  Modern  Regular  Western  16 x 32  40 %
MS PGothic  Swiss  Regular  Baltic  13 x 32  40 %
MS PGothic  Swiss  Regular  Central European  13 x 32  40 %
MS PGothic  Swiss  Regular  Cyrillic  13 x 32  40 %
MS PGothic  Swiss  Regular  Greek  13 x 32  40 %
MS PGothic  Swiss  Regular  Japanese  13 x 32  40 %
MS PGothic  Swiss  Regular  Turkish  13 x 32  40 %
MS PGothic  Swiss  Regular  Western  13 x 32  40 %
MS Sans Serif  Swiss    Western  5 x 13  40 %
MS Serif  Roman    Western  5 x 13  40 %
MS UI Gothic  Swiss  Regular  Baltic  13 x 32  40 %
MS UI Gothic  Swiss  Regular  Central European  13 x 32  40 %
MS UI Gothic  Swiss  Regular  Cyrillic  13 x 32  40 %
MS UI Gothic  Swiss  Regular  Greek  13 x 32  40 %
MS UI Gothic  Swiss  Regular  Japanese  13 x 32  40 %
MS UI Gothic  Swiss  Regular  Turkish  13 x 32  40 %
MS UI Gothic  Swiss  Regular  Western  13 x 32  40 %
MV Boli  Special  Regular  Western  18 x 52  40 %
Myanmar Text  Swiss  Regular  Western  18 x 60  40 %
Nirmala Text Semilight  Swiss  Regular  Western  30 x 60  35 %
Nirmala Text  Swiss  Regular  Western  30 x 60  40 %
Nirmala UI Semilight  Swiss  Regular  Western  30 x 43  35 %
Nirmala UI  Swiss  Regular  Western  31 x 43  40 %
NSimSun  Modern  Regular  CHINESE_GB2312  16 x 32  40 %
NSimSun  Modern  Regular  Western  16 x 32  40 %
Palatino Linotype  Roman  Regular  Baltic  14 x 43  40 %
Palatino Linotype  Roman  Regular  Central European  14 x 43  40 %
Palatino Linotype  Roman  Regular  Cyrillic  14 x 43  40 %
Palatino Linotype  Roman  Regular  Greek  14 x 43  40 %
Palatino Linotype  Roman  Regular  Turkish  14 x 43  40 %
Palatino Linotype  Roman  Regular  Vietnamese  14 x 43  40 %
Palatino Linotype  Roman  Regular  Western  14 x 43  40 %
PMingLiU-ExtB  Roman  Regular  CHINESE_BIG5  16 x 32  40 %
PMingLiU-ExtB  Roman  Regular  Western  16 x 32  40 %
Roman  Roman    OEM/DOS  22 x 37  40 %
Sans Serif Collection  Swiss  Regular  Arabic  22 x 109  40 %
Sans Serif Collection  Swiss  Regular  Baltic  22 x 109  40 %
Sans Serif Collection  Swiss  Regular  Central European  22 x 109  40 %
Sans Serif Collection  Swiss  Regular  Cyrillic  22 x 109  40 %
Sans Serif Collection  Swiss  Regular  Greek  22 x 109  40 %
Sans Serif Collection  Swiss  Regular  Turkish  22 x 109  40 %
Sans Serif Collection  Swiss  Regular  Vietnamese  22 x 109  40 %
Sans Serif Collection  Swiss  Regular  Western  22 x 109  40 %
Script  Script    OEM/DOS  16 x 36  40 %
Segoe Fluent Icons  Roman  Regular  Western  32 x 32  40 %
Segoe MDL2 Assets  Roman  Regular  Western  33 x 32  40 %
Segoe Print  Special  Regular  Baltic  21 x 56  40 %
Segoe Print  Special  Regular  Central European  21 x 56  40 %
Segoe Print  Special  Regular  Cyrillic  21 x 56  40 %
Segoe Print  Special  Regular  Greek  21 x 56  40 %
Segoe Print  Special  Regular  Turkish  21 x 56  40 %
Segoe Print  Special  Regular  Western  21 x 56  40 %
Segoe Script  Script  Regular  Baltic  22 x 51  40 %
Segoe Script  Script  Regular  Central European  22 x 51  40 %
Segoe Script  Script  Regular  Cyrillic  22 x 51  40 %
Segoe Script  Script  Regular  Greek  22 x 51  40 %
Segoe Script  Script  Regular  Turkish  22 x 51  40 %
Segoe Script  Script  Regular  Western  22 x 51  40 %
Segoe UI Black  Swiss  Regular  Baltic  20 x 43  90 %
Segoe UI Black  Swiss  Regular  Central European  20 x 43  90 %
Segoe UI Black  Swiss  Regular  Cyrillic  20 x 43  90 %
Segoe UI Black  Swiss  Regular  Greek  20 x 43  90 %
Segoe UI Black  Swiss  Regular  Turkish  20 x 43  90 %
Segoe UI Black  Swiss  Regular  Vietnamese  20 x 43  90 %
Segoe UI Black  Swiss  Regular  Western  20 x 43  90 %
Segoe UI Emoji  Swiss  Regular  Western  44 x 43  40 %
Segoe UI Historic  Swiss  Regular  Western  27 x 43  40 %
Segoe UI Light  Swiss  Regular  Arabic  17 x 43  30 %
Segoe UI Light  Swiss  Regular  Baltic  17 x 43  30 %
Segoe UI Light  Swiss  Regular  Central European  17 x 43  30 %
Segoe UI Light  Swiss  Regular  Cyrillic  17 x 43  30 %
Segoe UI Light  Swiss  Regular  Greek  17 x 43  30 %
Segoe UI Light  Swiss  Regular  Hebrew  17 x 43  30 %
Segoe UI Light  Swiss  Regular  Turkish  17 x 43  30 %
Segoe UI Light  Swiss  Regular  Vietnamese  17 x 43  30 %
Segoe UI Light  Swiss  Regular  Western  17 x 43  30 %
Segoe UI Semibold  Swiss  Regular  Arabic  18 x 43  60 %
Segoe UI Semibold  Swiss  Regular  Baltic  18 x 43  60 %
Segoe UI Semibold  Swiss  Regular  Central European  18 x 43  60 %
Segoe UI Semibold  Swiss  Regular  Cyrillic  18 x 43  60 %
Segoe UI Semibold  Swiss  Regular  Greek  18 x 43  60 %
Segoe UI Semibold  Swiss  Regular  Hebrew  18 x 43  60 %
Segoe UI Semibold  Swiss  Regular  Turkish  18 x 43  60 %
Segoe UI Semibold  Swiss  Regular  Vietnamese  18 x 43  60 %
Segoe UI Semibold  Swiss  Regular  Western  18 x 43  60 %
Segoe UI Semilight  Swiss  Regular  Arabic  18 x 43  35 %
Segoe UI Semilight  Swiss  Regular  Baltic  18 x 43  35 %
Segoe UI Semilight  Swiss  Regular  Central European  18 x 43  35 %
Segoe UI Semilight  Swiss  Regular  Cyrillic  18 x 43  35 %
Segoe UI Semilight  Swiss  Regular  Greek  18 x 43  35 %
Segoe UI Semilight  Swiss  Regular  Hebrew  18 x 43  35 %
Segoe UI Semilight  Swiss  Regular  Turkish  18 x 43  35 %
Segoe UI Semilight  Swiss  Regular  Vietnamese  18 x 43  35 %
Segoe UI Semilight  Swiss  Regular  Western  18 x 43  35 %
Segoe UI Symbol  Swiss  Regular  Western  23 x 43  40 %
Segoe UI Variable Display Light  Special  Display Light  Baltic  18 x 43  30 %
Segoe UI Variable Display Light  Special  Display Light  Central European  18 x 43  30 %
Segoe UI Variable Display Light  Special  Display Light  Cyrillic  18 x 43  30 %
Segoe UI Variable Display Light  Special  Display Light  Greek  18 x 43  30 %
Segoe UI Variable Display Light  Special  Display Light  Turkish  18 x 43  30 %
Segoe UI Variable Display Light  Special  Display Light  Vietnamese  18 x 43  30 %
Segoe UI Variable Display Light  Special  Display Light  Western  18 x 43  30 %
Segoe UI Variable Display Semib  Special  Display Semibold  Baltic  18 x 43  60 %
Segoe UI Variable Display Semib  Special  Display Semibold  Central European  18 x 43  60 %
Segoe UI Variable Display Semib  Special  Display Semibold  Cyrillic  18 x 43  60 %
Segoe UI Variable Display Semib  Special  Display Semibold  Greek  18 x 43  60 %
Segoe UI Variable Display Semib  Special  Display Semibold  Turkish  18 x 43  60 %
Segoe UI Variable Display Semib  Special  Display Semibold  Vietnamese  18 x 43  60 %
Segoe UI Variable Display Semib  Special  Display Semibold  Western  18 x 43  60 %
Segoe UI Variable Display Semil  Special  Display Semilight  Baltic  18 x 43  35 %
Segoe UI Variable Display Semil  Special  Display Semilight  Central European  18 x 43  35 %
Segoe UI Variable Display Semil  Special  Display Semilight  Cyrillic  18 x 43  35 %
Segoe UI Variable Display Semil  Special  Display Semilight  Greek  18 x 43  35 %
Segoe UI Variable Display Semil  Special  Display Semilight  Turkish  18 x 43  35 %
Segoe UI Variable Display Semil  Special  Display Semilight  Vietnamese  18 x 43  35 %
Segoe UI Variable Display Semil  Special  Display Semilight  Western  18 x 43  35 %
Segoe UI Variable Display  Special  Display  Baltic  18 x 43  40 %
Segoe UI Variable Display  Special  Display  Central European  18 x 43  40 %
Segoe UI Variable Display  Special  Display  Cyrillic  18 x 43  40 %
Segoe UI Variable Display  Special  Display  Greek  18 x 43  40 %
Segoe UI Variable Display  Special  Display  Turkish  18 x 43  40 %
Segoe UI Variable Display  Special  Display  Vietnamese  18 x 43  40 %
Segoe UI Variable Display  Special  Display  Western  18 x 43  40 %
Segoe UI Variable Small Light  Special  Small Light  Baltic  18 x 43  30 %
Segoe UI Variable Small Light  Special  Small Light  Central European  18 x 43  30 %
Segoe UI Variable Small Light  Special  Small Light  Cyrillic  18 x 43  30 %
Segoe UI Variable Small Light  Special  Small Light  Greek  18 x 43  30 %
Segoe UI Variable Small Light  Special  Small Light  Turkish  18 x 43  30 %
Segoe UI Variable Small Light  Special  Small Light  Vietnamese  18 x 43  30 %
Segoe UI Variable Small Light  Special  Small Light  Western  18 x 43  30 %
Segoe UI Variable Small Semibol  Special  Small Semibold  Baltic  18 x 43  60 %
Segoe UI Variable Small Semibol  Special  Small Semibold  Central European  18 x 43  60 %
Segoe UI Variable Small Semibol  Special  Small Semibold  Cyrillic  18 x 43  60 %
Segoe UI Variable Small Semibol  Special  Small Semibold  Greek  18 x 43  60 %
Segoe UI Variable Small Semibol  Special  Small Semibold  Turkish  18 x 43  60 %
Segoe UI Variable Small Semibol  Special  Small Semibold  Vietnamese  18 x 43  60 %
Segoe UI Variable Small Semibol  Special  Small Semibold  Western  18 x 43  60 %
Segoe UI Variable Small Semilig  Special  Small Semilight  Baltic  18 x 43  35 %
Segoe UI Variable Small Semilig  Special  Small Semilight  Central European  18 x 43  35 %
Segoe UI Variable Small Semilig  Special  Small Semilight  Cyrillic  18 x 43  35 %
Segoe UI Variable Small Semilig  Special  Small Semilight  Greek  18 x 43  35 %
Segoe UI Variable Small Semilig  Special  Small Semilight  Turkish  18 x 43  35 %
Segoe UI Variable Small Semilig  Special  Small Semilight  Vietnamese  18 x 43  35 %
Segoe UI Variable Small Semilig  Special  Small Semilight  Western  18 x 43  35 %
Segoe UI Variable Small  Special  Small  Baltic  18 x 43  40 %
Segoe UI Variable Small  Special  Small  Central European  18 x 43  40 %
Segoe UI Variable Small  Special  Small  Cyrillic  18 x 43  40 %
Segoe UI Variable Small  Special  Small  Greek  18 x 43  40 %
Segoe UI Variable Small  Special  Small  Turkish  18 x 43  40 %
Segoe UI Variable Small  Special  Small  Vietnamese  18 x 43  40 %
Segoe UI Variable Small  Special  Small  Western  18 x 43  40 %
Segoe UI Variable Text Light  Special  Text Light  Baltic  18 x 43  30 %
Segoe UI Variable Text Light  Special  Text Light  Central European  18 x 43  30 %
Segoe UI Variable Text Light  Special  Text Light  Cyrillic  18 x 43  30 %
Segoe UI Variable Text Light  Special  Text Light  Greek  18 x 43  30 %
Segoe UI Variable Text Light  Special  Text Light  Turkish  18 x 43  30 %
Segoe UI Variable Text Light  Special  Text Light  Vietnamese  18 x 43  30 %
Segoe UI Variable Text Light  Special  Text Light  Western  18 x 43  30 %
Segoe UI Variable Text Semibold  Special  Text Semibold  Baltic  18 x 43  60 %
Segoe UI Variable Text Semibold  Special  Text Semibold  Central European  18 x 43  60 %
Segoe UI Variable Text Semibold  Special  Text Semibold  Cyrillic  18 x 43  60 %
Segoe UI Variable Text Semibold  Special  Text Semibold  Greek  18 x 43  60 %
Segoe UI Variable Text Semibold  Special  Text Semibold  Turkish  18 x 43  60 %
Segoe UI Variable Text Semibold  Special  Text Semibold  Vietnamese  18 x 43  60 %
Segoe UI Variable Text Semibold  Special  Text Semibold  Western  18 x 43  60 %
Segoe UI Variable Text Semiligh  Special  Text Semilight  Baltic  18 x 43  35 %
Segoe UI Variable Text Semiligh  Special  Text Semilight  Central European  18 x 43  35 %
Segoe UI Variable Text Semiligh  Special  Text Semilight  Cyrillic  18 x 43  35 %
Segoe UI Variable Text Semiligh  Special  Text Semilight  Greek  18 x 43  35 %
Segoe UI Variable Text Semiligh  Special  Text Semilight  Turkish  18 x 43  35 %
Segoe UI Variable Text Semiligh  Special  Text Semilight  Vietnamese  18 x 43  35 %
Segoe UI Variable Text Semiligh  Special  Text Semilight  Western  18 x 43  35 %
Segoe UI Variable Text  Special  Text  Baltic  18 x 43  40 %
Segoe UI Variable Text  Special  Text  Central European  18 x 43  40 %
Segoe UI Variable Text  Special  Text  Cyrillic  18 x 43  40 %
Segoe UI Variable Text  Special  Text  Greek  18 x 43  40 %
Segoe UI Variable Text  Special  Text  Turkish  18 x 43  40 %
Segoe UI Variable Text  Special  Text  Vietnamese  18 x 43  40 %
Segoe UI Variable Text  Special  Text  Western  18 x 43  40 %
Segoe UI  Swiss  Regular  Arabic  17 x 43  40 %
Segoe UI  Swiss  Regular  Baltic  17 x 43  40 %
Segoe UI  Swiss  Regular  Central European  17 x 43  40 %
Segoe UI  Swiss  Regular  Cyrillic  17 x 43  40 %
Segoe UI  Swiss  Regular  Greek  17 x 43  40 %
Segoe UI  Swiss  Regular  Hebrew  17 x 43  40 %
Segoe UI  Swiss  Regular  Turkish  17 x 43  40 %
Segoe UI  Swiss  Regular  Vietnamese  17 x 43  40 %
Segoe UI  Swiss  Regular  Western  17 x 43  40 %
SimSun  Special  Regular  CHINESE_GB2312  16 x 32  40 %
SimSun  Special  Regular  Western  16 x 32  40 %
SimSun-ExtB  Modern  Regular  CHINESE_GB2312  16 x 32  40 %
SimSun-ExtB  Modern  Regular  Western  16 x 32  40 %
SimSun-ExtG  Modern  Regular  CHINESE_GB2312  16 x 32  40 %
SimSun-ExtG  Modern  Regular  Western  16 x 32  40 %
Sitka Banner Semibold  Special  Banner Semibold  Baltic  19 x 46  60 %
Sitka Banner Semibold  Special  Banner Semibold  Central European  19 x 46  60 %
Sitka Banner Semibold  Special  Banner Semibold  Cyrillic  19 x 46  60 %
Sitka Banner Semibold  Special  Banner Semibold  Greek  19 x 46  60 %
Sitka Banner Semibold  Special  Banner Semibold  Turkish  19 x 46  60 %
Sitka Banner Semibold  Special  Banner Semibold  Vietnamese  19 x 46  60 %
Sitka Banner Semibold  Special  Banner Semibold  Western  19 x 46  60 %
Sitka Banner  Special  Banner  Baltic  19 x 46  40 %
Sitka Banner  Special  Banner  Central European  19 x 46  40 %
Sitka Banner  Special  Banner  Cyrillic  19 x 46  40 %
Sitka Banner  Special  Banner  Greek  19 x 46  40 %
Sitka Banner  Special  Banner  Turkish  19 x 46  40 %
Sitka Banner  Special  Banner  Vietnamese  19 x 46  40 %
Sitka Banner  Special  Banner  Western  19 x 46  40 %
Sitka Display Semibold  Special  Display Semibold  Baltic  19 x 46  60 %
Sitka Display Semibold  Special  Display Semibold  Central European  19 x 46  60 %
Sitka Display Semibold  Special  Display Semibold  Cyrillic  19 x 46  60 %
Sitka Display Semibold  Special  Display Semibold  Greek  19 x 46  60 %
Sitka Display Semibold  Special  Display Semibold  Turkish  19 x 46  60 %
Sitka Display Semibold  Special  Display Semibold  Vietnamese  19 x 46  60 %
Sitka Display Semibold  Special  Display Semibold  Western  19 x 46  60 %
Sitka Display  Special  Display  Baltic  19 x 46  40 %
Sitka Display  Special  Display  Central European  19 x 46  40 %
Sitka Display  Special  Display  Cyrillic  19 x 46  40 %
Sitka Display  Special  Display  Greek  19 x 46  40 %
Sitka Display  Special  Display  Turkish  19 x 46  40 %
Sitka Display  Special  Display  Vietnamese  19 x 46  40 %
Sitka Display  Special  Display  Western  19 x 46  40 %
Sitka Heading Semibold  Special  Heading Semibold  Baltic  19 x 46  60 %
Sitka Heading Semibold  Special  Heading Semibold  Central European  19 x 46  60 %
Sitka Heading Semibold  Special  Heading Semibold  Cyrillic  19 x 46  60 %
Sitka Heading Semibold  Special  Heading Semibold  Greek  19 x 46  60 %
Sitka Heading Semibold  Special  Heading Semibold  Turkish  19 x 46  60 %
Sitka Heading Semibold  Special  Heading Semibold  Vietnamese  19 x 46  60 %
Sitka Heading Semibold  Special  Heading Semibold  Western  19 x 46  60 %
Sitka Heading  Special  Heading  Baltic  19 x 46  40 %
Sitka Heading  Special  Heading  Central European  19 x 46  40 %
Sitka Heading  Special  Heading  Cyrillic  19 x 46  40 %
Sitka Heading  Special  Heading  Greek  19 x 46  40 %
Sitka Heading  Special  Heading  Turkish  19 x 46  40 %
Sitka Heading  Special  Heading  Vietnamese  19 x 46  40 %
Sitka Heading  Special  Heading  Western  19 x 46  40 %
Sitka Small Semibold  Special  Small Semibold  Baltic  19 x 46  60 %
Sitka Small Semibold  Special  Small Semibold  Central European  19 x 46  60 %
Sitka Small Semibold  Special  Small Semibold  Cyrillic  19 x 46  60 %
Sitka Small Semibold  Special  Small Semibold  Greek  19 x 46  60 %
Sitka Small Semibold  Special  Small Semibold  Turkish  19 x 46  60 %
Sitka Small Semibold  Special  Small Semibold  Vietnamese  19 x 46  60 %
Sitka Small Semibold  Special  Small Semibold  Western  19 x 46  60 %
Sitka Small  Special  Small  Baltic  19 x 46  40 %
Sitka Small  Special  Small  Central European  19 x 46  40 %
Sitka Small  Special  Small  Cyrillic  19 x 46  40 %
Sitka Small  Special  Small  Greek  19 x 46  40 %
Sitka Small  Special  Small  Turkish  19 x 46  40 %
Sitka Small  Special  Small  Vietnamese  19 x 46  40 %
Sitka Small  Special  Small  Western  19 x 46  40 %
Sitka Subheading Semibold  Special  Subheading Semibold  Baltic  19 x 46  60 %
Sitka Subheading Semibold  Special  Subheading Semibold  Central European  19 x 46  60 %
Sitka Subheading Semibold  Special  Subheading Semibold  Cyrillic  19 x 46  60 %
Sitka Subheading Semibold  Special  Subheading Semibold  Greek  19 x 46  60 %
Sitka Subheading Semibold  Special  Subheading Semibold  Turkish  19 x 46  60 %
Sitka Subheading Semibold  Special  Subheading Semibold  Vietnamese  19 x 46  60 %
Sitka Subheading Semibold  Special  Subheading Semibold  Western  19 x 46  60 %
Sitka Subheading  Special  Subheading  Baltic  19 x 46  40 %
Sitka Subheading  Special  Subheading  Central European  19 x 46  40 %
Sitka Subheading  Special  Subheading  Cyrillic  19 x 46  40 %
Sitka Subheading  Special  Subheading  Greek  19 x 46  40 %
Sitka Subheading  Special  Subheading  Turkish  19 x 46  40 %
Sitka Subheading  Special  Subheading  Vietnamese  19 x 46  40 %
Sitka Subheading  Special  Subheading  Western  19 x 46  40 %
Sitka Text Semibold  Special  Text Semibold  Baltic  19 x 46  60 %
Sitka Text Semibold  Special  Text Semibold  Central European  19 x 46  60 %
Sitka Text Semibold  Special  Text Semibold  Cyrillic  19 x 46  60 %
Sitka Text Semibold  Special  Text Semibold  Greek  19 x 46  60 %
Sitka Text Semibold  Special  Text Semibold  Turkish  19 x 46  60 %
Sitka Text Semibold  Special  Text Semibold  Vietnamese  19 x 46  60 %
Sitka Text Semibold  Special  Text Semibold  Western  19 x 46  60 %
Sitka Text  Special  Text  Baltic  19 x 46  40 %
Sitka Text  Special  Text  Central European  19 x 46  40 %
Sitka Text  Special  Text  Cyrillic  19 x 46  40 %
Sitka Text  Special  Text  Greek  19 x 46  40 %
Sitka Text  Special  Text  Turkish  19 x 46  40 %
Sitka Text  Special  Text  Vietnamese  19 x 46  40 %
Sitka Text  Special  Text  Western  19 x 46  40 %
Small Fonts  Swiss    Western  1 x 3  40 %
Sylfaen  Roman  Regular  Baltic  13 x 42  40 %
Sylfaen  Roman  Regular  Central European  13 x 42  40 %
Sylfaen  Roman  Regular  Cyrillic  13 x 42  40 %
Sylfaen  Roman  Regular  Greek  13 x 42  40 %
Sylfaen  Roman  Regular  Turkish  13 x 42  40 %
Sylfaen  Roman  Regular  Western  13 x 42  40 %
Symbol  Roman  Regular  Symbol  19 x 39  40 %
System  Swiss    Western  7 x 16  70 %
Tahoma  Swiss  Regular  Arabic  14 x 39  40 %
Tahoma  Swiss  Regular  Baltic  14 x 39  40 %
Tahoma  Swiss  Regular  Central European  14 x 39  40 %
Tahoma  Swiss  Regular  Cyrillic  14 x 39  40 %
Tahoma  Swiss  Regular  Greek  14 x 39  40 %
Tahoma  Swiss  Regular  Hebrew  14 x 39  40 %
Tahoma  Swiss  Regular  Thai  14 x 39  40 %
Tahoma  Swiss  Regular  Turkish  14 x 39  40 %
Tahoma  Swiss  Regular  Vietnamese  14 x 39  40 %
Tahoma  Swiss  Regular  Western  14 x 39  40 %
Terminal  Modern    OEM/DOS  8 x 12  40 %
Times New Roman  Roman  Regular  Arabic  13 x 35  40 %
Times New Roman  Roman  Regular  Baltic  13 x 35  40 %
Times New Roman  Roman  Regular  Central European  13 x 35  40 %
Times New Roman  Roman  Regular  Cyrillic  13 x 35  40 %
Times New Roman  Roman  Regular  Greek  13 x 35  40 %
Times New Roman  Roman  Regular  Hebrew  13 x 35  40 %
Times New Roman  Roman  Regular  Turkish  13 x 35  40 %
Times New Roman  Roman  Regular  Vietnamese  13 x 35  40 %
Times New Roman  Roman  Regular  Western  13 x 35  40 %
Trebuchet MS  Swiss  Regular  Baltic  15 x 37  40 %
Trebuchet MS  Swiss  Regular  Central European  15 x 37  40 %
Trebuchet MS  Swiss  Regular  Cyrillic  15 x 37  40 %
Trebuchet MS  Swiss  Regular  Greek  15 x 37  40 %
Trebuchet MS  Swiss  Regular  Turkish  15 x 37  40 %
Trebuchet MS  Swiss  Regular  Western  15 x 37  40 %
Verdana  Swiss  Regular  Baltic  16 x 39  40 %
Verdana  Swiss  Regular  Central European  16 x 39  40 %
Verdana  Swiss  Regular  Cyrillic  16 x 39  40 %
Verdana  Swiss  Regular  Greek  16 x 39  40 %
Verdana  Swiss  Regular  Turkish  16 x 39  40 %
Verdana  Swiss  Regular  Vietnamese  16 x 39  40 %
Verdana  Swiss  Regular  Western  16 x 39  40 %
Webdings  Roman  Regular  Symbol  31 x 32  40 %
Wingdings  Special  Regular  Symbol  28 x 36  40 %
Yu Gothic Light  Swiss  Regular  Baltic  31 x 41  30 %
Yu Gothic Light  Swiss  Regular  Central European  31 x 41  30 %
Yu Gothic Light  Swiss  Regular  Cyrillic  31 x 41  30 %
Yu Gothic Light  Swiss  Regular  Greek  31 x 41  30 %
Yu Gothic Light  Swiss  Regular  Japanese  31 x 41  30 %
Yu Gothic Light  Swiss  Regular  Turkish  31 x 41  30 %
Yu Gothic Light  Swiss  Regular  Western  31 x 41  30 %
Yu Gothic Medium  Swiss  Regular  Baltic  31 x 41  50 %
Yu Gothic Medium  Swiss  Regular  Central European  31 x 41  50 %
Yu Gothic Medium  Swiss  Regular  Cyrillic  31 x 41  50 %
Yu Gothic Medium  Swiss  Regular  Greek  31 x 41  50 %
Yu Gothic Medium  Swiss  Regular  Japanese  31 x 41  50 %
Yu Gothic Medium  Swiss  Regular  Turkish  31 x 41  50 %
Yu Gothic Medium  Swiss  Regular  Western  31 x 41  50 %
Yu Gothic UI Light  Swiss  Regular  Baltic  17 x 43  30 %
Yu Gothic UI Light  Swiss  Regular  Central European  17 x 43  30 %
Yu Gothic UI Light  Swiss  Regular  Cyrillic  17 x 43  30 %
Yu Gothic UI Light  Swiss  Regular  Greek  17 x 43  30 %
Yu Gothic UI Light  Swiss  Regular  Japanese  17 x 43  30 %
Yu Gothic UI Light  Swiss  Regular  Turkish  17 x 43  30 %
Yu Gothic UI Light  Swiss  Regular  Western  17 x 43  30 %
Yu Gothic UI Semibold  Swiss  Regular  Baltic  19 x 43  60 %
Yu Gothic UI Semibold  Swiss  Regular  Central European  19 x 43  60 %
Yu Gothic UI Semibold  Swiss  Regular  Cyrillic  19 x 43  60 %
Yu Gothic UI Semibold  Swiss  Regular  Greek  19 x 43  60 %
Yu Gothic UI Semibold  Swiss  Regular  Japanese  19 x 43  60 %
Yu Gothic UI Semibold  Swiss  Regular  Turkish  19 x 43  60 %
Yu Gothic UI Semibold  Swiss  Regular  Western  19 x 43  60 %
Yu Gothic UI Semilight  Swiss  Regular  Baltic  17 x 43  35 %
Yu Gothic UI Semilight  Swiss  Regular  Central European  17 x 43  35 %
Yu Gothic UI Semilight  Swiss  Regular  Cyrillic  17 x 43  35 %
Yu Gothic UI Semilight  Swiss  Regular  Greek  17 x 43  35 %
Yu Gothic UI Semilight  Swiss  Regular  Japanese  17 x 43  35 %
Yu Gothic UI Semilight  Swiss  Regular  Turkish  17 x 43  35 %
Yu Gothic UI Semilight  Swiss  Regular  Western  17 x 43  35 %
Yu Gothic UI  Swiss  Regular  Baltic  17 x 43  40 %
Yu Gothic UI  Swiss  Regular  Central European  17 x 43  40 %
Yu Gothic UI  Swiss  Regular  Cyrillic  17 x 43  40 %
Yu Gothic UI  Swiss  Regular  Greek  17 x 43  40 %
Yu Gothic UI  Swiss  Regular  Japanese  17 x 43  40 %
Yu Gothic UI  Swiss  Regular  Turkish  17 x 43  40 %
Yu Gothic UI  Swiss  Regular  Western  17 x 43  40 %
Yu Gothic  Swiss  Regular  Baltic  31 x 41  40 %
Yu Gothic  Swiss  Regular  Central European  31 x 41  40 %
Yu Gothic  Swiss  Regular  Cyrillic  31 x 41  40 %
Yu Gothic  Swiss  Regular  Greek  31 x 41  40 %
Yu Gothic  Swiss  Regular  Japanese  31 x 41  40 %
Yu Gothic  Swiss  Regular  Turkish  31 x 41  40 %
Yu Gothic  Swiss  Regular  Western  31 x 41  40 %


Windows Audio
 
Device  Identifier  Device Description
midi-out.0  0001 001B  Microsoft GS Wavetable Synth
mixer.0  0001 FFFF  Speakers (High Definition Audio
wave-out.0  0001 FFFF  Speakers (High Definition Audio


PCI / PnP Audio
 
Device Description  Type
Realtek ALC256 @ Intel Arrow Point PCH - Audio Context Engine  PCI


HD Audio
 
[ Intel Arrow Point PCH - Audio Context Engine ]
 
Device Properties:
Device Description  Intel Arrow Point PCH - Audio Context Engine
Device Description (Windows)  High Definition Audio Controller
Bus Type  PCI
Bus / Device / Function  128 / 31 / 3
Device ID  8086-7F50
Subsystem ID  103C-8D17
Revision  10
Hardware ID  PCI\VEN_8086&DEV_7F50&SUBSYS_8D17103C&REV_10
 
Device Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/products/chipsets
Driver Download  https://www.intel.com/support/chipsets
BIOS Upgrades  http://www.aida64.com/goto/?p=biosupdates
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Realtek ALC256 ]
 
Device Properties:
Device Description  Realtek ALC256
Device Description (Windows)  High Definition Audio Device
Device Type  Audio
Bus Type  HDAUDIO
Device ID  10EC-0256
Subsystem ID  103C-8D17
Revision  1000
Hardware ID  HDAUDIO\FUNC_01&VEN_10EC&DEV_0256&SUBSYS_103C8D17&REV_1000
 
Device Manufacturer:
Company Name  Realtek Semiconductor Corp.
Product Information  https://www.realtek.com/products
Driver Download  https://www.realtek.com/downloads
Driver Update  http://www.aida64.com/goto/?p=drvupdates


Audio Codecs
 
[ Fraunhofer IIS MPEG Layer-3 Codec (decode only) ]
 
ACM Driver Properties:
Driver Description  Fraunhofer IIS MPEG Layer-3 Codec (decode only)
Copyright Notice  Copyright © 1996-1999 Fraunhofer Institut Integrierte Schaltungen IIS
Driver Features  decoder only version
Driver Version  1.09
 
[ Microsoft ADPCM CODEC ]
 
ACM Driver Properties:
Driver Description  Microsoft ADPCM CODEC
Copyright Notice  Copyright (C) 1992-1996 Microsoft Corporation
Driver Features  Compresses and decompresses Microsoft ADPCM audio data.
Driver Version  4.00
 
[ Microsoft CCITT G.711 A-Law and u-Law CODEC ]
 
ACM Driver Properties:
Driver Description  Microsoft CCITT G.711 A-Law and u-Law CODEC
Copyright Notice  Copyright (c) 1993-1996 Microsoft Corporation
Driver Features  Compresses and decompresses CCITT G.711 A-Law and u-Law audio data.
Driver Version  4.00
 
[ Microsoft GSM 6.10 Audio CODEC ]
 
ACM Driver Properties:
Driver Description  Microsoft GSM 6.10 Audio CODEC
Copyright Notice  Copyright (C) 1993-1996 Microsoft Corporation
Driver Features  Compresses and decompresses audio data conforming to the ETSI-GSM (European Telecommunications Standards Institute-Groupe Special Mobile) recommendation 6.10.
Driver Version  4.00
 
[ Microsoft IMA ADPCM CODEC ]
 
ACM Driver Properties:
Driver Description  Microsoft IMA ADPCM CODEC
Copyright Notice  Copyright (C) 1992-1996 Microsoft Corporation
Driver Features  Compresses and decompresses IMA ADPCM audio data.
Driver Version  4.00
 
[ Microsoft PCM Converter ]
 
ACM Driver Properties:
Driver Description  Microsoft PCM Converter
Copyright Notice  Copyright (C) 1992-1996 Microsoft Corporation
Driver Features  Converts frequency and bits per sample of PCM audio data.
Driver Version  5.00


Video Codecs
 
Driver  Version  Description
iyuv_32.dll  10.0.26100.1 (WinBuild.160101.0800)  Intel Indeo(R) Video YUV Codec
msrle32.dll  10.0.26100.1882 (WinBuild.160101.0800)  Microsoft RLE Compressor
msvidc32.dll  10.0.26100.1 (WinBuild.160101.0800)  Microsoft Video 1 Compressor
msyuv.dll  10.0.26100.1150 (WinBuild.160101.0800)  Microsoft UYVY Video Decompressor
tsbyuv.dll  10.0.26100.1150 (WinBuild.160101.0800)  Toshiba Video Codec


MCI
 
[ AVIVideo ]
 
MCI Device Properties:
Device  AVIVideo
Name  Video for Windows
Description  Video For Windows MCI driver
Type  Digital Video Device
Driver  mciavi32.dll
Status  Enabled
 
MCI Device Features:
Compound Device  Yes
File Based Device  Yes
Can Eject  No
Can Play  Yes
Can Play In Reverse  Yes
Can Record  No
Can Save Data  No
Can Freeze Data  No
Can Lock Data  No
Can Stretch Frame  Yes
Can Stretch Input  No
Can Test  Yes
Audio Capable  Yes
Video Capable  Yes
Still Image Capable  No
 
[ CDAudio ]
 
MCI Device Properties:
Device  CDAudio
Description  MCI driver for cdaudio devices
Driver  mcicda.dll
Status  Enabled
 
[ MPEGVideo ]
 
MCI Device Properties:
Device  MPEGVideo
Name  DirectShow
Description  DirectShow MCI Driver
Type  Digital Video Device
Driver  mciqtz32.dll
Status  Enabled
 
MCI Device Features:
Compound Device  Yes
File Based Device  Yes
Can Eject  No
Can Play  Yes
Can Play In Reverse  No
Can Record  No
Can Save Data  No
Can Freeze Data  No
Can Lock Data  No
Can Stretch Frame  Yes
Can Stretch Input  No
Can Test  Yes
Audio Capable  Yes
Video Capable  Yes
Still Image Capable  No
 
[ Sequencer ]
 
MCI Device Properties:
Device  Sequencer
Name  MIDI Sequencer
Description  MCI driver for MIDI sequencer
Type  Sequencer Device
Driver  mciseq.dll
Status  Enabled
 
MCI Device Features:
Compound Device  Yes
File Based Device  Yes
Can Eject  No
Can Play  Yes
Can Record  No
Can Save Data  No
Audio Capable  Yes
Video Capable  No
 
[ WaveAudio ]
 
MCI Device Properties:
Device  WaveAudio
Name  Sound
Description  MCI driver for waveform audio
Type  Waveform Audio Device
Driver  mciwave.dll
Status  Enabled
 
MCI Device Features:
Compound Device  Yes
File Based Device  Yes
Can Eject  No
Can Play  Yes
Can Record  No
Can Save Data  Yes
Audio Capable  Yes
Video Capable  No


SAPI
 
SAPI Properties:
SAPI4 Version  -
SAPI5 Version  5.3.31125.0
 
Voice (SAPI5):
Name  Microsoft David Desktop - English (United States)
Voice Path  C:\WINDOWS\Speech_OneCore\Engines\TTS\en-US\M1033David
Age  Adult
Gender  Male
Language  English (United States)
Vendor  Microsoft
Version  11.0
DLL File  C:\Windows\System32\speech_onecore\engines\tts\MSTTSEngine_OneCore.dll (x64)
CLSID  {179F3D56-1B0B-42B2-A962-59B7EF59FE1B}
 
Voice (SAPI5):
Name  Microsoft Zira Desktop - English (United States)
Voice Path  C:\WINDOWS\Speech\Engines\TTS\en-US\M1033ZIR
Age  Adult
Gender  Female
Language  English (United States)
Vendor  Microsoft
Version  11.0
DLL File  C:\Windows\System32\speech\engines\tts\MSTTSEngine.dll (x64)
CLSID  {C64501F6-E6E6-451f-A150-25D0839BC510}
 
Speech Recognizer (SAPI5):
Name  Microsoft Speech Recognizer 8.0 for Windows (English - US)
Description  Microsoft Speech Recognizer 8.0 for Windows (English - US)
FE Config Data File  C:\WINDOWS\Speech\Engines\SR\en-US\c1033dsk.fe
Language  English (United States); English
Speaking Style  Discrete;Continuous
Supported Locales  English (United States); English (Canada); English (Philippines); English
Vendor  Microsoft
Version  8.0
DLL File  C:\WINDOWS\System32\Speech\Engines\SR\spsreng.dll (x64)
CLSID  {DAC9F469-0C67-4643-9258-87EC128C5941}
RecoExtension  {4F4DB904-CA35-4A3A-90AF-C9D8BE7532AC}


Windows Storage
 
[ KINGSTON OM8PJP4512K3-AH0 ]
 
Device Properties:
Driver Description  KINGSTON OM8PJP4512K3-AH0
Driver Date  6/21/2006
Driver Version  10.0.26100.7705
Driver Provider  Microsoft
INF File  disk.inf
INF Section  disk_install.NT
 
[ Microsoft Storage Spaces Controller ]
 
Device Properties:
Driver Description  Microsoft Storage Spaces Controller
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  spaceport.inf
INF Section  Spaceport_Install
 
[ Standard NVM Express Controller ]
 
Device Properties:
Driver Description  Standard NVM Express Controller
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  stornvme.inf
INF Section  Stornvme_Inst
 
Device Resources:
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
Memory  90000000-90003FFF


Logical Drives
 
Drive  Drive Type  File System  Total Size  Used Space  Free Space  % Free  Volume Serial
C:  Local Disk  NTFS  487387 MB  38847 MB  448540 MB  92 %  046D-0827


Physical Drives
 
[ Drive #1 - KINGSTON OM8PJP4512K3-AH0 (0000_0000_0000_0000_0026_B738_48BD_3330.) [476 GB] C: ]
 
Partition  Partition Type  Drive  Start Offset  Partition Length
#1  EFI System    1 MB  200 MB
#2  MS Reserved    201 MB  16 MB
#3  Basic Data  J:  217 MB  487388 MB
#4  MS Recovery    487605 MB  780 MB


ASPI
 
Host  ID  LUN  Device Type  Vendor  Model  Rev  Extra Information
00  00  00  Disk Drive  NVMe  KINGSTON OM8PJP4  HPS0  
00  07  00  Host Adapter  stornvme      


ATA
 
[ KINGSTON OM8PJP4512K3-AH0 (0026B73848BD3330) ]
 
NVMe Device Properties:
Model ID  KINGSTON OM8PJP4512K3-AH0
Serial Number  0026B73848BD3330
Revision  HPS0
Device Type  NVMe v2.0.0
Unformatted Capacity  488386 MB
PCI Vendor ID  2646h
PCI Subsystem Vendor ID  2646h
IEEE OUI Identifier  B7-26-00
Controller ID  1
Version  131072
Controller Type  I/O Controller
Extended Device Self-test Time  10 min
Recommended Arbitration Burst Size  6
Max Data Transfer Size  6
Runtime D3 Resume Latency  100000 us
Runtime D3 Entry Latency  1000000 us
Abort Command Limit  4
Asynchronous Event Request Limit  8
Firmware Slots  2
Firmware Update Granularity  16 KB
Max Error Log Page Entries  256
Persistent Event Log Size  6144 KB
Power States  5
Warning Composite Temperature Threshold  83 °C
Critical Composite Temperature Threshold  85 °C
Max Thermal Management Temperature  83 °C
Max Time For Firmware Activation  5 sec
Host Memory Buffer Preferred Size  65536 KB
Host Memory Buffer Min Size  65536 KB
Host Memory Buffer Min Descriptor Entry Size  4096 KB
Host Memory Max Descriptors Entries  16
Min / Max Submission Queue Entry Size  64 / 64 bytes
Min / Max Completion Queue Entry Size  16 / 16 bytes
Namespaces  1
Atomic Write Unit Normal  256 blocks
Atomic Write Unit Power Fail  1 blocks
 
NVMe Device Features:
128-bit Host Identifier  Not Supported
ANA Change State Reporting  Not Supported
ANA Inaccessible State Reporting  Not Supported
ANA Non-Optimized State Reporting  Not Supported
ANA Optimized State Reporting  Not Supported
ANA Persistent Loss State Reporting  Not Supported
Asymmetric Namespace Access Reporting  Not Supported
Autonomous Power State Transitions  Supported
Commands Supported Log Page  Supported
Compare & Write Fused Operation  Not Supported
Cryptographic Erase  Not Supported
Directives  Not Supported
Effects Log Page  Supported
Endurance Groups  Not Supported
Firmware Activation Notices  Supported
Firmware Activation Without Reset  Not Supported
First Firmware Slot Read Only  No
Format All Namespaces  Not Supported
Get LBA Status  Not Supported
Get Log Page Extended Data  Supported
Host Controlled Thermal Management  Supported
Keep Alive  Not Supported
Multiple Controllers  No
Multiple PCIe Ports  No
Namespace Attribute Changed Event  Not Supported
Namespace Granularity  Not Supported
Non-Operational Power State Permissive Mode  Supported
NVM Sets  Not Supported
Persistent Event Log  Supported
Predictable Latency Mode  Not Supported
Read Recovery Levels  Not Supported
Reservations  Not Supported
Save / Select Fields  Supported
Secure Erase All Namespaces  Not Supported
SGLs  Not Supported
SGL Bit Bucket Descriptor  Not Supported
SGL Byte Aligned Contiguous Physical Buffer of Metadata  Not Supported
SGL Commands Larger Than Data  Not Supported
SMART Information Per Namespace  Not Supported
SQ Associations  Not Supported
SR-IOV Virtual Function  No
Telemetry Controller-Initiated Log Page  Supported
Telemetry Host-Initiated Log Page  Supported
Traffic Based Keep Alive  Not Supported
UUID List  Not Supported
Volatile Write Cache  Present
 
NVMe Commands:
Compare  Not Supported
Dataset Management  Supported
Device Self-test  Supported
Doorbell Buffer Config  Not Supported
Format NVM  Supported
Firmware Commit  Supported
Firmware Image Download  Supported
Namespace Attachment  Not Supported
Namespace Management  Not Supported
NVMe-MI Receive  Not Supported
NVMe-MI Send  Not Supported
Sanitize  Supported
Security Receive  Supported
Security Send  Supported
Virtualization Management  Not Supported
Write Uncorrectable  Supported
Write Zeroes  Not Supported
 
Sanitize Operations:
Block Erase  Supported
Crypto Erase  Not Supported
Overwrite  Not Supported
 
Device Manufacturer:
Company Name  Kingston Technology Corporation
Product Information  http://www.kingston.com/en/ssd
Driver Update  http://www.aida64.com/goto/?p=drvupdates


SMART
 
[ KINGSTON OM8PJP4512K3-AH0 (0026B73848BD3330) ]
 
ID  Attribute Description  Threshold  Value  Worst  Data  Status
0  Critical Warning        0   OK: Value is normal
1  Temperature        50 °C  OK: Always passes
3  Available Spare        100 %  OK: Always passes
4  Available Spare Threshold        5 %  OK: Always passes
5  Percentage Used        0 %  OK: Value is normal
32  Data Units Read        872.72 GB  OK: Always passes
48  Data Units Written        647.23 GB  OK: Always passes
64  Host Read Commands        11336100   OK: Always passes
80  Host Write Commands        11514301   OK: Always passes
96  Controller Busy Time        15 min  OK: Always passes
112  Power Cycles        49   OK: Always passes
128  Power-On Hours        5   OK: Always passes
144  Unsafe Shutdowns        9   OK: Always passes
160  Media Errors        0   OK: Value is normal
176  Error Information Log Entries        6   OK: Always passes
192  Warning Composite Temperature Time        0 min  OK: Always passes
196  Critical Composite Temperature Time        0 min  OK: Always passes


Windows Network
 
[ Intel(R) Ethernet Connection (19) I219-LM ]
 
Network Adapter Properties:
Network Adapter  Intel(R) Ethernet Connection (19) I219-LM
Interface Type  Ethernet
Hardware Address  B4-E2-5B-29-77-F9
Connection Name  Ethernet
MTU  1500 bytes
Bytes Received  0
Bytes Sent  0
 
Network Adapter Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/products/network-io.html
Driver Download  https://www.intel.com/support/network
Driver Update  http://www.aida64.com/goto/?p=drvupdates


PCI / PnP Network
 
Device Description  Type
Intel Arrow Lake - VPU  PCI
Intel Arrow Point - Gigabit Ethernet Controller  PCI
Intel Arrow Point PCH - CNVi: WiFi Controller  PCI


Internet
 
Internet Settings:
Start Page  http://go.microsoft.com/fwlink/p/?LinkId=255141
Search Page  http://go.microsoft.com/fwlink/?LinkId=54896
Local Page  %11%\blank.htm
Download Folder  
 
Current Proxy:
Proxy Status  Disabled
 
LAN Proxy:
Proxy Status  Disabled


Routes
 
Type  Net Destination  Netmask  Gateway  Metric  Interface
Active  127.0.0.0  255.0.0.0  127.0.0.1  331  127.0.0.1 (Software Loopback Interface 1)
Active  127.0.0.1  255.255.255.255  127.0.0.1  331  127.0.0.1 (Software Loopback Interface 1)
Active  127.255.255.255  255.255.255.255  127.0.0.1  331  127.0.0.1 (Software Loopback Interface 1)
Active  224.0.0.0  240.0.0.0  127.0.0.1  331  127.0.0.1 (Software Loopback Interface 1)
Active  255.255.255.255  255.255.255.255  127.0.0.1  331  127.0.0.1 (Software Loopback Interface 1)


Browser History
 
Last Access  URL
2026-07-13 17:30:17  Marius@file:///D:/aida/800/sn.txt


DirectX Files
 
Name  Version  Type  Language  Size  Date
amstream.dll  10.00.26100.5074  Final Retail  English  122880  3/6/2026 4:47:56 PM
bdaplgin.ax  10.00.26100.1882  Final Retail  English  124344  3/6/2026 4:48:37 PM
d2d1.dll  10.00.26100.7920  Final Retail  English  6592008  3/6/2026 4:47:56 PM
d3d10.dll  10.00.26100.1150  Final Retail  English  1253376  3/6/2026 4:51:30 PM
d3d10_1.dll  10.00.26100.1882  Final Retail  English  208896  3/6/2026 4:47:58 PM
d3d10_1core.dll  10.00.26100.1882  Final Retail  English  57344  3/6/2026 4:47:58 PM
d3d10core.dll  10.00.26100.1882  Final Retail  English  57344  3/6/2026 4:47:58 PM
d3d10level9.dll  10.00.26100.7309  Final Retail  English  418768  3/6/2026 4:47:58 PM
d3d10warp.dll  10.00.26100.7309  Final Retail  English  5914352  3/6/2026 4:47:58 PM
d3d11.dll  10.00.26100.7920  Final Retail  English  2522000  3/6/2026 4:47:58 PM
d3d12.dll  10.00.26100.7920  Final Retail  English  146080  3/6/2026 4:47:58 PM
d3d8thk.dll  10.00.26100.7920  Final Retail  English  36864  3/6/2026 4:47:57 PM
d3d9.dll  10.00.26100.7920  Final Retail  English  1778224  3/6/2026 4:47:57 PM
ddraw.dll  10.00.26100.7705  Final Retail  English  630784  3/6/2026 4:47:57 PM
ddrawex.dll  10.00.26100.4652  Final Retail  English  73728  3/6/2026 4:47:57 PM
devenum.dll  10.00.26100.7309  Final Retail  English  146096  3/6/2026 4:47:56 PM
dinput.dll  10.00.26100.1591  Final Retail  English  204800  3/6/2026 4:47:57 PM
dinput8.dll  10.00.26100.1591  Final Retail  English  266240  3/6/2026 4:47:57 PM
dmloader.dll  10.00.26100.7309  Final Retail  English  106496  3/6/2026 4:47:49 PM
dmsynth.dll  10.00.26100.1882  Final Retail  English  147456  3/6/2026 4:47:49 PM
dmusic.dll  10.00.26100.7309  Final Retail  English  204800  3/6/2026 4:47:49 PM
dpnaddr.dll  10.00.26100.4202  Final Retail  English  36864  3/6/2026 4:47:57 PM
dpnathlp.dll  10.00.26100.4202  Final Retail  English  36864  3/6/2026 4:51:46 PM
dpnet.dll  10.00.26100.4202  Final Retail  English  36864  3/6/2026 4:47:57 PM
dpnhpast.dll  10.00.26100.4202  Final Retail  English  36864  3/6/2026 4:51:40 PM
dpnhupnp.dll  10.00.26100.4202  Final Retail  English  36864  3/6/2026 4:51:42 PM
dpnlobby.dll  10.00.26100.4202  Final Retail  English  36864  3/6/2026 4:51:45 PM
dpnsvr.exe  10.00.26100.4202  Final Retail  English  36864  3/6/2026 4:47:57 PM
dsdmo.dll  10.00.26100.5074  Final Retail  English  139264  3/6/2026 4:47:49 PM
dsound.dll  10.00.26100.7309  Final Retail  English  598016  3/6/2026 4:47:49 PM
dswave.dll  10.00.26100.7309  Final Retail  English  81920  3/6/2026 4:47:49 PM
dwrite.dll  10.00.26100.7824  Final Retail  English  2486272  3/6/2026 4:47:58 PM
dxdiagn.dll  10.00.26100.7920  Final Retail  English  487424  3/6/2026 4:47:57 PM
dxgi.dll  10.00.26100.7920  Final Retail  English  1307216  3/6/2026 4:47:58 PM
dxgkrnl.sys  10.00.26100.7920  Final Retail  English  5182920  3/6/2026 4:48:06 PM
dxmasf.dll  12.00.26100.4202  Final Retail  English  28672  3/6/2026 4:48:06 PM
dxtmsft.dll  11.00.26100.5074  Final Retail  English  475136  3/6/2026 4:48:02 PM
dxtrans.dll  11.00.26100.5074  Final Retail  English  299008  3/6/2026 4:48:02 PM
dxva2.dll  10.00.26100.7309  Final Retail  English  199792  3/6/2026 4:47:58 PM
encapi.dll  10.00.26100.1150  Final Retail  English  61440  3/6/2026 4:47:58 PM
gcdef.dll  10.00.26100.1591  Final Retail  English  151552  3/6/2026 4:47:57 PM
joy.cpl  10.00.26100.1150  Final Retail  English  118784  3/6/2026 4:47:57 PM
ks.sys  10.00.26100.7920  Final Retail  English  544768  3/6/2026 4:48:03 PM
ksproxy.ax  10.00.26100.7309  Final Retail  English  378240  3/6/2026 4:47:56 PM
kstvtune.ax  10.00.26100.1882  Final Retail  English  136624  3/6/2026 4:48:08 PM
ksuser.dll  10.00.26100.1150  Final Retail  English  50944  3/6/2026 4:47:56 PM
kswdmcap.ax  10.00.26100.1882  Final Retail  English  165320  3/6/2026 4:48:03 PM
ksxbar.ax  10.00.26100.1150  Final Retail  English  99632  3/6/2026 4:51:40 PM
mciqtz32.dll  10.00.26100.1150  Final Retail  English  65536  3/6/2026 4:51:38 PM
mfc42.dll  6.06.8063.0000  Beta Retail  English  1417216  3/6/2026 4:48:06 PM
mpeg2data.ax  10.00.26100.4202  Final Retail  English  116152  3/6/2026 4:48:37 PM
mpg2splt.ax  10.00.26100.3624  Final Retail  English  300448  3/6/2026 4:47:56 PM
msdmo.dll  10.00.26100.1150  Final Retail  English  67472  3/6/2026 4:47:56 PM
msdvbnp.ax  10.00.26100.4202  Final Retail  English  112056  3/6/2026 4:48:37 PM
mskssrv.sys  10.00.26100.7920  Final Retail  English  77824  3/6/2026 4:48:03 PM
mspclock.sys  10.00.26100.4202  Final Retail  English  49152  3/6/2026 4:48:03 PM
mspqm.sys  10.00.26100.4202  Final Retail  English  49152  3/6/2026 4:48:03 PM
mstee.sys  10.00.26100.4202  Final Retail  English  57344  3/6/2026 4:48:03 PM
msvidctl.dll  6.05.26100.5074  Final Retail  English  2650112  3/6/2026 4:48:37 PM
msyuv.dll  10.00.26100.1150  Final Retail  English  53248  3/6/2026 4:47:56 PM
pid.dll  10.00.26100.1591  Final Retail  English  73728  3/6/2026 4:47:57 PM
psisdecd.dll  10.00.26100.3912  Final Retail  English  589824  3/6/2026 4:48:37 PM
psisrndr.ax  10.00.26100.4202  Final Retail  English  128432  3/6/2026 4:48:37 PM
qasf.dll  12.00.26100.0001  Final Retail  English  180224  4/1/2024 12:22:16 AM
qcap.dll  10.00.26100.5074  Final Retail  English  225280  3/6/2026 4:47:56 PM
qdv.dll  10.00.26100.5074  Final Retail  English  278528  3/6/2026 4:47:56 PM
qdvd.dll  10.00.26100.7309  Final Retail  English  462848  3/6/2026 4:47:56 PM
qedit.dll  10.00.26100.7309  Final Retail  English  679936  3/6/2026 4:48:12 PM
qedwipes.dll  10.00.26100.0001  Final Retail  English  12288  4/1/2024 12:22:17 AM
quartz.dll  10.00.26100.7309  Final Retail  English  1847296  3/6/2026 4:47:56 PM
stream.sys  10.00.26100.1150  Final Retail  English  118784  3/6/2026 4:48:33 PM
vbisurf.ax  10.00.26100.1150  Final Retail  English  83248  3/6/2026 4:51:42 PM
vfwwdm32.dll  10.00.26100.1882  Final Retail  English  94208  3/6/2026 4:47:56 PM
wsock32.dll  10.00.26100.0001  Final Retail  English  40960  4/1/2024 12:22:14 AM


DirectX Video
 
[ Primary Display Driver ]
 
DirectDraw Device Properties:
DirectDraw Driver Name  display
DirectDraw Driver Description  Primary Display Driver
Hardware Driver  d3d10warp.dll (10.0.26100.7309 (WinBuild.160101.0800))
Hardware Description  Microsoft Basic Display Adapter
 
Direct3D Device Properties:
Rendering Bit Depths  16, 32
Z-Buffer Bit Depths  16, 24, 32
Multisample Anti-Aliasing Modes  MSAA 2x, MSAA 4x, MSAA 8x
Min Texture Size  1 x 1
Max Texture Size  16384 x 16384
Unified Shader Version  5.1
DirectX Hardware Support  DirectX v11.1
 
Direct3D Device Features:
Additive Texture Blending  Supported
AGP Texturing  Not Supported
Anisotropic Filtering  Supported
Automatic Mipmap Generation  Supported
Bilinear Filtering  Supported
Compute Shader  Supported
Cubic Environment Mapping  Supported
Cubic Filtering  Not Supported
Directional Lights  Supported
DirectX Texture Compression  Not Supported
DirectX Volumetric Texture Compression  Not Supported
Dithering  Not Supported
Dot3 Texture Blending  Supported
Double-Precision Floating-Point  Supported
Driver Concurrent Creates  Supported
Driver Command Lists  Not Supported
Dynamic Textures  Supported
Environmental Bump Mapping  Supported
Environmental Bump Mapping + Luminance  Supported
Factor Alpha Blending  Supported
Geometric Hidden-Surface Removal  Not Supported
Geometry Shader  Supported
Guard Band  Supported
Hardware Scene Rasterization  Supported
Hardware Transform & Lighting  Supported
Legacy Depth Bias  Supported
Map On Default Buffers  Supported
Mipmap LOD Bias Adjustments  Supported
Mipmapped Cube Textures  Supported
Mipmapped Volume Textures  Supported
Modulate-Alpha Texture Blending  Supported
Modulate Texture Blending  Supported
Non-Square Textures  Supported
N-Patches  Not Supported
Perspective Texture Correction  Supported
Point Lights  Supported
Point Sampling  Supported
Projective Textures  Supported
Quintic Bezier Curves & B-Splines  Not Supported
Range-Based Fog  Supported
Rectangular & Triangular Patches  Not Supported
Rendering In Windowed Mode  Supported
Runtime Shader Linking  Supported
Scissor Test  Supported
Slope-Scale Based Depth Bias  Supported
Specular Gouraud Shading  Supported
Spherical Mapping  Supported
Spot Lights  Supported
Stencil Buffers  Supported
Subtractive Texture Blending  Supported
Table Fog  Supported
Texture Alpha Blending  Supported
Texture Clamping  Supported
Texture Mirroring  Supported
Texture Wrapping  Supported
Tiled Resources  Supported
Triangle Culling  Not Supported
Trilinear Filtering  Supported
Two-Sided Stencil Test  Supported
Vertex Alpha Blending  Supported
Vertex Fog  Supported
Vertex Tweening  Supported
Volume Textures  Supported
W-Based Fog  Supported
W-Buffering  Not Supported
Z-Based Fog  Supported
Z-Test  Supported
 
Supported FourCC Codes:
AYUV  Supported
YUY2  Supported


DirectX Sound
 
[ Primary Sound Driver ]
 
DirectSound Device Properties:
Device Description  Primary Sound Driver
Driver Module  
Primary Buffers  1
Min / Max Secondary Buffers Sample Rate  100 / 200000 Hz
Primary Buffers Sound Formats  8-bit, 16-bit, Mono, Stereo
Secondary Buffers Sound Formats  8-bit, 16-bit, Mono, Stereo
Total / Free Sound Buffers  1 / 0
Total / Free Static Sound Buffers  1 / 0
Total / Free Streaming Sound Buffers  1 / 0
Total / Free 3D Sound Buffers  0 / 0
Total / Free 3D Static Sound Buffers  0 / 0
Total / Free 3D Streaming Sound Buffers  0 / 0
 
DirectSound Device Features:
Certified Driver  No
Emulated Device  No
Precise Sample Rate  Supported
DirectSound3D  Not Supported
Creative EAX 1.0  Not Supported
Creative EAX 2.0  Not Supported
Creative EAX 3.0  Not Supported
Creative EAX 4.0  Not Supported
Creative EAX 5.0  Not Supported
I3DL2  Not Supported
Sensaura ZoomFX  Not Supported
 
[ Speakers (High Definition Audio Device) ]
 
DirectSound Device Properties:
Device Description  Speakers (High Definition Audio Device)
Driver Module  {0.0.0.00000000}.{5e1040b5-0828-4da8-918f-004457d2da45}
Primary Buffers  1
Min / Max Secondary Buffers Sample Rate  100 / 200000 Hz
Primary Buffers Sound Formats  8-bit, 16-bit, Mono, Stereo
Secondary Buffers Sound Formats  8-bit, 16-bit, Mono, Stereo
Total / Free Sound Buffers  1 / 0
Total / Free Static Sound Buffers  1 / 0
Total / Free Streaming Sound Buffers  1 / 0
Total / Free 3D Sound Buffers  0 / 0
Total / Free 3D Static Sound Buffers  0 / 0
Total / Free 3D Streaming Sound Buffers  0 / 0
 
DirectSound Device Features:
Certified Driver  No
Emulated Device  No
Precise Sample Rate  Supported
DirectSound3D  Not Supported
Creative EAX 1.0  Not Supported
Creative EAX 2.0  Not Supported
Creative EAX 3.0  Not Supported
Creative EAX 4.0  Not Supported
Creative EAX 5.0  Not Supported
I3DL2  Not Supported
Sensaura ZoomFX  Not Supported


Windows Devices
 
[ Devices ]
 
Audio inputs and outputs:
Speakers (High Definition Audio Device)  10.0.26100.1
 
Computer:
ACPI x64-based PC  10.0.26100.1
HP HP ProDesk 4 Mini G1i Desktop AI PC  10.0.26100.1
 
Disk drives:
KINGSTON OM8PJP4512K3-AH0  10.0.26100.7705
 
Display adapters:
Microsoft Basic Display Adapter  10.0.26100.1
 
Firmware:
System Firmware  10.0.26100.4768
 
Human Interface Devices:
HID-compliant consumer control device  10.0.26100.1
HID-compliant consumer control device  10.0.26100.1
HID-compliant device  10.0.26100.7920
HID-compliant device  10.0.26100.7920
HID-compliant system controller  10.0.26100.7920
HID-compliant system controller  10.0.26100.7920
HID-compliant vendor-defined device  10.0.26100.7920
HID-compliant vendor-defined device  10.0.26100.7920
USB Input Device  10.0.26100.7920
USB Input Device  10.0.26100.7920
USB Input Device  10.0.26100.7920
USB Input Device  10.0.26100.7920
 
Keyboards:
HID Keyboard Device  10.0.26100.1882
HID Keyboard Device  10.0.26100.1882
 
Mice and other pointing devices:
HID-compliant mouse  10.0.26100.1150
HID-compliant mouse  10.0.26100.1150
 
Monitors:
Generic Monitor (P24h-10)  10.0.26100.7309
 
Network adapters:
Intel(R) Ethernet Connection (19) I219-LM  12.19.1.32
Microsoft Kernel Debug Network Adapter  10.0.26100.8036
 
Print queues:
Microsoft Print to PDF  10.0.26100.1
Root Print Queue  10.0.26100.1
 
Processors:
Intel(R) Core(TM) Ultra 5 225T  10.0.26100.7920
Intel(R) Core(TM) Ultra 5 225T  10.0.26100.7920
Intel(R) Core(TM) Ultra 5 225T  10.0.26100.7920
Intel(R) Core(TM) Ultra 5 225T  10.0.26100.7920
Intel(R) Core(TM) Ultra 5 225T  10.0.26100.7920
Intel(R) Core(TM) Ultra 5 225T  10.0.26100.7920
Intel(R) Core(TM) Ultra 5 225T  10.0.26100.7920
Intel(R) Core(TM) Ultra 5 225T  10.0.26100.7920
Intel(R) Core(TM) Ultra 5 225T  10.0.26100.7920
Intel(R) Core(TM) Ultra 5 225T  10.0.26100.7920
 
Security devices:
Trusted Platform Module 2.0  10.0.26100.7920
 
Software components:
Generic software component  10.0.26100.1
 
Software devices:
Microsoft GS Wavetable Synth  10.0.26100.1
Microsoft Radio Device Enumeration Bus  10.0.26100.1
MIDI 2.0 Loop Devices  10.0.26100.1
MIDI 2.0 Service Tests  10.0.26100.1
MIDI 2.0 Virtual Devices  10.0.26100.1
Service Test Loopback A  10.0.26100.1
Service Test Loopback B  10.0.26100.1
Service Test Ping (Internal)  10.0.26100.1
 
Sound, video and game controllers:
High Definition Audio Device  10.0.26100.8036
 
Storage controllers:
Microsoft Storage Spaces Controller  10.0.26100.7920
Standard NVM Express Controller  10.0.26100.7920
 
Storage volumes:
Volume  10.0.26100.5074
Volume  10.0.26100.5074
Volume  10.0.26100.5074
Volume  10.0.26100.5074
 
System devices:
ACPI Fixed Feature Button  10.0.26100.1150
ACPI Processor Aggregator  10.0.26100.1150
ACPI Wake Alarm  10.0.26100.1150
Composite Bus Enumerator  10.0.26100.1150
Extended IO Bus  10.0.26100.1150
Generic Bus  10.0.26100.1150
High Definition Audio Controller  10.0.26100.7920
High precision event timer  10.0.26100.1150
Intel(R) Power Engine Plug-in  10.0.26100.7920
Microsoft ACPI-Compliant Embedded Controller  10.0.26100.1150
Microsoft ACPI-Compliant System  10.0.26100.7920
Microsoft Basic Display Driver  10.0.26100.4202
Microsoft Basic Render Driver  10.0.26100.7920
Microsoft Hyper-V Virtualization Infrastructure Driver  10.0.26100.7920
Microsoft System Management BIOS Driver  10.0.26100.1
Microsoft UEFI-Compliant System  10.0.26100.7920
Microsoft Virtual Drive Enumerator  10.0.26100.1591
Microsoft Windows Management Interface for ACPI  10.0.26100.1150
Microsoft Windows Management Interface for ACPI  10.0.26100.1150
Microsoft Windows Management Interface for ACPI  10.0.26100.1150
Motherboard resources  10.0.26100.1150
Motherboard resources  10.0.26100.1150
Motherboard resources  10.0.26100.1150
Motherboard resources  10.0.26100.1150
Motherboard resources  10.0.26100.1150
Motherboard resources  10.0.26100.1150
Motherboard resources  10.0.26100.1150
Motherboard resources  10.0.26100.1150
Motherboard resources  10.0.26100.1150
NDIS Virtual Network Adapter Enumerator  10.0.26100.1
PCI Express Root Complex  10.0.26100.7920
PCI Express Root Complex  10.0.26100.7920
PCI Express Root Port  10.0.26100.7920
PCI standard host CPU bridge  10.0.26100.1150
PCI standard ISA bridge  10.0.26100.1150
PCI standard ISA bridge  10.0.26100.1150
PCI standard RAM Controller  10.0.26100.1150
Plug and Play Software Device Enumerator  10.0.26100.4202
Programmable interrupt controller  10.0.26100.1150
Remote Desktop Device Redirector Bus  10.0.26100.7920
System timer  10.0.26100.1150
UMBus Root Bus Enumerator  10.0.26100.1150
Volume Manager  10.0.26100.7920
 
Universal Serial Bus controllers:
Intel(R) USB 3.20 eXtensible Host Controller - 1.20 (Microsoft)  10.0.26100.7920
Intel(R) USB 3.20 eXtensible Host Controller - 1.20 (Microsoft)  10.0.26100.7920
USB Composite Device  10.0.26100.7920
USB Root Hub (USB 3.0)  10.0.26100.7920
USB Root Hub (USB 3.0)  10.0.26100.7920
 
Unknown:
Network Controller  
PCI Data Acquisition and Signal Processing Controller  
PCI Data Acquisition and Signal Processing Controller  
PCI Device  
PCI Device  
PCI Device  
PCI Device  
PCI Serial Port  
PCI Simple Communications Controller  
SM Bus Controller  
Unknown  
Unknown  
Unknown  
Unknown  
Unknown  
Unknown  
Unknown  
 
USB Connector Managers:
UCM-UCSI ACPI Device  10.0.26100.1882
 
[ Audio inputs and outputs / Speakers (High Definition Audio Device) ]
 
Device Properties:
Driver Description  Speakers (High Definition Audio Device)
Driver Date  3/31/2024
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  audioendpoint.inf
INF Section  NO_DRV
Hardware ID  MMDEVAPI\AudioEndpoints
 
[ Computer / ACPI x64-based PC ]
 
Device Properties:
Driver Description  ACPI x64-based PC
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  hal.inf
INF Section  ACPI_AMD64_HAL
Hardware ID  acpiapic
 
[ Computer / HP HP ProDesk 4 Mini G1i Desktop AI PC ]
 
Device Properties:
Driver Description  HP HP ProDesk 4 Mini G1i Desktop AI PC
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  compdev.inf
INF Section  CompDev_Install
Hardware ID  COMPUTER\{D329AE74-0AB9-5C05-81DF-E7E1A25040CC}
 
[ Disk drives / KINGSTON OM8PJP4512K3-AH0 ]
 
Device Properties:
Driver Description  KINGSTON OM8PJP4512K3-AH0
Driver Date  6/21/2006
Driver Version  10.0.26100.7705
Driver Provider  Microsoft
INF File  disk.inf
INF Section  disk_install.NT
Hardware ID  SCSI\DiskNVMe___________________KINGSTON_OM8PJP4512K3-AH0____HPS0
Location Information  Bus Number 0, Target Id 0, LUN 0
 
Device Manufacturer:
Company Name  Kingston Technology Corporation
Product Information  http://www.kingston.com/en/ssd
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Display adapters / Microsoft Basic Display Adapter ]
 
Device Properties:
Driver Description  Microsoft Basic Display Adapter
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  display.inf
INF Section  MSBDA
Hardware ID  PCI\VEN_8086&DEV_7D67&SUBSYS_8D17103C&REV_06
Location Information  PCI bus 0, device 2, function 0
PCI Device  Intel Arrow Lake-HX/S - Integrated Graphics Controller
 
Device Resources:
Memory  00000000-0FFFFFFF
Memory  18000000-18FFFFFF
 
Video Adapter Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/products/chipsets
Driver Download  https://www.intel.com/support/graphics
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Firmware / System Firmware ]
 
Device Properties:
Driver Description  System Firmware
Driver Date  6/21/2006
Driver Version  10.0.26100.4768
Driver Provider  Microsoft
INF File  c_firmware.inf
INF Section  FirmwareResource.NT
Hardware ID  UEFI\RES_{23ec5982-a3af-488c-b481-8b4b52edabeb}&REV_2040A00
 
[ Human Interface Devices / HID-compliant consumer control device ]
 
Device Properties:
Driver Description  HID-compliant consumer control device
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  hidserv.inf
INF Section  HIDSystemConsumerDevice
Hardware ID  HID\VID_062A&PID_4101&REV_0101&Col04
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Human Interface Devices / HID-compliant consumer control device ]
 
Device Properties:
Driver Description  HID-compliant consumer control device
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  hidserv.inf
INF Section  HIDSystemConsumerDevice
Hardware ID  HID\VID_3434&PID_0243&REV_0100&MI_02&Col03
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Human Interface Devices / HID-compliant device ]
 
Device Properties:
Driver Description  HID-compliant device
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  input.inf
INF Section  HID_Raw_Inst.NT
Hardware ID  HID\VID_062A&PID_4101&REV_0101&Col01
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Human Interface Devices / HID-compliant device ]
 
Device Properties:
Driver Description  HID-compliant device
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  input.inf
INF Section  HID_Raw_Inst.NT
Hardware ID  HID\VID_062A&PID_4101&REV_0101&Col03
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Human Interface Devices / HID-compliant system controller ]
 
Device Properties:
Driver Description  HID-compliant system controller
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  input.inf
INF Section  HID_Raw_Inst.NT
Hardware ID  HID\VID_062A&PID_4101&REV_0101&Col05
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Human Interface Devices / HID-compliant system controller ]
 
Device Properties:
Driver Description  HID-compliant system controller
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  input.inf
INF Section  HID_Raw_Inst.NT
Hardware ID  HID\VID_3434&PID_0243&REV_0100&MI_02&Col02
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Human Interface Devices / HID-compliant vendor-defined device ]
 
Device Properties:
Driver Description  HID-compliant vendor-defined device
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  input.inf
INF Section  HID_Raw_Inst.NT
Hardware ID  HID\VID_062A&PID_4101&REV_0101&Col06
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Human Interface Devices / HID-compliant vendor-defined device ]
 
Device Properties:
Driver Description  HID-compliant vendor-defined device
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  input.inf
INF Section  HID_Raw_Inst.NT
Hardware ID  HID\VID_3434&PID_0243&REV_0100&MI_01
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Human Interface Devices / USB Input Device ]
 
Device Properties:
Driver Description  USB Input Device
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  input.inf
INF Section  HID_Inst.NT
Hardware ID  USB\VID_062A&PID_4101&REV_0101
Location Information  Port_#0002.Hub_#0001
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Human Interface Devices / USB Input Device ]
 
Device Properties:
Driver Description  USB Input Device
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  input.inf
INF Section  HID_Inst.NT
Hardware ID  USB\VID_3434&PID_0243&REV_0100&MI_00
Location Information  0080.0014.0000.003.000.000.000.000.000
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Human Interface Devices / USB Input Device ]
 
Device Properties:
Driver Description  USB Input Device
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  input.inf
INF Section  HID_Inst.NT
Hardware ID  USB\VID_3434&PID_0243&REV_0100&MI_01
Location Information  0080.0014.0000.003.000.000.000.000.000
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Human Interface Devices / USB Input Device ]
 
Device Properties:
Driver Description  USB Input Device
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  input.inf
INF Section  HID_Inst.NT
Hardware ID  USB\VID_3434&PID_0243&REV_0100&MI_02
Location Information  0080.0014.0000.003.000.000.000.000.000
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Keyboards / HID Keyboard Device ]
 
Device Properties:
Driver Description  HID Keyboard Device
Driver Date  6/21/2006
Driver Version  10.0.26100.1882
Driver Provider  Microsoft
INF File  keyboard.inf
INF Section  HID_Keyboard_Inst.NT
Hardware ID  HID\VID_3434&PID_0243&REV_0100&MI_00
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Keyboards / HID Keyboard Device ]
 
Device Properties:
Driver Description  HID Keyboard Device
Driver Date  6/21/2006
Driver Version  10.0.26100.1882
Driver Provider  Microsoft
INF File  keyboard.inf
INF Section  HID_Keyboard_Inst.NT
Hardware ID  HID\VID_3434&PID_0243&REV_0100&MI_02&Col04
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Mice and other pointing devices / HID-compliant mouse ]
 
Device Properties:
Driver Description  HID-compliant mouse
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  msmouse.inf
INF Section  HID_Mouse_Inst.NT
Hardware ID  HID\VID_062A&PID_4101&REV_0101&Col02
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Mice and other pointing devices / HID-compliant mouse ]
 
Device Properties:
Driver Description  HID-compliant mouse
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  msmouse.inf
INF Section  HID_Mouse_Inst.NT
Hardware ID  HID\VID_3434&PID_0243&REV_0100&MI_02&Col01
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Monitors / Generic Monitor (P24h-10) ]
 
Device Properties:
Driver Description  Generic Monitor (P24h-10)
Driver Date  6/21/2006
Driver Version  10.0.26100.7309
Driver Provider  Microsoft
INF File  monitor.inf
INF Section  PnPMonitor.Install
Hardware ID  MONITOR\LEN61AE
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Network adapters / Intel(R) Ethernet Connection (19) I219-LM ]
 
Device Properties:
Driver Description  Intel(R) Ethernet Connection (19) I219-LM
Driver Date  8/3/2015
Driver Version  12.19.1.32
Driver Provider  Microsoft
INF File  net1ic64.inf
INF Section  E550C.10.0.1
Hardware ID  PCI\VEN_8086&DEV_550C&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 128, device 31, function 6
PCI Device  Intel Arrow Point - Gigabit Ethernet Controller
 
Device Resources:
IRQ  65536
Memory  BDFE0000-BDFFFFFF
 
Network Adapter Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/products/network-io.html
Driver Download  https://www.intel.com/support/network
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Network adapters / Microsoft Kernel Debug Network Adapter ]
 
Device Properties:
Driver Description  Microsoft Kernel Debug Network Adapter
Driver Date  6/21/2006
Driver Version  10.0.26100.8036
Driver Provider  Microsoft
INF File  kdnic.inf
INF Section  KdNic.ndi
Hardware ID  root\kdnic
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Print queues / Microsoft Print to PDF ]
 
Device Properties:
Driver Description  Microsoft Print to PDF
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  printqueue.inf
INF Section  NO_DRV_LOCAL
Hardware ID  PRINTENUM\{084f01fa-e634-4d77-83ee-074817c03581}
 
[ Print queues / Root Print Queue ]
 
Device Properties:
Driver Description  Root Print Queue
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  printqueue.inf
INF Section  NO_DRV_LOCAL
Hardware ID  PRINTENUM\LocalPrintQueue
 
[ Processors / Intel(R) Core(TM) Ultra 5 225T ]
 
Device Properties:
Driver Description  Intel(R) Core(TM) Ultra 5 225T
Driver Date  4/21/2009
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  cpu.inf
INF Section  IntelPPM_Inst.NT
Hardware ID  ACPI\VEN_ACPI&DEV_0007
 
CPU Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/search.html?ws=text#q=Intel%20Core%20Ultra%205%20225T&sort=relevancy
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Processors / Intel(R) Core(TM) Ultra 5 225T ]
 
Device Properties:
Driver Description  Intel(R) Core(TM) Ultra 5 225T
Driver Date  4/21/2009
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  cpu.inf
INF Section  IntelPPM_Inst.NT
Hardware ID  ACPI\VEN_ACPI&DEV_0007
 
CPU Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/search.html?ws=text#q=Intel%20Core%20Ultra%205%20225T&sort=relevancy
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Processors / Intel(R) Core(TM) Ultra 5 225T ]
 
Device Properties:
Driver Description  Intel(R) Core(TM) Ultra 5 225T
Driver Date  4/21/2009
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  cpu.inf
INF Section  IntelPPM_Inst.NT
Hardware ID  ACPI\VEN_ACPI&DEV_0007
 
CPU Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/search.html?ws=text#q=Intel%20Core%20Ultra%205%20225T&sort=relevancy
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Processors / Intel(R) Core(TM) Ultra 5 225T ]
 
Device Properties:
Driver Description  Intel(R) Core(TM) Ultra 5 225T
Driver Date  4/21/2009
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  cpu.inf
INF Section  IntelPPM_Inst.NT
Hardware ID  ACPI\VEN_ACPI&DEV_0007
 
CPU Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/search.html?ws=text#q=Intel%20Core%20Ultra%205%20225T&sort=relevancy
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Processors / Intel(R) Core(TM) Ultra 5 225T ]
 
Device Properties:
Driver Description  Intel(R) Core(TM) Ultra 5 225T
Driver Date  4/21/2009
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  cpu.inf
INF Section  IntelPPM_Inst.NT
Hardware ID  ACPI\VEN_ACPI&DEV_0007
 
CPU Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/search.html?ws=text#q=Intel%20Core%20Ultra%205%20225T&sort=relevancy
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Processors / Intel(R) Core(TM) Ultra 5 225T ]
 
Device Properties:
Driver Description  Intel(R) Core(TM) Ultra 5 225T
Driver Date  4/21/2009
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  cpu.inf
INF Section  IntelPPM_Inst.NT
Hardware ID  ACPI\VEN_ACPI&DEV_0007
 
CPU Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/search.html?ws=text#q=Intel%20Core%20Ultra%205%20225T&sort=relevancy
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Processors / Intel(R) Core(TM) Ultra 5 225T ]
 
Device Properties:
Driver Description  Intel(R) Core(TM) Ultra 5 225T
Driver Date  4/21/2009
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  cpu.inf
INF Section  IntelPPM_Inst.NT
Hardware ID  ACPI\VEN_ACPI&DEV_0007
 
CPU Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/search.html?ws=text#q=Intel%20Core%20Ultra%205%20225T&sort=relevancy
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Processors / Intel(R) Core(TM) Ultra 5 225T ]
 
Device Properties:
Driver Description  Intel(R) Core(TM) Ultra 5 225T
Driver Date  4/21/2009
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  cpu.inf
INF Section  IntelPPM_Inst.NT
Hardware ID  ACPI\VEN_ACPI&DEV_0007
 
CPU Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/search.html?ws=text#q=Intel%20Core%20Ultra%205%20225T&sort=relevancy
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Processors / Intel(R) Core(TM) Ultra 5 225T ]
 
Device Properties:
Driver Description  Intel(R) Core(TM) Ultra 5 225T
Driver Date  4/21/2009
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  cpu.inf
INF Section  IntelPPM_Inst.NT
Hardware ID  ACPI\VEN_ACPI&DEV_0007
 
CPU Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/search.html?ws=text#q=Intel%20Core%20Ultra%205%20225T&sort=relevancy
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Processors / Intel(R) Core(TM) Ultra 5 225T ]
 
Device Properties:
Driver Description  Intel(R) Core(TM) Ultra 5 225T
Driver Date  4/21/2009
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  cpu.inf
INF Section  IntelPPM_Inst.NT
Hardware ID  ACPI\VEN_ACPI&DEV_0007
 
CPU Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/search.html?ws=text#q=Intel%20Core%20Ultra%205%20225T&sort=relevancy
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Security devices / Trusted Platform Module 2.0 ]
 
Device Properties:
Driver Description  Trusted Platform Module 2.0
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  tpm.inf
INF Section  Tpm2BaseInstall
Hardware ID  ACPI\VEN_IFX&DEV_1524
 
Device Resources:
IRQ  53
Memory  FED40000-FED44FFF
 
[ Software components / Generic software component ]
 
Device Properties:
Driver Description  Generic software component
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  c_swcomponent.inf
INF Section  SoftwareComponent
Hardware ID  SWC\VEN_MSFT&AUDIO_EFFECTPACK_VOICECLARITY
 
[ Software devices / Microsoft GS Wavetable Synth ]
 
Device Properties:
Driver Description  Microsoft GS Wavetable Synth
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  c_swdevice.inf
INF Section  SoftwareDevice
 
[ Software devices / Microsoft Radio Device Enumeration Bus ]
 
Device Properties:
Driver Description  Microsoft Radio Device Enumeration Bus
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  c_swdevice.inf
INF Section  SoftwareDevice
 
[ Software devices / MIDI 2.0 Loop Devices ]
 
Device Properties:
Driver Description  MIDI 2.0 Loop Devices
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  c_swdevice.inf
INF Section  SoftwareDevice
 
[ Software devices / MIDI 2.0 Service Tests ]
 
Device Properties:
Driver Description  MIDI 2.0 Service Tests
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  c_swdevice.inf
INF Section  SoftwareDevice
 
[ Software devices / MIDI 2.0 Virtual Devices ]
 
Device Properties:
Driver Description  MIDI 2.0 Virtual Devices
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  c_swdevice.inf
INF Section  SoftwareDevice
 
[ Software devices / Service Test Loopback A ]
 
Device Properties:
Driver Description  Service Test Loopback A
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  c_swdevice.inf
INF Section  SoftwareDevice
Hardware ID  MIDISRV\MidiEndpoints
 
[ Software devices / Service Test Loopback B ]
 
Device Properties:
Driver Description  Service Test Loopback B
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  c_swdevice.inf
INF Section  SoftwareDevice
Hardware ID  MIDISRV\MidiEndpoints
 
[ Software devices / Service Test Ping (Internal) ]
 
Device Properties:
Driver Description  Service Test Ping (Internal)
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  c_swdevice.inf
INF Section  SoftwareDevice
Hardware ID  MIDISRV\MidiEndpoints
 
[ Sound, video and game controllers / High Definition Audio Device ]
 
Device Properties:
Driver Description  High Definition Audio Device
Driver Date  3/4/2026
Driver Version  10.0.26100.8036
Driver Provider  Microsoft
INF File  hdaudio.inf
INF Section  HdAudModel
Hardware ID  HDAUDIO\FUNC_01&VEN_10EC&DEV_0256&SUBSYS_103C8D17&REV_1000
Location Information  Internal High Definition Audio Bus
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Storage controllers / Microsoft Storage Spaces Controller ]
 
Device Properties:
Driver Description  Microsoft Storage Spaces Controller
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  spaceport.inf
INF Section  Spaceport_Install
Hardware ID  Root\Spaceport
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Storage controllers / Standard NVM Express Controller ]
 
Device Properties:
Driver Description  Standard NVM Express Controller
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  stornvme.inf
INF Section  Stornvme_Inst
Hardware ID  PCI\VEN_2646&DEV_502E&SUBSYS_502E2646&REV_01
Location Information  PCI bus 1, device 0, function 0
PCI Device  Standard NVM Express Controller [2646-502E] [NoDB]
 
Device Resources:
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
IRQ  65536
Memory  90000000-90003FFF
 
Device Manufacturer:
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Storage volumes / Volume ]
 
Device Properties:
Driver Description  Volume
Driver Date  6/21/2006
Driver Version  10.0.26100.5074
Driver Provider  Microsoft
INF File  volume.inf
INF Section  volume_install.NT
Hardware ID  STORAGE\Volume
 
[ Storage volumes / Volume ]
 
Device Properties:
Driver Description  Volume
Driver Date  6/21/2006
Driver Version  10.0.26100.5074
Driver Provider  Microsoft
INF File  volume.inf
INF Section  volume_install.NT
Hardware ID  STORAGE\Volume
 
[ Storage volumes / Volume ]
 
Device Properties:
Driver Description  Volume
Driver Date  6/21/2006
Driver Version  10.0.26100.5074
Driver Provider  Microsoft
INF File  volume.inf
INF Section  volume_install.NT
Hardware ID  STORAGE\Volume
 
[ Storage volumes / Volume ]
 
Device Properties:
Driver Description  Volume
Driver Date  6/21/2006
Driver Version  10.0.26100.5074
Driver Provider  Microsoft
INF File  volume.inf
INF Section  volume_install.NT
Hardware ID  STORAGE\Volume
 
[ System devices / ACPI Fixed Feature Button ]
 
Device Properties:
Driver Description  ACPI Fixed Feature Button
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV
Hardware ID  ACPI\FixedButton
 
[ System devices / ACPI Processor Aggregator ]
 
Device Properties:
Driver Description  ACPI Processor Aggregator
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  acpipagr.inf
INF Section  PagrInstall
Hardware ID  ACPI\VEN_ACPI&DEV_000C
 
[ System devices / ACPI Wake Alarm ]
 
Device Properties:
Driver Description  ACPI Wake Alarm
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  acpitime.inf
INF Section  AcpiTime_Inst.NT
Hardware ID  ACPI\VEN_ACPI&DEV_000E
 
[ System devices / Composite Bus Enumerator ]
 
Device Properties:
Driver Description  Composite Bus Enumerator
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  compositebus.inf
INF Section  CompositeBus_Device.NT
Hardware ID  ROOT\CompositeBus
 
[ System devices / Extended IO Bus ]
 
Device Properties:
Driver Description  Extended IO Bus
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_X_PNP
Hardware ID  ACPI\VEN_PNP&DEV_0A06
 
[ System devices / Generic Bus ]
 
Device Properties:
Driver Description  Generic Bus
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_X_PNP
Hardware ID  ACPI\VEN_PNP&DEV_0A05
 
[ System devices / High Definition Audio Controller ]
 
Device Properties:
Driver Description  High Definition Audio Controller
Driver Date  2/16/2026
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  hdaudbus.inf
INF Section  HDAudio_Device.NT
Hardware ID  PCI\VEN_8086&DEV_7F50&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 128, device 31, function 3
PCI Device  Intel Arrow Point PCH - Audio Context Engine
 
Device Resources:
IRQ  16
Memory  DFDFC000-DFDFFFFF
Memory  DFE00000-DFFFFFFF
 
[ System devices / High precision event timer ]
 
Device Properties:
Driver Description  High precision event timer
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_HPET
Hardware ID  ACPI\VEN_PNP&DEV_0103
 
[ System devices / Intel(R) Power Engine Plug-in ]
 
Device Properties:
Driver Description  Intel(R) Power Engine Plug-in
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  intelpep.inf
INF Section  HSWULT
Hardware ID  ACPI\VEN_INT&DEV_33A1
 
[ System devices / Microsoft ACPI-Compliant Embedded Controller ]
 
Device Properties:
Driver Description  Microsoft ACPI-Compliant Embedded Controller
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV
Hardware ID  ACPI\VEN_PNP&DEV_0C09
 
Device Resources:
Port  0062-0062
Port  0066-0066
 
[ System devices / Microsoft ACPI-Compliant System ]
 
Device Properties:
Driver Description  Microsoft ACPI-Compliant System
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  acpi.inf
INF Section  ACPI_Inst.NT
Hardware ID  ACPI_HAL\PNP0C08
PnP Device  ACPI Driver/BIOS
 
Device Resources:
IRQ  100
IRQ  101
IRQ  102
IRQ  103
IRQ  104
IRQ  105
IRQ  106
IRQ  107
IRQ  108
IRQ  109
IRQ  110
IRQ  111
IRQ  112
IRQ  113
IRQ  114
IRQ  115
IRQ  116
IRQ  117
IRQ  118
IRQ  119
IRQ  120
IRQ  121
IRQ  122
IRQ  123
IRQ  124
IRQ  125
IRQ  126
IRQ  127
IRQ  128
IRQ  129
IRQ  130
IRQ  131
IRQ  132
IRQ  133
IRQ  134
IRQ  135
IRQ  136
IRQ  137
IRQ  138
IRQ  139
IRQ  140
IRQ  141
IRQ  142
IRQ  143
IRQ  144
IRQ  145
IRQ  146
IRQ  147
IRQ  148
IRQ  149
IRQ  150
IRQ  151
IRQ  152
IRQ  153
IRQ  154
IRQ  155
IRQ  156
IRQ  157
IRQ  158
IRQ  159
IRQ  160
IRQ  161
IRQ  162
IRQ  163
IRQ  164
IRQ  165
IRQ  166
IRQ  167
IRQ  168
IRQ  169
IRQ  170
IRQ  171
IRQ  172
IRQ  173
IRQ  174
IRQ  175
IRQ  176
IRQ  177
IRQ  178
IRQ  179
IRQ  180
IRQ  181
IRQ  182
IRQ  183
IRQ  184
IRQ  185
IRQ  186
IRQ  187
IRQ  188
IRQ  189
IRQ  190
IRQ  191
IRQ  192
IRQ  193
IRQ  194
IRQ  195
IRQ  196
IRQ  197
IRQ  198
IRQ  199
IRQ  200
IRQ  201
IRQ  202
IRQ  203
IRQ  204
IRQ  256
IRQ  257
IRQ  258
IRQ  259
IRQ  260
IRQ  261
IRQ  262
IRQ  263
IRQ  264
IRQ  265
IRQ  266
IRQ  267
IRQ  268
IRQ  269
IRQ  270
IRQ  271
IRQ  272
IRQ  273
IRQ  274
IRQ  275
IRQ  276
IRQ  277
IRQ  278
IRQ  279
IRQ  280
IRQ  281
IRQ  282
IRQ  283
IRQ  284
IRQ  285
IRQ  286
IRQ  287
IRQ  288
IRQ  289
IRQ  290
IRQ  291
IRQ  292
IRQ  293
IRQ  294
IRQ  295
IRQ  296
IRQ  297
IRQ  298
IRQ  299
IRQ  300
IRQ  301
IRQ  302
IRQ  303
IRQ  304
IRQ  305
IRQ  306
IRQ  307
IRQ  308
IRQ  309
IRQ  310
IRQ  311
IRQ  312
IRQ  313
IRQ  314
IRQ  315
IRQ  316
IRQ  317
IRQ  318
IRQ  319
IRQ  320
IRQ  321
IRQ  322
IRQ  323
IRQ  324
IRQ  325
IRQ  326
IRQ  327
IRQ  328
IRQ  329
IRQ  330
IRQ  331
IRQ  332
IRQ  333
IRQ  334
IRQ  335
IRQ  336
IRQ  337
IRQ  338
IRQ  339
IRQ  340
IRQ  341
IRQ  342
IRQ  343
IRQ  344
IRQ  345
IRQ  346
IRQ  347
IRQ  348
IRQ  349
IRQ  350
IRQ  351
IRQ  352
IRQ  353
IRQ  354
IRQ  355
IRQ  356
IRQ  357
IRQ  358
IRQ  359
IRQ  360
IRQ  361
IRQ  362
IRQ  363
IRQ  364
IRQ  365
IRQ  366
IRQ  367
IRQ  368
IRQ  369
IRQ  370
IRQ  371
IRQ  372
IRQ  373
IRQ  374
IRQ  375
IRQ  376
IRQ  377
IRQ  378
IRQ  379
IRQ  380
IRQ  381
IRQ  382
IRQ  383
IRQ  384
IRQ  385
IRQ  386
IRQ  387
IRQ  388
IRQ  389
IRQ  390
IRQ  391
IRQ  392
IRQ  393
IRQ  394
IRQ  395
IRQ  396
IRQ  397
IRQ  398
IRQ  399
IRQ  400
IRQ  401
IRQ  402
IRQ  403
IRQ  404
IRQ  405
IRQ  406
IRQ  407
IRQ  408
IRQ  409
IRQ  410
IRQ  411
IRQ  412
IRQ  413
IRQ  414
IRQ  415
IRQ  416
IRQ  417
IRQ  418
IRQ  419
IRQ  420
IRQ  421
IRQ  422
IRQ  423
IRQ  424
IRQ  425
IRQ  426
IRQ  427
IRQ  428
IRQ  429
IRQ  430
IRQ  431
IRQ  432
IRQ  433
IRQ  434
IRQ  435
IRQ  436
IRQ  437
IRQ  438
IRQ  439
IRQ  440
IRQ  441
IRQ  442
IRQ  443
IRQ  444
IRQ  445
IRQ  446
IRQ  447
IRQ  448
IRQ  449
IRQ  450
IRQ  451
IRQ  452
IRQ  453
IRQ  454
IRQ  455
IRQ  456
IRQ  457
IRQ  458
IRQ  459
IRQ  460
IRQ  461
IRQ  462
IRQ  463
IRQ  464
IRQ  465
IRQ  466
IRQ  467
IRQ  468
IRQ  469
IRQ  470
IRQ  471
IRQ  472
IRQ  473
IRQ  474
IRQ  475
IRQ  476
IRQ  477
IRQ  478
IRQ  479
IRQ  480
IRQ  481
IRQ  482
IRQ  483
IRQ  484
IRQ  485
IRQ  486
IRQ  487
IRQ  488
IRQ  489
IRQ  490
IRQ  491
IRQ  492
IRQ  493
IRQ  494
IRQ  495
IRQ  496
IRQ  497
IRQ  498
IRQ  499
IRQ  500
IRQ  501
IRQ  502
IRQ  503
IRQ  504
IRQ  505
IRQ  506
IRQ  507
IRQ  508
IRQ  509
IRQ  510
IRQ  511
IRQ  55
IRQ  56
IRQ  57
IRQ  58
IRQ  59
IRQ  60
IRQ  61
IRQ  62
IRQ  63
IRQ  64
IRQ  65
IRQ  66
IRQ  67
IRQ  68
IRQ  69
IRQ  70
IRQ  71
IRQ  72
IRQ  73
IRQ  74
IRQ  75
IRQ  76
IRQ  77
IRQ  78
IRQ  79
IRQ  80
IRQ  81
IRQ  82
IRQ  83
IRQ  84
IRQ  85
IRQ  86
IRQ  87
IRQ  88
IRQ  89
IRQ  90
IRQ  91
IRQ  92
IRQ  93
IRQ  94
IRQ  95
IRQ  96
IRQ  97
IRQ  98
IRQ  99
 
[ System devices / Microsoft Basic Display Driver ]
 
Device Properties:
Driver Description  Microsoft Basic Display Driver
Driver Date  6/21/2006
Driver Version  10.0.26100.4202
Driver Provider  Microsoft
INF File  basicdisplay.inf
INF Section  MSBDD_Fallback
Hardware ID  ROOT\BasicDisplay
 
[ System devices / Microsoft Basic Render Driver ]
 
Device Properties:
Driver Description  Microsoft Basic Render Driver
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  basicrender.inf
INF Section  BasicRender
Hardware ID  ROOT\BasicRender
 
[ System devices / Microsoft Hyper-V Virtualization Infrastructure Driver ]
 
Device Properties:
Driver Description  Microsoft Hyper-V Virtualization Infrastructure Driver
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  wvid.inf
INF Section  Vid_Device_Client.NT
Hardware ID  ROOT\VID
 
[ System devices / Microsoft System Management BIOS Driver ]
 
Device Properties:
Driver Description  Microsoft System Management BIOS Driver
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  mssmbios.inf
INF Section  MSSMBIOS_DRV
Hardware ID  ROOT\mssmbios
 
[ System devices / Microsoft UEFI-Compliant System ]
 
Device Properties:
Driver Description  Microsoft UEFI-Compliant System
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  uefi.inf
INF Section  UEFI_Inst.NT
Hardware ID  ACPI_HAL\UEFI
 
[ System devices / Microsoft Virtual Drive Enumerator ]
 
Device Properties:
Driver Description  Microsoft Virtual Drive Enumerator
Driver Date  6/21/2006
Driver Version  10.0.26100.1591
Driver Provider  Microsoft
INF File  vdrvroot.inf
INF Section  VDRVROOT
Hardware ID  ROOT\vdrvroot
 
[ System devices / Microsoft Windows Management Interface for ACPI ]
 
Device Properties:
Driver Description  Microsoft Windows Management Interface for ACPI
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  wmiacpi.inf
INF Section  WMIMAP_Inst.NT
Hardware ID  ACPI\VEN_PNP&DEV_0C14
 
[ System devices / Microsoft Windows Management Interface for ACPI ]
 
Device Properties:
Driver Description  Microsoft Windows Management Interface for ACPI
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  wmiacpi.inf
INF Section  WMIMAP_Inst.NT
Hardware ID  ACPI\VEN_PNP&DEV_0C14
 
[ System devices / Microsoft Windows Management Interface for ACPI ]
 
Device Properties:
Driver Description  Microsoft Windows Management Interface for ACPI
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  wmiacpi.inf
INF Section  WMIMAP_Inst.NT
Hardware ID  ACPI\VEN_PNP&DEV_0C14
 
[ System devices / Motherboard resources ]
 
Device Properties:
Driver Description  Motherboard resources
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_MBRES
Hardware ID  ACPI\VEN_PNP&DEV_0C02
 
[ System devices / Motherboard resources ]
 
Device Properties:
Driver Description  Motherboard resources
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_MBRES
Hardware ID  ACPI\VEN_PNP&DEV_0C02
 
[ System devices / Motherboard resources ]
 
Device Properties:
Driver Description  Motherboard resources
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_MBRES
Hardware ID  ACPI\VEN_PNP&DEV_0C02
 
[ System devices / Motherboard resources ]
 
Device Properties:
Driver Description  Motherboard resources
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_MBRES
Hardware ID  ACPI\VEN_PNP&DEV_0C02
 
[ System devices / Motherboard resources ]
 
Device Properties:
Driver Description  Motherboard resources
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_MBRES
Hardware ID  ACPI\VEN_INTC&DEV_109F
 
[ System devices / Motherboard resources ]
 
Device Properties:
Driver Description  Motherboard resources
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_MBRES
Hardware ID  ACPI\VEN_PNP&DEV_0C02
 
[ System devices / Motherboard resources ]
 
Device Properties:
Driver Description  Motherboard resources
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_MBRES
Hardware ID  ACPI\VEN_PNP&DEV_0C02
 
[ System devices / Motherboard resources ]
 
Device Properties:
Driver Description  Motherboard resources
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_MBRES
Hardware ID  ACPI\VEN_PNP&DEV_0C02
 
[ System devices / Motherboard resources ]
 
Device Properties:
Driver Description  Motherboard resources
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_MBRES
Hardware ID  ACPI\VEN_PNP&DEV_0C02
 
[ System devices / NDIS Virtual Network Adapter Enumerator ]
 
Device Properties:
Driver Description  NDIS Virtual Network Adapter Enumerator
Driver Date  6/21/2006
Driver Version  10.0.26100.1
Driver Provider  Microsoft
INF File  ndisvirtualbus.inf
INF Section  NdisVirtualBus_Device.NT
Hardware ID  ROOT\NdisVirtualBus
 
[ System devices / PCI Express Root Complex ]
 
Device Properties:
Driver Description  PCI Express Root Complex
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  pci.inf
INF Section  PCI_ROOT
Hardware ID  ACPI\VEN_PNP&DEV_0A08
 
Device Resources:
Memory  000A0000-000BFFFF
Memory  90000000-B7FFFFFF
Port  0000-0CF7
Port  9000-FFFF
 
[ System devices / PCI Express Root Complex ]
 
Device Properties:
Driver Description  PCI Express Root Complex
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  pci.inf
INF Section  PCI_ROOT
Hardware ID  ACPI\VEN_PNP&DEV_0A08
 
Device Resources:
Memory  B8000000-BDFFFFFF
Port  2000-8BFF
 
[ System devices / PCI Express Root Port ]
 
Device Properties:
Driver Description  PCI Express Root Port
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  pci.inf
INF Section  PCI_BRIDGE
Hardware ID  PCI\VEN_8086&DEV_7ECC&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 0, device 1, function 0
PCI Device  Intel Meteor Lake-H/U / Arrow Lake - PCI Express Root Port 12
 
Device Resources:
IRQ  131071
Memory  90000000-900FFFFF
 
[ System devices / PCI standard host CPU bridge ]
 
Device Properties:
Driver Description  PCI standard host CPU bridge
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV
Hardware ID  PCI\VEN_8086&DEV_7D35&SUBSYS_8D17103C&REV_01
Location Information  PCI bus 0, device 0, function 0
PCI Device  Intel Arrow Lake-S 6+4 - Host Controller
 
[ System devices / PCI standard ISA bridge ]
 
Device Properties:
Driver Description  PCI standard ISA bridge
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  MSISADRV
Hardware ID  PCI\VEN_8086&DEV_AE0D&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 0, device 31, function 0
PCI Device  Intel Arrow Point PCH - Direct eSPI Controller
 
[ System devices / PCI standard ISA bridge ]
 
Device Properties:
Driver Description  PCI standard ISA bridge
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  MSISADRV
Hardware ID  PCI\VEN_8086&DEV_7F03&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 128, device 31, function 0
PCI Device  Intel Q870 Chipset - eSPI Controller
 
[ System devices / PCI standard RAM Controller ]
 
Device Properties:
Driver Description  PCI standard RAM Controller
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV
Hardware ID  PCI\VEN_8086&DEV_AE7F&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 0, device 20, function 0
PCI Device  Intel Arrow Lake SoC - Shared SRAM
 
[ System devices / Plug and Play Software Device Enumerator ]
 
Device Properties:
Driver Description  Plug and Play Software Device Enumerator
Driver Date  5/23/2025
Driver Version  10.0.26100.4202
Driver Provider  Microsoft
INF File  swenum.inf
INF Section  SWENUM
Hardware ID  ROOT\SWENUM
 
[ System devices / Programmable interrupt controller ]
 
Device Properties:
Driver Description  Programmable interrupt controller
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_PIC
Hardware ID  ACPI\VEN_PNP&DEV_0000
 
[ System devices / Remote Desktop Device Redirector Bus ]
 
Device Properties:
Driver Description  Remote Desktop Device Redirector Bus
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  rdpbus.inf
INF Section  RDPBUS
Hardware ID  ROOT\RDPBUS
 
[ System devices / System timer ]
 
Device Properties:
Driver Description  System timer
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  machine.inf
INF Section  NO_DRV_X
Hardware ID  ACPI\VEN_PNP&DEV_0100
 
[ System devices / UMBus Root Bus Enumerator ]
 
Device Properties:
Driver Description  UMBus Root Bus Enumerator
Driver Date  6/21/2006
Driver Version  10.0.26100.1150
Driver Provider  Microsoft
INF File  umbus.inf
INF Section  UmBusRoot_Device.NT
Hardware ID  root\umbus
 
[ System devices / Volume Manager ]
 
Device Properties:
Driver Description  Volume Manager
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  volmgr.inf
INF Section  Volmgr
Hardware ID  ROOT\VOLMGR
 
[ Universal Serial Bus controllers / Intel(R) USB 3.20 eXtensible Host Controller - 1.20 (Microsoft) ]
 
Device Properties:
Driver Description  Intel(R) USB 3.20 eXtensible Host Controller - 1.20 (Microsoft)
Driver Date  2/16/2026
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  usbxhci.inf
INF Section  Generic.Install.NT
Hardware ID  PCI\VEN_8086&DEV_7EC0&SUBSYS_8D17103C&REV_02
Location Information  PCI bus 0, device 13, function 0
PCI Device  Intel Meteor Lake-H/U / Arrow Lake - USB xHCI Host Controller
 
Device Resources:
IRQ  65536
Memory  BFFF0000-BFFFFFFF
 
Chipset Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/products/chipsets
Driver Download  https://www.intel.com/support/chipsets
BIOS Upgrades  http://www.aida64.com/goto/?p=biosupdates
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Universal Serial Bus controllers / Intel(R) USB 3.20 eXtensible Host Controller - 1.20 (Microsoft) ]
 
Device Properties:
Driver Description  Intel(R) USB 3.20 eXtensible Host Controller - 1.20 (Microsoft)
Driver Date  2/16/2026
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  usbxhci.inf
INF Section  Generic.Install.NT
Hardware ID  PCI\VEN_8086&DEV_7F6E&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 128, device 20, function 0
PCI Device  Intel Arrow Point PCH - USB 3.2 Gen 2x2 (20 Gb/s) xHCI Host Controller
 
Device Resources:
IRQ  65536
Memory  00200000-0020FFFF
 
Chipset Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/products/chipsets
Driver Download  https://www.intel.com/support/chipsets
BIOS Upgrades  http://www.aida64.com/goto/?p=biosupdates
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Universal Serial Bus controllers / USB Composite Device ]
 
Device Properties:
Driver Description  USB Composite Device
Driver Date  6/21/2006
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  usb.inf
INF Section  Composite.Dev.NT
Hardware ID  USB\VID_3434&PID_0243&REV_0100
Location Information  Port_#0003.Hub_#0001
 
[ Universal Serial Bus controllers / USB Root Hub (USB 3.0) ]
 
Device Properties:
Driver Description  USB Root Hub (USB 3.0)
Driver Date  2/16/2026
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  usbhub3.inf
INF Section  Generic.Install.NT
Hardware ID  USB\ROOT_HUB30&VID8086&PID7F6E&REV0010
 
[ Universal Serial Bus controllers / USB Root Hub (USB 3.0) ]
 
Device Properties:
Driver Description  USB Root Hub (USB 3.0)
Driver Date  2/16/2026
Driver Version  10.0.26100.7920
Driver Provider  Microsoft
INF File  usbhub3.inf
INF Section  Generic.Install.NT
Hardware ID  USB\ROOT_HUB30&VID8086&PID7EC0&REV0002
 
[ Unknown / Network Controller ]
 
Device Properties:
Driver Description  Network Controller
Hardware ID  PCI\VEN_8086&DEV_7F70&SUBSYS_00948086&REV_10
Location Information  PCI bus 128, device 20, function 3
PCI Device  Intel Arrow Point PCH - CNVi: WiFi Controller
 
[ Unknown / PCI Data Acquisition and Signal Processing Controller ]
 
Device Properties:
Driver Description  PCI Data Acquisition and Signal Processing Controller
Hardware ID  PCI\VEN_8086&DEV_AD03&SUBSYS_8D17103C&REV_01
Location Information  PCI bus 0, device 4, function 0
PCI Device  Intel Arrow Lake - Dynamic Tuning Technology (DTT)
 
[ Unknown / PCI Data Acquisition and Signal Processing Controller ]
 
Device Properties:
Driver Description  PCI Data Acquisition and Signal Processing Controller
Hardware ID  PCI\VEN_8086&DEV_AD0D&SUBSYS_8D17103C&REV_01
Location Information  PCI bus 0, device 10, function 0
PCI Device  Intel Arrow Lake - Crash Log & Telemetry
 
[ Unknown / PCI Device ]
 
Device Properties:
Driver Description  PCI Device
Hardware ID  PCI\VEN_8086&DEV_7F24&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 128, device 31, function 5
PCI Device  Intel Arrow Point PCH - SPI (Flash) Controller
 
[ Unknown / PCI Device ]
 
Device Properties:
Driver Description  PCI Device
Hardware ID  PCI\VEN_8086&DEV_7F2F&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 128, device 20, function 5
PCI Device  Intel Arrow Point PCH - Error Aggregation Handler (EAH)
 
[ Unknown / PCI Device ]
 
Device Properties:
Driver Description  PCI Device
Hardware ID  PCI\VEN_8086&DEV_AD1D&SUBSYS_8D17103C&REV_01
Location Information  PCI bus 0, device 11, function 0
PCI Device  Intel Arrow Lake - VPU
 
[ Unknown / PCI Device ]
 
Device Properties:
Driver Description  PCI Device
Hardware ID  PCI\VEN_8086&DEV_AE23&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 0, device 31, function 5
PCI Device  Intel Arrow Point PCH - SPI (Flash) Controller
 
[ Unknown / PCI Serial Port ]
 
Device Properties:
Driver Description  PCI Serial Port
Hardware ID  PCI\VEN_8086&DEV_7F6B&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 128, device 22, function 3
PCI Device  Intel Arrow Point PCH - CSME: Keyboard and Text (KT) Redirection
 
[ Unknown / PCI Simple Communications Controller ]
 
Device Properties:
Driver Description  PCI Simple Communications Controller
Hardware ID  PCI\VEN_8086&DEV_7F68&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 128, device 22, function 0
PCI Device  Intel Arrow Point PCH - CSME: HECI Controller 1
 
[ Unknown / SM Bus Controller ]
 
Device Properties:
Driver Description  SM Bus Controller
Hardware ID  PCI\VEN_8086&DEV_7F23&SUBSYS_8D17103C&REV_10
Location Information  PCI bus 128, device 31, function 4
PCI Device  Intel Arrow Point PCH - SMBus Controller
 
[ Unknown / Unknown ]
 
Device Properties:
Driver Description  Unknown
Hardware ID  ACPI\VEN_HPIC&DEV_000C
 
[ Unknown / Unknown ]
 
Device Properties:
Driver Description  Unknown
Hardware ID  ACPI\VEN_HPIC&DEV_0015
 
[ Unknown / Unknown ]
 
Device Properties:
Driver Description  Unknown
Hardware ID  ACPI\VEN_INTC&DEV_1025
 
[ Unknown / Unknown ]
 
Device Properties:
Driver Description  Unknown
Hardware ID  ACPI\VEN_INTC&DEV_1042
 
[ Unknown / Unknown ]
 
Device Properties:
Driver Description  Unknown
Hardware ID  ACPI\VEN_INTC&DEV_1064
 
[ Unknown / Unknown ]
 
Device Properties:
Driver Description  Unknown
 
[ Unknown / Unknown ]
 
Device Properties:
Driver Description  Unknown
Hardware ID  USB\VID_8087&PID_0033&REV_0000
Location Information  Port_#0014.Hub_#0001
 
[ USB Connector Managers / UCM-UCSI ACPI Device ]
 
Device Properties:
Driver Description  UCM-UCSI ACPI Device
Driver Date  6/21/2006
Driver Version  10.0.26100.1882
Driver Provider  Microsoft
INF File  ucmucsiacpiclient.inf
INF Section  UcmUcsiAcpiClient.Install.NT
Hardware ID  ACPI\VEN_USB&DEV_C000
 
Device Resources:
Memory  71EA6000-71EA6FFF


Physical Devices
 
PCI Devices:
Bus 0, Device 10, Function 0  Intel Arrow Lake - Crash Log & Telemetry
Bus 0, Device 4, Function 0  Intel Arrow Lake - Dynamic Tuning Technology (DTT)
Bus 0, Device 11, Function 0  Intel Arrow Lake - VPU
Bus 0, Device 20, Function 0  Intel Arrow Lake SoC - Shared SRAM
Bus 0, Device 2, Function 0  Intel Arrow Lake-HX/S - Integrated Graphics Controller
Bus 0, Device 0, Function 0  Intel Arrow Lake-S 6+4 - Host Controller
Bus 128, Device 31, Function 6  Intel Arrow Point - Gigabit Ethernet Controller
Bus 128, Device 31, Function 3  Intel Arrow Point PCH - Audio Context Engine
Bus 128, Device 20, Function 3  Intel Arrow Point PCH - CNVi: WiFi Controller
Bus 128, Device 22, Function 0  Intel Arrow Point PCH - CSME: HECI Controller 1
Bus 128, Device 22, Function 3  Intel Arrow Point PCH - CSME: Keyboard and Text (KT) Redirection
Bus 0, Device 31, Function 0  Intel Arrow Point PCH - Direct eSPI Controller
Bus 128, Device 20, Function 5  Intel Arrow Point PCH - Error Aggregation Handler (EAH)
Bus 128, Device 31, Function 4  Intel Arrow Point PCH - SMBus Controller
Bus 0, Device 31, Function 5  Intel Arrow Point PCH - SPI (Flash) Controller
Bus 128, Device 31, Function 5  Intel Arrow Point PCH - SPI (Flash) Controller
Bus 128, Device 20, Function 0  Intel Arrow Point PCH - USB 3.2 Gen 2x2 (20 Gb/s) xHCI Host Controller
Bus 0, Device 1, Function 0  Intel Meteor Lake-H/U / Arrow Lake - PCI Express Root Port 12
Bus 0, Device 13, Function 0  Intel Meteor Lake-H/U / Arrow Lake - USB xHCI Host Controller
Bus 128, Device 31, Function 0  Intel Q870 Chipset - eSPI Controller
Bus 1, Device 0, Function 0  Standard NVM Express Controller [2646-502E] [NoDB]
 
PnP Devices:
PNP0C08  ACPI Driver/BIOS
FIXEDBUTTON  ACPI Fixed Feature Button
ACPI000C  ACPI Processor Aggregator
PNP0A08  ACPI Three-wire Device Bus
PNP0A08  ACPI Three-wire Device Bus
ACPI000E  ACPI Wake Alarm
PNP0C09  Embedded Controller Device
PNP0A06  Extended IO Bus
PNP0A05  Generic ACPI Bus
PNP0103  High Precision Event Timer
INT33A1  Intel Power Engine Plug-in
GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_198_-_INTEL(R)_CORE(TM)_ULTRA_5_225T  Intel(R) Core(TM) Ultra 5 225T
GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_198_-_INTEL(R)_CORE(TM)_ULTRA_5_225T  Intel(R) Core(TM) Ultra 5 225T
GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_198_-_INTEL(R)_CORE(TM)_ULTRA_5_225T  Intel(R) Core(TM) Ultra 5 225T
GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_198_-_INTEL(R)_CORE(TM)_ULTRA_5_225T  Intel(R) Core(TM) Ultra 5 225T
GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_198_-_INTEL(R)_CORE(TM)_ULTRA_5_225T  Intel(R) Core(TM) Ultra 5 225T
GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_198_-_INTEL(R)_CORE(TM)_ULTRA_5_225T  Intel(R) Core(TM) Ultra 5 225T
GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_198_-_INTEL(R)_CORE(TM)_ULTRA_5_225T  Intel(R) Core(TM) Ultra 5 225T
GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_198_-_INTEL(R)_CORE(TM)_ULTRA_5_225T  Intel(R) Core(TM) Ultra 5 225T
GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_198_-_INTEL(R)_CORE(TM)_ULTRA_5_225T  Intel(R) Core(TM) Ultra 5 225T
GENUINEINTEL_-_INTEL64_FAMILY_6_MODEL_198_-_INTEL(R)_CORE(TM)_ULTRA_5_225T  Intel(R) Core(TM) Ultra 5 225T
UEFI  Microsoft UEFI-Compliant System
PNP0C14  Microsoft Windows Management Interface for ACPI
PNP0C14  Microsoft Windows Management Interface for ACPI
PNP0C14  Microsoft Windows Management Interface for ACPI
INTC109F  Motherboard resources
PNP0000  Programmable Interrupt Controller
PNP0100  System Timer
PNP0C02  Thermal Monitoring ACPI Device
PNP0C02  Thermal Monitoring ACPI Device
PNP0C02  Thermal Monitoring ACPI Device
PNP0C02  Thermal Monitoring ACPI Device
PNP0C02  Thermal Monitoring ACPI Device
PNP0C02  Thermal Monitoring ACPI Device
PNP0C02  Thermal Monitoring ACPI Device
PNP0C02  Thermal Monitoring ACPI Device
IFX1524  Trusted Platform Module 2.0 [NoDB]
USBC000  UCSI USB Connector Manager
HPIC000C  Unknown
HPIC0015  Unknown
INTC1025  Unknown
INTC1042  Unknown
INTC1064  Unknown
 
USB Devices:
8087 0033  Unknown
3434 0243  USB Composite Device
062A 4101  USB Input Device
3434 0243  USB Input Device
3434 0243  USB Input Device
3434 0243  USB Input Device


PCI Devices
 
[ Intel Arrow Lake - Crash Log & Telemetry ]
 
Device Properties:
Device Description  Intel Arrow Lake - Crash Log & Telemetry
Bus Type  PCI Express
Bus / Device / Function  0 / 10 / 0
Device ID  8086-AD0D
Subsystem ID  103C-8D17
Device Class  1180 (Data Acquisition / Signal Processing Controller)
Revision  01
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Disabled
 
[ Intel Arrow Lake - Dynamic Tuning Technology (DTT) ]
 
Device Properties:
Device Description  Intel Arrow Lake - Dynamic Tuning Technology (DTT)
Bus Type  PCI
Bus / Device / Function  0 / 4 / 0
Device ID  8086-AD03
Subsystem ID  103C-8D17
Device Class  1180 (Data Acquisition / Signal Processing Controller)
Revision  01
Fast Back-to-Back Transactions  Supported, Disabled
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Disabled
 
[ Intel Arrow Lake - VPU ]
 
Device Properties:
Device Description  Intel Arrow Lake - VPU
Bus Type  PCI Express
Bus / Device / Function  0 / 11 / 0
Device ID  8086-AD1D
Subsystem ID  103C-8D17
Device Class  1200 (Processing Accelerator)
Revision  01
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Disabled
 
[ Intel Arrow Lake SoC - Shared SRAM ]
 
Device Properties:
Device Description  Intel Arrow Lake SoC - Shared SRAM
Bus Type  PCI
Bus / Device / Function  0 / 20 / 0
Device ID  8086-AE7F
Subsystem ID  103C-8D17
Device Class  0500 (RAM Controller)
Revision  10
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Enabled
 
[ Intel Arrow Lake-HX/S - Integrated Graphics Controller ]
 
Device Properties:
Device Description  Intel Arrow Lake-HX/S - Integrated Graphics Controller
Bus Type  PCI Express 1.0 x1
Bus / Device / Function  0 / 2 / 0
Device ID  8086-7D67
Subsystem ID  103C-8D17
Device Class  0300 (VGA Display Controller)
Revision  06
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Enabled
 
Video Adapter Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/products/chipsets
Driver Download  https://www.intel.com/support/graphics
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Intel Arrow Lake-S 6+4 - Host Controller ]
 
Device Properties:
Device Description  Intel Arrow Lake-S 6+4 - Host Controller
Bus Type  PCI
Bus / Device / Function  0 / 0 / 0
Device ID  8086-7D35
Subsystem ID  103C-8D17
Device Class  0600 (Host/PCI Bridge)
Revision  01
Fast Back-to-Back Transactions  Supported, Disabled
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Enabled
 
[ Intel Arrow Point - Gigabit Ethernet Controller ]
 
Device Properties:
Device Description  Intel Arrow Point - Gigabit Ethernet Controller
Bus Type  PCI
Bus / Device / Function  128 / 31 / 6
Device ID  8086-550C
Subsystem ID  103C-8D17
Device Class  0200 (Ethernet Controller)
Revision  10
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Enabled
 
Network Adapter Manufacturer:
Company Name  Intel Corporation
Product Information  https://www.intel.com/content/www/us/en/products/network-io.html
Driver Download  https://www.intel.com/support/network
Driver Update  http://www.aida64.com/goto/?p=drvupdates
 
[ Intel Arrow Point PCH - Audio Context Engine ]
 
Device Properties:
Device Description  Intel Arrow Point PCH - Audio Context Engine
Bus Type  PCI
Bus / Device / Function  128 / 31 / 3
Device ID  8086-7F50
Subsystem ID  103C-8D17
Device Class  0403 (High Definition Audio)
Revision  10
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Enabled
 
[ Intel Arrow Point PCH - CNVi: WiFi Controller ]
 
Device Properties:
Device Description  Intel Arrow Point PCH - CNVi: WiFi Controller
Bus Type  PCI Express
Bus / Device / Function  128 / 20 / 3
Device ID  8086-7F70
Subsystem ID  8086-0094
Device Class  0280 (Network Controller)
Revision  10
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Disabled
 
[ Intel Arrow Point PCH - CSME: HECI Controller 1 ]
 
Device Properties:
Device Description  Intel Arrow Point PCH - CSME: HECI Controller 1
Bus Type  PCI
Bus / Device / Function  128 / 22 / 0
Device ID  8086-7F68
Subsystem ID  103C-8D17
Device Class  0780 (Communications Controller)
Revision  10
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Disabled
 
[ Intel Arrow Point PCH - CSME: Keyboard and Text (KT) Redirection ]
 
Device Properties:
Device Description  Intel Arrow Point PCH - CSME: Keyboard and Text (KT) Redirection
Bus Type  PCI
Bus / Device / Function  128 / 22 / 3
Device ID  8086-7F6B
Subsystem ID  103C-8D17
Device Class  0700 (Serial Controller)
Revision  10
Fast Back-to-Back Transactions  Supported, Disabled
 
Device Features:
66 MHz Operation  Supported
Bus Mastering  Disabled
 
[ Intel Arrow Point PCH - Direct eSPI Controller ]
 
Device Properties:
Device Description  Intel Arrow Point PCH - Direct eSPI Controller
Bus Type  PCI
Bus / Device / Function  0 / 31 / 0
Device ID  8086-AE0D
Subsystem ID  103C-8D17
Device Class  0601 (PCI/ISA Bridge)
Revision  10
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Enabled
 
[ Intel Arrow Point PCH - Error Aggregation Handler (EAH) ]
 
Device Properties:
Device Description  Intel Arrow Point PCH - Error Aggregation Handler (EAH)
Bus Type  PCI Express
Bus / Device / Function  128 / 20 / 5
Device ID  8086-7F2F
Subsystem ID  103C-8D17
Revision  10
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Disabled
 
[ Intel Arrow Point PCH - SMBus Controller ]
 
Device Properties:
Device Description  Intel Arrow Point PCH - SMBus Controller
Bus Type  PCI
Bus / Device / Function  128 / 31 / 4
Device ID  8086-7F23
Subsystem ID  103C-8D17
Device Class  0C05 (SMBus Controller)
Revision  10
Fast Back-to-Back Transactions  Supported, Disabled
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Disabled
 
[ Intel Arrow Point PCH - SPI (Flash) Controller ]
 
Device Properties:
Device Description  Intel Arrow Point PCH - SPI (Flash) Controller
Bus Type  PCI
Bus / Device / Function  0 / 31 / 5
Device ID  8086-AE23
Subsystem ID  103C-8D17
Device Class  0C80 (Serial Bus Controller)
Revision  10
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Disabled
 
[ Intel Arrow Point PCH - SPI (Flash) Controller ]
 
Device Properties:
Device Description  Intel Arrow Point PCH - SPI (Flash) Controller
Bus Type  PCI
Bus / Device / Function  128 / 31 / 5
Device ID  8086-7F24
Subsystem ID  103C-8D17
Device Class  0C80 (Serial Bus Controller)
Revision  10
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Disabled
 
[ Intel Arrow Point PCH - USB 3.2 Gen 2x2 (20 Gb/s) xHCI Host Controller ]
 
Device Properties:
Device Description  Intel Arrow Point PCH - USB 3.2 Gen 2x2 (20 Gb/s) xHCI Host Controller
Bus Type  PCI
Bus / Device / Function  128 / 20 / 0
Device ID  8086-7F6E
Subsystem ID  103C-8D17
Device Class  0C03 (USB3 xHCI Controller)
Revision  10
Fast Back-to-Back Transactions  Supported, Disabled
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Enabled
 
[ Intel Meteor Lake-H/U / Arrow Lake - PCI Express Root Port 12 ]
 
Device Properties:
Device Description  Intel Meteor Lake-H/U / Arrow Lake - PCI Express Root Port 12
Bus Type  PCI
Bus / Device / Function  0 / 1 / 0
Device ID  8086-7ECC
Subsystem ID  0000-0000
Device Class  0604 (PCI/PCI Bridge)
Revision  10
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Enabled
 
[ Intel Meteor Lake-H/U / Arrow Lake - USB xHCI Host Controller ]
 
Device Properties:
Device Description  Intel Meteor Lake-H/U / Arrow Lake - USB xHCI Host Controller
Bus Type  PCI
Bus / Device / Function  0 / 13 / 0
Device ID  8086-7EC0
Subsystem ID  103C-8D17
Device Class  0C03 (USB3 xHCI Controller)
Revision  02
Fast Back-to-Back Transactions  Supported, Disabled
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Disabled
 
[ Intel Q870 Chipset - eSPI Controller ]
 
Device Properties:
Device Description  Intel Q870 Chipset - eSPI Controller
Bus Type  PCI
Bus / Device / Function  128 / 31 / 0
Device ID  8086-7F03
Subsystem ID  103C-8D17
Device Class  0601 (PCI/ISA Bridge)
Revision  10
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Disabled
 
[ Standard NVM Express Controller [2646-502E] [NoDB] ]
 
Device Properties:
Device Description  Standard NVM Express Controller [2646-502E] [NoDB]
Bus Type  PCI Express 4.0 x4
Bus / Device / Function  1 / 0 / 0
Device ID  2646-502E
Subsystem ID  2646-502E
Device Class  0108 (Non-Volatile Memory Controller)
Revision  01
Fast Back-to-Back Transactions  Not Supported
 
Device Features:
66 MHz Operation  Not Supported
Bus Mastering  Enabled


USB Devices
 
[ USB Input Device (2.4G Wireless Mouse) ]
 
Device Properties:
Device Description  USB Input Device
Device ID  062A-4101
Device Class  03 / 01 (Human Interface Device)
Device Protocol  01
Revision  0101h
Manufacturer  Newmen Tech.,LTD
Product  2.4G Wireless Mouse
Supported USB Version  1.10
Current Speed  Full (USB 1.1)
 
[ USB Composite Device (Keychron K4 Pro) ]
 
Device Properties:
Device Description  USB Composite Device
Device ID  3434-0243
Device Class  03 / 01 (Human Interface Device)
Device Protocol  01
Revision  0100h
Manufacturer  Keychron
Product  Keychron K4 Pro
Supported USB Version  2.00
Current Speed  Full (USB 1.1)
 
[ Unknown Device ]
 
Device Properties:
Device Description  Unknown Device
Device ID  8087-0033
Device Class  E0 / 01 (Bluetooth)
Device Protocol  01
Revision  0000h
Supported USB Version  2.01
Current Speed  Full (USB 1.1)


Device Resources
 
Resource  Share  Device Description
IRQ 100  Exclusive  Microsoft ACPI-Compliant System
IRQ 101  Exclusive  Microsoft ACPI-Compliant System
IRQ 102  Exclusive  Microsoft ACPI-Compliant System
IRQ 103  Exclusive  Microsoft ACPI-Compliant System
IRQ 104  Exclusive  Microsoft ACPI-Compliant System
IRQ 105  Exclusive  Microsoft ACPI-Compliant System
IRQ 106  Exclusive  Microsoft ACPI-Compliant System
IRQ 107  Exclusive  Microsoft ACPI-Compliant System
IRQ 108  Exclusive  Microsoft ACPI-Compliant System
IRQ 109  Exclusive  Microsoft ACPI-Compliant System
IRQ 110  Exclusive  Microsoft ACPI-Compliant System
IRQ 111  Exclusive  Microsoft ACPI-Compliant System
IRQ 112  Exclusive  Microsoft ACPI-Compliant System
IRQ 113  Exclusive  Microsoft ACPI-Compliant System
IRQ 114  Exclusive  Microsoft ACPI-Compliant System
IRQ 115  Exclusive  Microsoft ACPI-Compliant System
IRQ 116  Exclusive  Microsoft ACPI-Compliant System
IRQ 117  Exclusive  Microsoft ACPI-Compliant System
IRQ 118  Exclusive  Microsoft ACPI-Compliant System
IRQ 119  Exclusive  Microsoft ACPI-Compliant System
IRQ 120  Exclusive  Microsoft ACPI-Compliant System
IRQ 121  Exclusive  Microsoft ACPI-Compliant System
IRQ 122  Exclusive  Microsoft ACPI-Compliant System
IRQ 123  Exclusive  Microsoft ACPI-Compliant System
IRQ 124  Exclusive  Microsoft ACPI-Compliant System
IRQ 125  Exclusive  Microsoft ACPI-Compliant System
IRQ 126  Exclusive  Microsoft ACPI-Compliant System
IRQ 127  Exclusive  Microsoft ACPI-Compliant System
IRQ 128  Exclusive  Microsoft ACPI-Compliant System
IRQ 129  Exclusive  Microsoft ACPI-Compliant System
IRQ 130  Exclusive  Microsoft ACPI-Compliant System
IRQ 131  Exclusive  Microsoft ACPI-Compliant System
IRQ 131071  Exclusive  PCI Express Root Port
IRQ 132  Exclusive  Microsoft ACPI-Compliant System
IRQ 133  Exclusive  Microsoft ACPI-Compliant System
IRQ 134  Exclusive  Microsoft ACPI-Compliant System
IRQ 135  Exclusive  Microsoft ACPI-Compliant System
IRQ 136  Exclusive  Microsoft ACPI-Compliant System
IRQ 137  Exclusive  Microsoft ACPI-Compliant System
IRQ 138  Exclusive  Microsoft ACPI-Compliant System
IRQ 139  Exclusive  Microsoft ACPI-Compliant System
IRQ 140  Exclusive  Microsoft ACPI-Compliant System
IRQ 141  Exclusive  Microsoft ACPI-Compliant System
IRQ 142  Exclusive  Microsoft ACPI-Compliant System
IRQ 143  Exclusive  Microsoft ACPI-Compliant System
IRQ 144  Exclusive  Microsoft ACPI-Compliant System
IRQ 145  Exclusive  Microsoft ACPI-Compliant System
IRQ 146  Exclusive  Microsoft ACPI-Compliant System
IRQ 147  Exclusive  Microsoft ACPI-Compliant System
IRQ 148  Exclusive  Microsoft ACPI-Compliant System
IRQ 149  Exclusive  Microsoft ACPI-Compliant System
IRQ 150  Exclusive  Microsoft ACPI-Compliant System
IRQ 151  Exclusive  Microsoft ACPI-Compliant System
IRQ 152  Exclusive  Microsoft ACPI-Compliant System
IRQ 153  Exclusive  Microsoft ACPI-Compliant System
IRQ 154  Exclusive  Microsoft ACPI-Compliant System
IRQ 155  Exclusive  Microsoft ACPI-Compliant System
IRQ 156  Exclusive  Microsoft ACPI-Compliant System
IRQ 157  Exclusive  Microsoft ACPI-Compliant System
IRQ 158  Exclusive  Microsoft ACPI-Compliant System
IRQ 159  Exclusive  Microsoft ACPI-Compliant System
IRQ 16  Shared  High Definition Audio Controller
IRQ 160  Exclusive  Microsoft ACPI-Compliant System
IRQ 161  Exclusive  Microsoft ACPI-Compliant System
IRQ 162  Exclusive  Microsoft ACPI-Compliant System
IRQ 163  Exclusive  Microsoft ACPI-Compliant System
IRQ 164  Exclusive  Microsoft ACPI-Compliant System
IRQ 165  Exclusive  Microsoft ACPI-Compliant System
IRQ 166  Exclusive  Microsoft ACPI-Compliant System
IRQ 167  Exclusive  Microsoft ACPI-Compliant System
IRQ 168  Exclusive  Microsoft ACPI-Compliant System
IRQ 169  Exclusive  Microsoft ACPI-Compliant System
IRQ 170  Exclusive  Microsoft ACPI-Compliant System
IRQ 171  Exclusive  Microsoft ACPI-Compliant System
IRQ 172  Exclusive  Microsoft ACPI-Compliant System
IRQ 173  Exclusive  Microsoft ACPI-Compliant System
IRQ 174  Exclusive  Microsoft ACPI-Compliant System
IRQ 175  Exclusive  Microsoft ACPI-Compliant System
IRQ 176  Exclusive  Microsoft ACPI-Compliant System
IRQ 177  Exclusive  Microsoft ACPI-Compliant System
IRQ 178  Exclusive  Microsoft ACPI-Compliant System
IRQ 179  Exclusive  Microsoft ACPI-Compliant System
IRQ 180  Exclusive  Microsoft ACPI-Compliant System
IRQ 181  Exclusive  Microsoft ACPI-Compliant System
IRQ 182  Exclusive  Microsoft ACPI-Compliant System
IRQ 183  Exclusive  Microsoft ACPI-Compliant System
IRQ 184  Exclusive  Microsoft ACPI-Compliant System
IRQ 185  Exclusive  Microsoft ACPI-Compliant System
IRQ 186  Exclusive  Microsoft ACPI-Compliant System
IRQ 187  Exclusive  Microsoft ACPI-Compliant System
IRQ 188  Exclusive  Microsoft ACPI-Compliant System
IRQ 189  Exclusive  Microsoft ACPI-Compliant System
IRQ 190  Exclusive  Microsoft ACPI-Compliant System
IRQ 191  Exclusive  Microsoft ACPI-Compliant System
IRQ 192  Exclusive  Microsoft ACPI-Compliant System
IRQ 193  Exclusive  Microsoft ACPI-Compliant System
IRQ 194  Exclusive  Microsoft ACPI-Compliant System
IRQ 195  Exclusive  Microsoft ACPI-Compliant System
IRQ 196  Exclusive  Microsoft ACPI-Compliant System
IRQ 197  Exclusive  Microsoft ACPI-Compliant System
IRQ 198  Exclusive  Microsoft ACPI-Compliant System
IRQ 199  Exclusive  Microsoft ACPI-Compliant System
IRQ 200  Exclusive  Microsoft ACPI-Compliant System
IRQ 201  Exclusive  Microsoft ACPI-Compliant System
IRQ 202  Exclusive  Microsoft ACPI-Compliant System
IRQ 203  Exclusive  Microsoft ACPI-Compliant System
IRQ 204  Exclusive  Microsoft ACPI-Compliant System
IRQ 256  Exclusive  Microsoft ACPI-Compliant System
IRQ 257  Exclusive  Microsoft ACPI-Compliant System
IRQ 258  Exclusive  Microsoft ACPI-Compliant System
IRQ 259  Exclusive  Microsoft ACPI-Compliant System
IRQ 260  Exclusive  Microsoft ACPI-Compliant System
IRQ 261  Exclusive  Microsoft ACPI-Compliant System
IRQ 262  Exclusive  Microsoft ACPI-Compliant System
IRQ 263  Exclusive  Microsoft ACPI-Compliant System
IRQ 264  Exclusive  Microsoft ACPI-Compliant System
IRQ 265  Exclusive  Microsoft ACPI-Compliant System
IRQ 266  Exclusive  Microsoft ACPI-Compliant System
IRQ 267  Exclusive  Microsoft ACPI-Compliant System
IRQ 268  Exclusive  Microsoft ACPI-Compliant System
IRQ 269  Exclusive  Microsoft ACPI-Compliant System
IRQ 270  Exclusive  Microsoft ACPI-Compliant System
IRQ 271  Exclusive  Microsoft ACPI-Compliant System
IRQ 272  Exclusive  Microsoft ACPI-Compliant System
IRQ 273  Exclusive  Microsoft ACPI-Compliant System
IRQ 274  Exclusive  Microsoft ACPI-Compliant System
IRQ 275  Exclusive  Microsoft ACPI-Compliant System
IRQ 276  Exclusive  Microsoft ACPI-Compliant System
IRQ 277  Exclusive  Microsoft ACPI-Compliant System
IRQ 278  Exclusive  Microsoft ACPI-Compliant System
IRQ 279  Exclusive  Microsoft ACPI-Compliant System
IRQ 280  Exclusive  Microsoft ACPI-Compliant System
IRQ 281  Exclusive  Microsoft ACPI-Compliant System
IRQ 282  Exclusive  Microsoft ACPI-Compliant System
IRQ 283  Exclusive  Microsoft ACPI-Compliant System
IRQ 284  Exclusive  Microsoft ACPI-Compliant System
IRQ 285  Exclusive  Microsoft ACPI-Compliant System
IRQ 286  Exclusive  Microsoft ACPI-Compliant System
IRQ 287  Exclusive  Microsoft ACPI-Compliant System
IRQ 288  Exclusive  Microsoft ACPI-Compliant System
IRQ 289  Exclusive  Microsoft ACPI-Compliant System
IRQ 290  Exclusive  Microsoft ACPI-Compliant System
IRQ 291  Exclusive  Microsoft ACPI-Compliant System
IRQ 292  Exclusive  Microsoft ACPI-Compliant System
IRQ 293  Exclusive  Microsoft ACPI-Compliant System
IRQ 294  Exclusive  Microsoft ACPI-Compliant System
IRQ 295  Exclusive  Microsoft ACPI-Compliant System
IRQ 296  Exclusive  Microsoft ACPI-Compliant System
IRQ 297  Exclusive  Microsoft ACPI-Compliant System
IRQ 298  Exclusive  Microsoft ACPI-Compliant System
IRQ 299  Exclusive  Microsoft ACPI-Compliant System
IRQ 300  Exclusive  Microsoft ACPI-Compliant System
IRQ 301  Exclusive  Microsoft ACPI-Compliant System
IRQ 302  Exclusive  Microsoft ACPI-Compliant System
IRQ 303  Exclusive  Microsoft ACPI-Compliant System
IRQ 304  Exclusive  Microsoft ACPI-Compliant System
IRQ 305  Exclusive  Microsoft ACPI-Compliant System
IRQ 306  Exclusive  Microsoft ACPI-Compliant System
IRQ 307  Exclusive  Microsoft ACPI-Compliant System
IRQ 308  Exclusive  Microsoft ACPI-Compliant System
IRQ 309  Exclusive  Microsoft ACPI-Compliant System
IRQ 310  Exclusive  Microsoft ACPI-Compliant System
IRQ 311  Exclusive  Microsoft ACPI-Compliant System
IRQ 312  Exclusive  Microsoft ACPI-Compliant System
IRQ 313  Exclusive  Microsoft ACPI-Compliant System
IRQ 314  Exclusive  Microsoft ACPI-Compliant System
IRQ 315  Exclusive  Microsoft ACPI-Compliant System
IRQ 316  Exclusive  Microsoft ACPI-Compliant System
IRQ 317  Exclusive  Microsoft ACPI-Compliant System
IRQ 318  Exclusive  Microsoft ACPI-Compliant System
IRQ 319  Exclusive  Microsoft ACPI-Compliant System
IRQ 320  Exclusive  Microsoft ACPI-Compliant System
IRQ 321  Exclusive  Microsoft ACPI-Compliant System
IRQ 322  Exclusive  Microsoft ACPI-Compliant System
IRQ 323  Exclusive  Microsoft ACPI-Compliant System
IRQ 324  Exclusive  Microsoft ACPI-Compliant System
IRQ 325  Exclusive  Microsoft ACPI-Compliant System
IRQ 326  Exclusive  Microsoft ACPI-Compliant System
IRQ 327  Exclusive  Microsoft ACPI-Compliant System
IRQ 328  Exclusive  Microsoft ACPI-Compliant System
IRQ 329  Exclusive  Microsoft ACPI-Compliant System
IRQ 330  Exclusive  Microsoft ACPI-Compliant System
IRQ 331  Exclusive  Microsoft ACPI-Compliant System
IRQ 332  Exclusive  Microsoft ACPI-Compliant System
IRQ 333  Exclusive  Microsoft ACPI-Compliant System
IRQ 334  Exclusive  Microsoft ACPI-Compliant System
IRQ 335  Exclusive  Microsoft ACPI-Compliant System
IRQ 336  Exclusive  Microsoft ACPI-Compliant System
IRQ 337  Exclusive  Microsoft ACPI-Compliant System
IRQ 338  Exclusive  Microsoft ACPI-Compliant System
IRQ 339  Exclusive  Microsoft ACPI-Compliant System
IRQ 340  Exclusive  Microsoft ACPI-Compliant System
IRQ 341  Exclusive  Microsoft ACPI-Compliant System
IRQ 342  Exclusive  Microsoft ACPI-Compliant System
IRQ 343  Exclusive  Microsoft ACPI-Compliant System
IRQ 344  Exclusive  Microsoft ACPI-Compliant System
IRQ 345  Exclusive  Microsoft ACPI-Compliant System
IRQ 346  Exclusive  Microsoft ACPI-Compliant System
IRQ 347  Exclusive  Microsoft ACPI-Compliant System
IRQ 348  Exclusive  Microsoft ACPI-Compliant System
IRQ 349  Exclusive  Microsoft ACPI-Compliant System
IRQ 350  Exclusive  Microsoft ACPI-Compliant System
IRQ 351  Exclusive  Microsoft ACPI-Compliant System
IRQ 352  Exclusive  Microsoft ACPI-Compliant System
IRQ 353  Exclusive  Microsoft ACPI-Compliant System
IRQ 354  Exclusive  Microsoft ACPI-Compliant System
IRQ 355  Exclusive  Microsoft ACPI-Compliant System
IRQ 356  Exclusive  Microsoft ACPI-Compliant System
IRQ 357  Exclusive  Microsoft ACPI-Compliant System
IRQ 358  Exclusive  Microsoft ACPI-Compliant System
IRQ 359  Exclusive  Microsoft ACPI-Compliant System
IRQ 360  Exclusive  Microsoft ACPI-Compliant System
IRQ 361  Exclusive  Microsoft ACPI-Compliant System
IRQ 362  Exclusive  Microsoft ACPI-Compliant System
IRQ 363  Exclusive  Microsoft ACPI-Compliant System
IRQ 364  Exclusive  Microsoft ACPI-Compliant System
IRQ 365  Exclusive  Microsoft ACPI-Compliant System
IRQ 366  Exclusive  Microsoft ACPI-Compliant System
IRQ 367  Exclusive  Microsoft ACPI-Compliant System
IRQ 368  Exclusive  Microsoft ACPI-Compliant System
IRQ 369  Exclusive  Microsoft ACPI-Compliant System
IRQ 370  Exclusive  Microsoft ACPI-Compliant System
IRQ 371  Exclusive  Microsoft ACPI-Compliant System
IRQ 372  Exclusive  Microsoft ACPI-Compliant System
IRQ 373  Exclusive  Microsoft ACPI-Compliant System
IRQ 374  Exclusive  Microsoft ACPI-Compliant System
IRQ 375  Exclusive  Microsoft ACPI-Compliant System
IRQ 376  Exclusive  Microsoft ACPI-Compliant System
IRQ 377  Exclusive  Microsoft ACPI-Compliant System
IRQ 378  Exclusive  Microsoft ACPI-Compliant System
IRQ 379  Exclusive  Microsoft ACPI-Compliant System
IRQ 380  Exclusive  Microsoft ACPI-Compliant System
IRQ 381  Exclusive  Microsoft ACPI-Compliant System
IRQ 382  Exclusive  Microsoft ACPI-Compliant System
IRQ 383  Exclusive  Microsoft ACPI-Compliant System
IRQ 384  Exclusive  Microsoft ACPI-Compliant System
IRQ 385  Exclusive  Microsoft ACPI-Compliant System
IRQ 386  Exclusive  Microsoft ACPI-Compliant System
IRQ 387  Exclusive  Microsoft ACPI-Compliant System
IRQ 388  Exclusive  Microsoft ACPI-Compliant System
IRQ 389  Exclusive  Microsoft ACPI-Compliant System
IRQ 390  Exclusive  Microsoft ACPI-Compliant System
IRQ 391  Exclusive  Microsoft ACPI-Compliant System
IRQ 392  Exclusive  Microsoft ACPI-Compliant System
IRQ 393  Exclusive  Microsoft ACPI-Compliant System
IRQ 394  Exclusive  Microsoft ACPI-Compliant System
IRQ 395  Exclusive  Microsoft ACPI-Compliant System
IRQ 396  Exclusive  Microsoft ACPI-Compliant System
IRQ 397  Exclusive  Microsoft ACPI-Compliant System
IRQ 398  Exclusive  Microsoft ACPI-Compliant System
IRQ 399  Exclusive  Microsoft ACPI-Compliant System
IRQ 400  Exclusive  Microsoft ACPI-Compliant System
IRQ 401  Exclusive  Microsoft ACPI-Compliant System
IRQ 402  Exclusive  Microsoft ACPI-Compliant System
IRQ 403  Exclusive  Microsoft ACPI-Compliant System
IRQ 404  Exclusive  Microsoft ACPI-Compliant System
IRQ 405  Exclusive  Microsoft ACPI-Compliant System
IRQ 406  Exclusive  Microsoft ACPI-Compliant System
IRQ 407  Exclusive  Microsoft ACPI-Compliant System
IRQ 408  Exclusive  Microsoft ACPI-Compliant System
IRQ 409  Exclusive  Microsoft ACPI-Compliant System
IRQ 410  Exclusive  Microsoft ACPI-Compliant System
IRQ 411  Exclusive  Microsoft ACPI-Compliant System
IRQ 412  Exclusive  Microsoft ACPI-Compliant System
IRQ 413  Exclusive  Microsoft ACPI-Compliant System
IRQ 414  Exclusive  Microsoft ACPI-Compliant System
IRQ 415  Exclusive  Microsoft ACPI-Compliant System
IRQ 416  Exclusive  Microsoft ACPI-Compliant System
IRQ 417  Exclusive  Microsoft ACPI-Compliant System
IRQ 418  Exclusive  Microsoft ACPI-Compliant System
IRQ 419  Exclusive  Microsoft ACPI-Compliant System
IRQ 420  Exclusive  Microsoft ACPI-Compliant System
IRQ 421  Exclusive  Microsoft ACPI-Compliant System
IRQ 422  Exclusive  Microsoft ACPI-Compliant System
IRQ 423  Exclusive  Microsoft ACPI-Compliant System
IRQ 424  Exclusive  Microsoft ACPI-Compliant System
IRQ 425  Exclusive  Microsoft ACPI-Compliant System
IRQ 426  Exclusive  Microsoft ACPI-Compliant System
IRQ 427  Exclusive  Microsoft ACPI-Compliant System
IRQ 428  Exclusive  Microsoft ACPI-Compliant System
IRQ 429  Exclusive  Microsoft ACPI-Compliant System
IRQ 430  Exclusive  Microsoft ACPI-Compliant System
IRQ 431  Exclusive  Microsoft ACPI-Compliant System
IRQ 432  Exclusive  Microsoft ACPI-Compliant System
IRQ 433  Exclusive  Microsoft ACPI-Compliant System
IRQ 434  Exclusive  Microsoft ACPI-Compliant System
IRQ 435  Exclusive  Microsoft ACPI-Compliant System
IRQ 436  Exclusive  Microsoft ACPI-Compliant System
IRQ 437  Exclusive  Microsoft ACPI-Compliant System
IRQ 438  Exclusive  Microsoft ACPI-Compliant System
IRQ 439  Exclusive  Microsoft ACPI-Compliant System
IRQ 440  Exclusive  Microsoft ACPI-Compliant System
IRQ 441  Exclusive  Microsoft ACPI-Compliant System
IRQ 442  Exclusive  Microsoft ACPI-Compliant System
IRQ 443  Exclusive  Microsoft ACPI-Compliant System
IRQ 444  Exclusive  Microsoft ACPI-Compliant System
IRQ 445  Exclusive  Microsoft ACPI-Compliant System
IRQ 446  Exclusive  Microsoft ACPI-Compliant System
IRQ 447  Exclusive  Microsoft ACPI-Compliant System
IRQ 448  Exclusive  Microsoft ACPI-Compliant System
IRQ 449  Exclusive  Microsoft ACPI-Compliant System
IRQ 450  Exclusive  Microsoft ACPI-Compliant System
IRQ 451  Exclusive  Microsoft ACPI-Compliant System
IRQ 452  Exclusive  Microsoft ACPI-Compliant System
IRQ 453  Exclusive  Microsoft ACPI-Compliant System
IRQ 454  Exclusive  Microsoft ACPI-Compliant System
IRQ 455  Exclusive  Microsoft ACPI-Compliant System
IRQ 456  Exclusive  Microsoft ACPI-Compliant System
IRQ 457  Exclusive  Microsoft ACPI-Compliant System
IRQ 458  Exclusive  Microsoft ACPI-Compliant System
IRQ 459  Exclusive  Microsoft ACPI-Compliant System
IRQ 460  Exclusive  Microsoft ACPI-Compliant System
IRQ 461  Exclusive  Microsoft ACPI-Compliant System
IRQ 462  Exclusive  Microsoft ACPI-Compliant System
IRQ 463  Exclusive  Microsoft ACPI-Compliant System
IRQ 464  Exclusive  Microsoft ACPI-Compliant System
IRQ 465  Exclusive  Microsoft ACPI-Compliant System
IRQ 466  Exclusive  Microsoft ACPI-Compliant System
IRQ 467  Exclusive  Microsoft ACPI-Compliant System
IRQ 468  Exclusive  Microsoft ACPI-Compliant System
IRQ 469  Exclusive  Microsoft ACPI-Compliant System
IRQ 470  Exclusive  Microsoft ACPI-Compliant System
IRQ 471  Exclusive  Microsoft ACPI-Compliant System
IRQ 472  Exclusive  Microsoft ACPI-Compliant System
IRQ 473  Exclusive  Microsoft ACPI-Compliant System
IRQ 474  Exclusive  Microsoft ACPI-Compliant System
IRQ 475  Exclusive  Microsoft ACPI-Compliant System
IRQ 476  Exclusive  Microsoft ACPI-Compliant System
IRQ 477  Exclusive  Microsoft ACPI-Compliant System
IRQ 478  Exclusive  Microsoft ACPI-Compliant System
IRQ 479  Exclusive  Microsoft ACPI-Compliant System
IRQ 480  Exclusive  Microsoft ACPI-Compliant System
IRQ 481  Exclusive  Microsoft ACPI-Compliant System
IRQ 482  Exclusive  Microsoft ACPI-Compliant System
IRQ 483  Exclusive  Microsoft ACPI-Compliant System
IRQ 484  Exclusive  Microsoft ACPI-Compliant System
IRQ 485  Exclusive  Microsoft ACPI-Compliant System
IRQ 486  Exclusive  Microsoft ACPI-Compliant System
IRQ 487  Exclusive  Microsoft ACPI-Compliant System
IRQ 488  Exclusive  Microsoft ACPI-Compliant System
IRQ 489  Exclusive  Microsoft ACPI-Compliant System
IRQ 490  Exclusive  Microsoft ACPI-Compliant System
IRQ 491  Exclusive  Microsoft ACPI-Compliant System
IRQ 492  Exclusive  Microsoft ACPI-Compliant System
IRQ 493  Exclusive  Microsoft ACPI-Compliant System
IRQ 494  Exclusive  Microsoft ACPI-Compliant System
IRQ 495  Exclusive  Microsoft ACPI-Compliant System
IRQ 496  Exclusive  Microsoft ACPI-Compliant System
IRQ 497  Exclusive  Microsoft ACPI-Compliant System
IRQ 498  Exclusive  Microsoft ACPI-Compliant System
IRQ 499  Exclusive  Microsoft ACPI-Compliant System
IRQ 500  Exclusive  Microsoft ACPI-Compliant System
IRQ 501  Exclusive  Microsoft ACPI-Compliant System
IRQ 502  Exclusive  Microsoft ACPI-Compliant System
IRQ 503  Exclusive  Microsoft ACPI-Compliant System
IRQ 504  Exclusive  Microsoft ACPI-Compliant System
IRQ 505  Exclusive  Microsoft ACPI-Compliant System
IRQ 506  Exclusive  Microsoft ACPI-Compliant System
IRQ 507  Exclusive  Microsoft ACPI-Compliant System
IRQ 508  Exclusive  Microsoft ACPI-Compliant System
IRQ 509  Exclusive  Microsoft ACPI-Compliant System
IRQ 510  Exclusive  Microsoft ACPI-Compliant System
IRQ 511  Exclusive  Microsoft ACPI-Compliant System
IRQ 53  Shared  Trusted Platform Module 2.0
IRQ 55  Exclusive  Microsoft ACPI-Compliant System
IRQ 56  Exclusive  Microsoft ACPI-Compliant System
IRQ 57  Exclusive  Microsoft ACPI-Compliant System
IRQ 58  Exclusive  Microsoft ACPI-Compliant System
IRQ 59  Exclusive  Microsoft ACPI-Compliant System
IRQ 60  Exclusive  Microsoft ACPI-Compliant System
IRQ 61  Exclusive  Microsoft ACPI-Compliant System
IRQ 62  Exclusive  Microsoft ACPI-Compliant System
IRQ 63  Exclusive  Microsoft ACPI-Compliant System
IRQ 64  Exclusive  Microsoft ACPI-Compliant System
IRQ 65  Exclusive  Microsoft ACPI-Compliant System
IRQ 65536  Exclusive  Intel(R) USB 3.20 eXtensible Host Controller - 1.20 (Microsoft)
IRQ 65536  Exclusive  Intel(R) USB 3.20 eXtensible Host Controller - 1.20 (Microsoft)
IRQ 65536  Exclusive  Intel(R) Ethernet Connection (19) I219-LM
IRQ 65536  Exclusive  Standard NVM Express Controller
IRQ 65536  Exclusive  Standard NVM Express Controller
IRQ 65536  Exclusive  Standard NVM Express Controller
IRQ 65536  Exclusive  Standard NVM Express Controller
IRQ 65536  Exclusive  Standard NVM Express Controller
IRQ 65536  Exclusive  Standard NVM Express Controller
IRQ 65536  Exclusive  Standard NVM Express Controller
IRQ 65536  Exclusive  Standard NVM Express Controller
IRQ 65536  Exclusive  Standard NVM Express Controller
IRQ 65536  Exclusive  Standard NVM Express Controller
IRQ 65536  Exclusive  Standard NVM Express Controller
IRQ 66  Exclusive  Microsoft ACPI-Compliant System
IRQ 67  Exclusive  Microsoft ACPI-Compliant System
IRQ 68  Exclusive  Microsoft ACPI-Compliant System
IRQ 69  Exclusive  Microsoft ACPI-Compliant System
IRQ 70  Exclusive  Microsoft ACPI-Compliant System
IRQ 71  Exclusive  Microsoft ACPI-Compliant System
IRQ 72  Exclusive  Microsoft ACPI-Compliant System
IRQ 73  Exclusive  Microsoft ACPI-Compliant System
IRQ 74  Exclusive  Microsoft ACPI-Compliant System
IRQ 75  Exclusive  Microsoft ACPI-Compliant System
IRQ 76  Exclusive  Microsoft ACPI-Compliant System
IRQ 77  Exclusive  Microsoft ACPI-Compliant System
IRQ 78  Exclusive  Microsoft ACPI-Compliant System
IRQ 79  Exclusive  Microsoft ACPI-Compliant System
IRQ 80  Exclusive  Microsoft ACPI-Compliant System
IRQ 81  Exclusive  Microsoft ACPI-Compliant System
IRQ 82  Exclusive  Microsoft ACPI-Compliant System
IRQ 83  Exclusive  Microsoft ACPI-Compliant System
IRQ 84  Exclusive  Microsoft ACPI-Compliant System
IRQ 85  Exclusive  Microsoft ACPI-Compliant System
IRQ 86  Exclusive  Microsoft ACPI-Compliant System
IRQ 87  Exclusive  Microsoft ACPI-Compliant System
IRQ 88  Exclusive  Microsoft ACPI-Compliant System
IRQ 89  Exclusive  Microsoft ACPI-Compliant System
IRQ 90  Exclusive  Microsoft ACPI-Compliant System
IRQ 91  Exclusive  Microsoft ACPI-Compliant System
IRQ 92  Exclusive  Microsoft ACPI-Compliant System
IRQ 93  Exclusive  Microsoft ACPI-Compliant System
IRQ 94  Exclusive  Microsoft ACPI-Compliant System
IRQ 95  Exclusive  Microsoft ACPI-Compliant System
IRQ 96  Exclusive  Microsoft ACPI-Compliant System
IRQ 97  Exclusive  Microsoft ACPI-Compliant System
IRQ 98  Exclusive  Microsoft ACPI-Compliant System
IRQ 99  Exclusive  Microsoft ACPI-Compliant System
Memory 00000000-0FFFFFFF  Exclusive  Microsoft Basic Display Adapter
Memory 000A0000-000BFFFF  Shared  PCI Express Root Complex
Memory 00200000-0020FFFF  Exclusive  Intel(R) USB 3.20 eXtensible Host Controller - 1.20 (Microsoft)
Memory 18000000-18FFFFFF  Exclusive  Microsoft Basic Display Adapter
Memory 71EA6000-71EA6FFF  Exclusive  UCM-UCSI ACPI Device
Memory 90000000-90003FFF  Exclusive  Standard NVM Express Controller
Memory 90000000-900FFFFF  Exclusive  PCI Express Root Port
Memory 90000000-B7FFFFFF  Shared  PCI Express Root Complex
Memory B8000000-BDFFFFFF  Shared  PCI Express Root Complex
Memory BDFE0000-BDFFFFFF  Exclusive  Intel(R) Ethernet Connection (19) I219-LM
Memory BFFF0000-BFFFFFFF  Exclusive  Intel(R) USB 3.20 eXtensible Host Controller - 1.20 (Microsoft)
Memory DFDFC000-DFDFFFFF  Exclusive  High Definition Audio Controller
Memory DFE00000-DFFFFFFF  Exclusive  High Definition Audio Controller
Memory FED40000-FED44FFF  Exclusive  Trusted Platform Module 2.0
Port 0000-0CF7  Shared  PCI Express Root Complex
Port 0062-0062  Exclusive  Microsoft ACPI-Compliant Embedded Controller
Port 0066-0066  Exclusive  Microsoft ACPI-Compliant Embedded Controller
Port 2000-8BFF  Shared  PCI Express Root Complex
Port 9000-FFFF  Shared  PCI Express Root Complex


Input
 
[ HID Keyboard Device ]
 
Keyboard Properties:
Keyboard Name  HID Keyboard Device
Keyboard Type  IBM enhanced (101- or 102-key) keyboard
Keyboard Layout  US
ANSI Code Page  1252 - Western European (Windows)
OEM Code Page  437
Repeat Delay  1
Repeat Rate  31
 
[ HID-compliant mouse ]
 
Mouse Properties:
Mouse Name  HID-compliant mouse
Mouse Buttons  8
Mouse Hand  Right
Pointer Speed  1
Double-Click Time  500 msec
X/Y Threshold  6 / 10
Wheel Scroll Lines  3
 
Mouse Features:
Active Window Tracking  Disabled
ClickLock  Disabled
Hide Pointer While Typing  Enabled
Mouse Wheel  Present
Move Pointer To Default Button  Disabled
Pointer Trails  Disabled
Sonar  Disabled


Printers
 
[ Microsoft Print to PDF (Default) ]
 
Printer Properties:
Printer Name  Microsoft Print to PDF
Default Printer  Yes
Share Point  Not shared
Printer Port  PORTPROMPT:
Printer Driver  Microsoft Print To PDF (v6.03)
Device Name  Microsoft Print to PDF
Print Processor  winprint
Separator Page  None
Availability  Always
Priority  1
Print Jobs Queued  0
Status  Unknown
 
Paper Properties:
Paper Size  Letter, 8.5 x 11 in
Orientation  Portrait
Print Quality  600 x 600 dpi Color


Auto Start
 
Application Description  Start From  Application Command
OneDrive  Registry\User\Run  C:\Users\Marius\AppData\Local\Microsoft\OneDrive\OneDrive.exe /background
SecurityHealth  Registry\Common\Run  C:\WINDOWS\system32\SecurityHealthSystray.exe


Scheduled
 
[ MicrosoftEdgeUpdateTaskMachineCore{C1A799C1-46AA-424B-BB9F-63C112314144} ]
 
Task Properties:
Task Name  MicrosoftEdgeUpdateTaskMachineCore{C1A799C1-46AA-424B-BB9F-63C112314144}
Status  Running
Application Name  C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
Application Parameters  /c
Working Folder  
Comment  Keeps your Microsoft software up to date. If this task is disabled or stopped, your Microsoft software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This task uninstalls itself when there is no Microsoft software using it.
Account Name  SYSTEM
Creator  
Last Run  7/13/2026 5:29:09 PM
Next Run  7/13/2026 5:47:48 PM
 
Task Triggers:
At log on  At log on of any user
Daily  At 5:47:48 PM every day
 
[ MicrosoftEdgeUpdateTaskMachineUA{808D488F-360B-4F62-8BE8-4323CD88D884} ]
 
Task Properties:
Task Name  MicrosoftEdgeUpdateTaskMachineUA{808D488F-360B-4F62-8BE8-4323CD88D884}
Status  Enabled
Application Name  C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
Application Parameters  /ua /installsource scheduler
Working Folder  
Comment  Keeps your Microsoft software up to date. If this task is disabled or stopped, your Microsoft software will not be kept up to date, meaning security vulnerabilities that may arise cannot be fixed and features may not work. This task uninstalls itself when there is no Microsoft software using it.
Account Name  SYSTEM
Creator  
Last Run  7/13/2026 5:17:48 PM
Next Run  7/13/2026 6:17:48 PM
 
Task Triggers:
Daily  At 5:17:48 PM every day - After triggered, repeat every 1 hour for a duration of 1 day
 
[ OneDrive Reporting Task-S-1-5-21-3469770775-847581034-1203560767-1001 ]
 
Task Properties:
Task Name  OneDrive Reporting Task-S-1-5-21-3469770775-847581034-1203560767-1001
Status  Enabled
Application Name  %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Application Parameters  /reporting
Working Folder  
Comment  
Account Name  Marius
Creator  Microsoft Corporation
Last Run  11/30/1999
Next Run  7/13/2026 6:18:32 PM
 
Task Triggers:
One time  At 6:18:32 PM on 7/12/2026 - After triggered, repeat every 1 day indefinitely
 
[ OneDrive Standalone Update Task-S-1-5-21-3469770775-847581034-1203560767-1001 ]
 
Task Properties:
Task Name  OneDrive Standalone Update Task-S-1-5-21-3469770775-847581034-1203560767-1001
Status  Enabled
Application Name  %localappdata%\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe
Application Parameters  
Working Folder  
Comment  
Account Name  Marius
Creator  Microsoft Corporation
Last Run  11/30/1999
Next Run  7/14/2026 8:29:52 PM
 
Task Triggers:
One time  At 5:00:00 PM on 5/1/1992 - After triggered, repeat every 1 day indefinitely
 
[ OneDrive Startup Task-S-1-5-21-3469770775-847581034-1203560767-1001 ]
 
Task Properties:
Task Name  OneDrive Startup Task-S-1-5-21-3469770775-847581034-1203560767-1001
Status  Enabled
Application Name  C:\Users\Marius\AppData\Local\Microsoft\OneDrive\25.087.0506.0001\OneDriveLauncher.exe
Application Parameters  /startInstances
Working Folder  
Comment  
Account Name  Marius
Creator  Microsoft Corporation
Last Run  11/30/1999
Next Run  Unknown
 
Task Triggers:
At log on  At log on of DESKTOP-M1V6K8T\Marius


Installed Programs
 
Program  Version  Inst. Size  GUID  Publisher  Inst. Date
AIDA64 Extreme v8.00  8.00  Unknown  AIDA64 Extreme_is1  FinalWire Ltd.  2026-07-13
Microsoft Edge Update  1.3.223.11  Unknown  Microsoft Edge Update    
Microsoft Edge WebView2 Runtime  145.0.3800.97  Unknown  Microsoft EdgeWebView    
Microsoft Edge  145.0.3800.97  Unknown  Microsoft Edge  Microsoft Corporation  2026-07-13
Microsoft OneDrive  25.087.0506.0001  Unknown  OneDriveSetup.exe  Microsoft Corporation  


Licenses
 
Software  Product Key
Microsoft Internet Explorer 11.1882.26100.0  2BG4Q-PNMMK-WBTRD-G9VTQ-T6PR8
Microsoft Windows 11 Home  2BG4Q-PNMMK-WBTRD-G9VTQ-T6PR8


File Types
 
Extension  File Type Description  Content Type
386  Virtual device driver  
3G2  3G2 File  video/3gpp2
3GP  3GP File  video/3gpp
3GP2  3GP2 File  video/3gpp2
3GPP  3GPP File  video/3gpp
7Z  Compressed Archive Folder  application/x-compressed
AAC  AAC File  audio/vnd.dlna.adts
ACCOUNTPICTURE-MS  Account Picture  application/windows-accountpicture
ADT  ADT File  audio/vnd.dlna.adts
ADTS  ADTS File  audio/vnd.dlna.adts
AIF  AIFF Format Sound  audio/aiff
AIFC  AIFF Format Sound  audio/aiff
AIFF  WMP11.AssocFile.AIFF  audio/aiff
ANI  Animated Cursor  
APPCONTENT-MS  Application Content  application/windows-appcontent+xml
APPLICATION  Application Manifest  application/x-ms-application
APPREF-MS  Application Reference  
ASA  ASA File  
ASF  ASF File  video/x-ms-asf
ASP  ASP File  
ASX  Windows Media Audio/Video playlist  video/x-ms-asf
AU  AU Format Sound  audio/basic
AVI  AVI File  video/avi
BAT  Windows Batch File  
BLG  Performance Monitor File  
BMP  BMP File  image/bmp
BZ2  Compressed Archive Folder  application/x-compressed
CAB  Cabinet File  
CAMP  WCS Viewing Condition Profile  
CAT  Security Catalog  application/vnd.ms-pki.seccat
CDA  WMP11.AssocFile.CDA  
CDMP  WCS Device Profile  
CDX  CDX File  
CDXML  Windows PowerShell Cmdlet Definition XML Document  
CER  Security Certificate  application/x-x509-ca-cert
CHK  Recovered File Fragments  
CHM  Compiled HTML Help file  
CMD  Windows Command Script  
COM  MS-DOS Application  
COMPOSITEFONT  Composite Font File  
CPIO  Compressed Archive Folder  application/x-compressed
CPL  Control panel item  
CRL  Certificate Revocation List  application/pkix-crl
CRT  Security Certificate  application/x-x509-ca-cert
CSS  Cascading Style Sheet Document  text/css
CUR  Cursor  
DB  Data Base File  
DCTX  Open Extended Dictionary  
DCTXC  Open Extended Dictionary  
DDS  DDS Image  image/vnd.ms-dds
DER  Security Certificate  application/x-x509-ca-cert
DESKLINK  Desktop Shortcut  
DESKTHEMEPACK  Windows Desktop Theme Pack File  
DIAGCAB  Troubleshooting Pack Cabinet  
DIAGCFG  Troubleshooting Pack Configuration  
DIAGPKG  Troubleshooting Pack  
DLL  Application extension  application/x-msdownload
DRV  Device driver  
DSN  Data Source Name  
EML  Microsoft Email Message  
EVT  Classic Event Log  
EVTX  Event Log  
EXE  Application  application/x-msdownload
FLAC  FLAC File  audio/x-flac
FON  Font file  
GIF  GIF File  image/gif
GMMP  WCS Gamut Mapping Profile  
GRP  Microsoft Program Group  
GZ  Compressed Archive Folder  application/x-gzip
HLP  Help file  
HTA  HTML Application  application/hta
HTM  Microsoft Edge HTML Document  text/html
HTML  Microsoft Edge HTML Document  text/html
ICC  ICC Profile  
ICL  Icon library  
ICM  ICC Profile  
ICO  ICO File  image/x-icon
IMESX  IME Search provider definition  
IMG  Disc Image File  
ISO  Disc Image File  
JFIF  JFIF File  image/jpeg
JOB  Task Scheduler Task Object  
JOD  Microsoft.Jet.OLEDB.4.0  
JPE  JPE File  image/jpeg
JPEG  JPEG File  image/jpeg
JPG  JPG File  image/jpeg
JS  JavaScript File  
JSE  JScript Encoded Script File  
JXR  JXR File  image/vnd.ms-photo
LABEL  Property List  
LIBRARY-MS  Library  application/windows-library+xml
LNK  Shortcut  
M1V  M1V File  video/mpeg
M2T  M2T File  video/vnd.dlna.mpeg-tts
M2TS  M2TS File  video/vnd.dlna.mpeg-tts
M2V  M2V File  video/mpeg
M3U  M3U File  audio/x-mpegurl
M4A  M4A File  audio/mp4
M4V  M4V File  video/mp4
MAPIMAIL  Mail Service  
MHT  Microsoft Edge MHT Document  message/rfc822
MHTML  Microsoft Edge MHT Document  message/rfc822
MID  MIDI Sequence  audio/mid
MIDI  MIDI Sequence  audio/mid
MK3D  WMP11.AssocFile.MK3D  
MKA  MKA File  audio/x-matroska
MKV  MKV File  video/x-matroska
MLC  Language Pack File  
MOD  MOD File  video/mpeg
MOV  MOV File  video/quicktime
MP2  MP3 Format Sound  audio/mpeg
MP2V  MP2V File  video/mpeg
MP3  MP3 File  audio/mpeg
MP4  MP4 File  video/mp4
MP4V  MP4V File  video/mp4
MPA  MPA File  audio/mpeg
MPE  MPE File  video/mpeg
MPEG  MPEG File  video/mpeg
MPG  MPG File  video/mpeg
MPV2  MPV2 File  video/mpeg
MSC  Microsoft Common Console Document  
MSI  Windows Installer Package  
MSP  Windows Installer Patch  
MSRCINCIDENT  Windows Remote Assistance Invitation  
MSSTYLES  Windows Visual Style File  
MSU  Microsoft Update Standalone Package  
MS-WINDOWS-STORE-LICENSE  Microsoft Store License  
MTREE  Compressed Archive Folder  application/x-compressed
MTS  MTS File  video/vnd.dlna.mpeg-tts
MYDOCS  MyDocs Drop Target  
NFO  System Information File  
NUPKG  Compressed Archive Folder  application/x-compressed
OCX  ActiveX control  
OSDX  Search connector description  application/opensearchdescription+xml
OTF  OpenType font file  
P10  Certificate Request  application/pkcs10
P12  Personal Information Exchange  application/x-pkcs12
P7B  PKCS #7 Certificates  application/x-pkcs7-certificates
P7C  Certificate file  application/pkcs7-mime
P7M  PKCS #7 MIME Message  application/pkcs7-mime
P7R  Certificate Request Response  application/x-pkcs7-certreqresp
P7S  PKCS #7 Signature  application/pkcs7-signature
PARTIAL  Partial Download  
PBK  Dial-Up Phonebook  
PERFMONCFG  Performance Monitor Configuration  
PFM  Type 1 Font file  
PFX  Personal Information Exchange  application/x-pkcs12
PIF  Shortcut to MS-DOS Program  
PKO  Public Key Security Object  application/vnd.ms-pki.pko
PNF  Precompiled Setup Information  
PNG  PNG File  image/png
PPKG  RunTime Provisioning Tool  
PRF  PICS Rules File  application/pics-rules
PS1XML  Windows PowerShell XML Document  
PSC1  Windows PowerShell Console File  application/PowerShell
PSSC  Windows PowerShell Session Configuration File  
QDS  Directory Query  
RAR  Compressed Archive Folder  application/x-compressed
RAT  Rating System File  application/rat-file
RDP  Remote Desktop Connection  
REG  Registration Entries  
RESMONCFG  Resource Monitor Configuration  
RLL  Application extension  
RMI  MIDI Sequence  audio/mid
SCF  File Explorer Command  
SCR  Screen saver  
SCT  Windows Script Component  text/scriptlet
SEARCHCONNECTOR-MS  Search Connector  application/windows-search-connector+xml
SEARCH-MS  Saved Search  
SETTINGCONTENT-MS  Setting Content  
SFCACHE  ReadyBoost Cache File  
SND  AU Format Sound  audio/basic
SPC  PKCS #7 Certificates  application/x-pkcs7-certificates
SST  Microsoft Serialized Certificate Store  application/vnd.ms-pki.certstore
SVG  Microsoft Edge HTML Document  image/svg+xml
SYMLINK  .symlink  
SYS  System file  
TAR  Compressed Archive Folder  application/x-tar
TBZ2  Compressed Archive Folder  application/x-compressed
TGZ  Compressed Archive Folder  application/x-compressed
THEME  Windows Theme File  
THEMEPACK  Windows Theme Pack File  
TIF  TIF File  image/tiff
TIFF  TIFF File  image/tiff
TS  TS File  video/vnd.dlna.mpeg-tts
TTC  TrueType collection font file  
TTF  TrueType font file  
TTS  TTS File  video/vnd.dlna.mpeg-tts
TXT  Text Document  text/plain
TXZ  Compressed Archive Folder  application/x-compressed
TZST  Compressed Archive Folder  application/x-compressed
UDL  Microsoft Data Link  
URL  Internet Shortcut  
UU  Compressed Archive Folder  application/x-compressed
VBE  VBScript Encoded Script File  
VBS  VBScript Script File  
VHD  Hard Disk Image File  
VHDPMEM  Hard Disk Image File  
VHDX  Hard Disk Image File  
VXD  Virtual device driver  
WAB  WAB file  
WAV  WAV File  audio/wav
WAX  Windows Media Audio shortcut  audio/x-ms-wax
WBCAT  Windows Backup Catalog File  
WCX  RemoteApp and Desktop Connections Configuration File  
WDP  WDP File  image/vnd.ms-photo
WEBPNP  Web Point And Print File  
WEBSITE  Pinned Site Shortcut  application/x-mswebsite
WM  WM File  video/x-ms-wm
WMA  WMA File  audio/x-ms-wma
WMD  Windows Media Player Download Package  application/x-ms-wmd
WMDB  Windows Media Library  
WMS  Windows Media Player Skin File  
WMV  WMV File  video/x-ms-wmv
WMX  Windows Media Audio/Video playlist  video/x-ms-wmx
WMZ  Windows Media Player Skin Package  application/x-ms-wmz
WPL  WPL File  application/vnd.ms-wpl
WSC  Windows Script Component  text/scriptlet
WSF  Windows Script File  
WSH  Windows Script Host Settings File  
WVX  Windows Media Audio/Video playlist  video/x-ms-wvx
XAML  Windows Markup File  application/xaml+xml
XAR  Compressed Archive Folder  application/x-compressed
XBAP  XAML Browser Application  application/x-ms-xbap
XHT  Microsoft Edge HTML Document  application/xhtml+xml
XHTML  Microsoft Edge HTML Document  application/xhtml+xml
XRM-MS  XrML Digital License  text/xml
XSL  XSL Stylesheet  text/xml
XZ  Compressed Archive Folder  application/x-compressed
ZFSENDTOTARGET  Compressed (zipped) Folder SendTo Target  
ZIP  Compressed (zipped) Folder  application/x-zip-compressed
ZST  Compressed Archive Folder  application/x-compressed


Windows Security
 
Operating System Properties:
OS Name  Microsoft Windows 11 Home
OS Service Pack  -
Winlogon Shell  explorer.exe
User Account Control (UAC)  Enabled
UAC Remote Restrictions  Enabled
System Restore  Enabled
Windows Update Agent  1451.2601.23012.0
 
Data Execution Prevention (DEP, NX, EDB):
Supported by Operating System  Yes
Supported by CPU  Yes
Active (To Protect Applications)  Yes
Active (To Protect Drivers)  Yes


Windows Update
 
Update Description  Update Type  Inst. Date
(Automatic Update)  Unknown  


Anti-Virus
 
Software Description  Software Version  Virus Database Date  Known Viruses
Windows Defender  4.18.25080.5  9/16/2025  ?


Firewall
 
Software Description  Software Version  Status
Windows Firewall  10.0.26100.7309  Enabled


Anti-Spyware
 
Software Description  Software Version
Microsoft Windows Defender  4.18.25080.5


Regional
 
Time Zone:
Current Time Zone  Pacific Daylight Time
Current Time Zone Description  (UTC-08:00) Pacific Time (US & Canada)
Change To Standard Time  First Sunday of November 2:00:00 AM
Change To Daylight Saving Time  2nd Sunday of March 2:00:00 AM
 
Language:
Language Name (Native)  English
Language Name (English)  English
Language Name (ISO 639)  en
 
Country/Region:
Country Name (Native)  United States
Country Name (English)  United States
Country Name (ISO 3166)  US
Country Code  1
 
Currency:
Currency Name (Native)  US Dollar
Currency Name (English)  US Dollar
Currency Symbol (Native)  $
Currency Symbol (ISO 4217)  USD
Currency Format  $123,456,789.00
Negative Currency Format  ($123,456,789.00)
 
Formatting:
Time Format  h:mm:ss tt
Short Date Format  M/d/yyyy
Long Date Format  dddd, MMMM d, yyyy
Number Format  123,456,789.00
Negative Number Format  -123,456,789.00
List Format  first, second, third
Native Digits  0123456789
 
Days of Week:
Native Name for Monday  Monday / Mon
Native Name for Tuesday  Tuesday / Tue
Native Name for Wednesday  Wednesday / Wed
Native Name for Thursday  Thursday / Thu
Native Name for Friday  Friday / Fri
Native Name for Saturday  Saturday / Sat
Native Name for Sunday  Sunday / Sun
 
Months:
Native Name for January  January / Jan
Native Name for February  February / Feb
Native Name for March  March / Mar
Native Name for April  April / Apr
Native Name for May  May / May
Native Name for June  June / Jun
Native Name for July  July / Jul
Native Name for August  August / Aug
Native Name for September  September / Sep
Native Name for October  October / Oct
Native Name for November  November / Nov
Native Name for December  December / Dec
 
Miscellaneous:
Calendar Type  Gregorian (localized)
Default Paper Size  US Letter
Measurement System  U.S.
 
Display Languages:
LCID 0409h (Active)  English (United States)


Environment
 
Variable  Value
ALLUSERSPROFILE  C:\ProgramData
APPDATA  C:\Users\Marius\AppData\Roaming
CommonProgramFiles(x86)  C:\Program Files (x86)\Common Files
CommonProgramFiles  C:\Program Files\Common Files
CommonProgramW6432  C:\Program Files\Common Files
COMPUTERNAME  DESKTOP-M1V6K8T
ComSpec  C:\WINDOWS\system32\cmd.exe
DriverData  C:\Windows\System32\Drivers\DriverData
FPS_BROWSER_APP_PROFILE_STRING  Internet Explorer
FPS_BROWSER_USER_PROFILE_STRING  Default
HOMEDRIVE  C:
HOMEPATH  \Users\Marius
LOCALAPPDATA  C:\Users\Marius\AppData\Local
LOGONSERVER  \\DESKTOP-M1V6K8T
NUMBER_OF_PROCESSORS  10
OneDrive  C:\Users\Marius\OneDrive
OS  Windows_NT
Path  C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;C:\WINDOWS\System32\OpenSSH\;C:\Users\Marius\AppData\Local\Microsoft\WindowsApps
PATHEXT  .COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
PROCESSOR_ARCHITECTURE  AMD64
PROCESSOR_IDENTIFIER  Intel64 Family 6 Model 198 Stepping 2, GenuineIntel
PROCESSOR_LEVEL  6
PROCESSOR_REVISION  c602
ProgramData  C:\ProgramData
ProgramFiles(x86)  C:\Program Files (x86)
ProgramFiles  C:\Program Files
ProgramW6432  C:\Program Files
PSModulePath  C:\Program Files\WindowsPowerShell\Modules;C:\WINDOWS\system32\WindowsPowerShell\v1.0\Modules
PUBLIC  C:\Users\Public
SystemDrive  C:
SystemRoot  C:\WINDOWS
TEMP  C:\Users\Marius\AppData\Local\Temp
TMP  C:\Users\Marius\AppData\Local\Temp
USERDOMAIN_ROAMINGPROFILE  DESKTOP-M1V6K8T
USERDOMAIN  DESKTOP-M1V6K8T
USERNAME  Marius
USERPROFILE  C:\Users\Marius
windir  C:\WINDOWS


Control Panel
 
Name  Comment
AutoPlay  Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software...
Backup and Restore (Windows 7)  Recover copies of your files backed up in Windows 7
Color Management  Change advanced color management settings for displays, scanners, and printers.
Credential Manager  Manage your Windows credentials.
Date and Time  Set the date, time, and time zone for your computer.
Default Programs  Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing ...
Device Manager  View and update your device hardware settings and driver software.
Devices and Printers  View and manage devices, printers, and print jobs
Ease of Access Center  Make your computer easier to use.
File Explorer Options  Customize the display of files and folders.
File History  Keep a history of your files
Fonts  Add, change, and manage fonts on your computer.
Indexing Options  Change how Windows indexes to search faster
Internet Options  Configure your Internet display and connection settings.
Keyboard  Customize your keyboard settings, such as the cursor blink rate and the character repeat rate.
Mouse  Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed.
Network and Sharing Center  Check network status, change network settings and set preferences for sharing files and printers.
Phone and Modem  Configure your telephone dialing rules and modem settings.
Power Options  Conserve energy or maximize performance by choosing how your computer manages power.
Programs and Features  Uninstall or change programs on your computer.
Recovery  Recovery
Region  Customize settings for the display of languages, numbers, times, and dates.
RemoteApp and Desktop Connections  Manage your RemoteApp and Desktop Connections
Security and Maintenance  Review recent messages and resolve problems with your computer.
Sound  Configure your audio devices or change the sound scheme for your computer.
Storage Spaces  Help protect your files from drive failure.
Sync Center  Sync files between your computer and network folders
System  View information about your computer, and change settings for hardware, performance, and remote connections.
Taskbar and Navigation  Customize the taskbar, such as the types of items to be displayed and how they should appear.
Troubleshooting  Troubleshoot and fix common computer problems.
User Accounts  Change user account settings and passwords for people who share this computer.
Windows Defender Firewall  Set firewall security options to help protect your computer from hackers and malicious software.
Windows Tools  Configure administrative settings for your computer.
Work Folders  Access your work files anywhere, anytime.


Recycle Bin
 
Drive  Items Size  Items Count  Space %  Recycle Bin
C:  0  0  ?  ?


System Files
 
[ system.ini ]
 
; for 16-bit app support
[386Enh]
woafont=dosapp.fon
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON
[drivers]
wave=mmdrv.dll
timer=timer.drv
[mci]
 
[ win.ini ]
 
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
 
[ hosts ]
 
 
[ lmhosts.sam ]
 


System Folders
 
System Folder  Path
Administrative Tools  C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
AppData  C:\Users\Marius\AppData\Roaming
Cache  C:\Users\Marius\AppData\Local\Microsoft\Windows\INetCache
CD Burning  C:\Users\Marius\AppData\Local\Microsoft\Windows\Burn\Burn
Common Administrative Tools  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools
Common AppData  C:\ProgramData
Common Desktop  C:\Users\Public\Desktop
Common Documents  C:\Users\Public\Documents
Common Favorites  C:\Users\Marius\Favorites
Common Files (x86)  C:\Program Files (x86)\Common Files
Common Files  C:\Program Files\Common Files
Common Music  C:\Users\Public\Music
Common Pictures  C:\Users\Public\Pictures
Common Programs  C:\ProgramData\Microsoft\Windows\Start Menu\Programs
Common Start Menu  C:\ProgramData\Microsoft\Windows\Start Menu
Common Startup  C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup
Common Templates  C:\ProgramData\Microsoft\Windows\Templates
Common Video  C:\Users\Public\Videos
Cookies  C:\Users\Marius\AppData\Local\Microsoft\Windows\INetCookies
Desktop  C:\Users\Marius\Desktop
Device  C:\WINDOWS\inf
Favorites  C:\Users\Marius\Favorites
Fonts  C:\WINDOWS\Fonts
History  C:\Users\Marius\AppData\Local\Microsoft\Windows\History
Local AppData  C:\Users\Marius\AppData\Local
My Documents  C:\Users\Marius\Documents
My Music  C:\Users\Marius\Music
My Pictures  C:\Users\Marius\Pictures
My Video  C:\Users\Marius\Videos
NetHood  C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Network Shortcuts
PrintHood  C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Printer Shortcuts
Profile  C:\Users\Marius
Program Files (x86)  C:\Program Files (x86)
Program Files  C:\Program Files
Programs  C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs
Recent  C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Recent
Resources  C:\WINDOWS\resources
SendTo  C:\Users\Marius\AppData\Roaming\Microsoft\Windows\SendTo
Start Menu  C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu
Startup  C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
System (x86)  C:\WINDOWS\SysWOW64
System  C:\WINDOWS\system32
Temp  C:\Users\Marius\AppData\Local\Temp\
Templates  C:\Users\Marius\AppData\Roaming\Microsoft\Windows\Templates
Windows  C:\WINDOWS


Event Logs
 
Log Name  Event Type  Category  Generated On  User  Source  Description
Application  Error  None  2026-07-13 17:13:00  SYSTEM  CertEnroll  86: SCEP Certificate enrollment initialization for Local system via https://IFX-KeyId-6fc8a3609be1cef8b68480e1fb2dde5e9a961d9f.microsoftaik.azure.net/templates/Aik/scep failed: GetCACaps Method: GET(47ms) Stage: GetCACaps The server name or address could not be resolved 0x80072ee7 (WinHttp: 12007 ERROR_WINHTTP_NAME_NOT_RESOLVED)
Application  Error  None  2026-07-13 17:13:01  SYSTEM  CertEnroll  86: SCEP Certificate enrollment initialization for \MINWINPC$ via https://IFX-KeyId-6fc8a3609be1cef8b68480e1fb2dde5e9a961d9f.microsoftaik.azure.net/templates/Aik/scep failed: GetCACaps Method: GET(407ms) Stage: GetCACaps The server name or address could not be resolved 0x80072ee7 (WinHttp: 12007 ERROR_WINHTTP_NAME_NOT_RESOLVED)
Application  Warning  1  2026-07-13 17:13:57    Windows Search Service  1008: The Windows Search Service is starting up and attempting to remove the old search index {Reason: Full Index Reset}.
Application  Error  None  2026-07-13 17:14:00  SYSTEM  CertEnroll  86: SCEP Certificate enrollment initialization for Local system via https://IFX-KeyId-6fc8a3609be1cef8b68480e1fb2dde5e9a961d9f.microsoftaik.azure.net/templates/Aik/scep failed: GetCACaps Method: GET(16ms) Stage: GetCACaps The server name or address could not be resolved 0x80072ee7 (WinHttp: 12007 ERROR_WINHTTP_NAME_NOT_RESOLVED)
Application  Error  None  2026-07-13 17:14:00  SYSTEM  CertEnroll  86: SCEP Certificate enrollment initialization for WORKGROUP\WIN-SLRHEC6PMT7$ via https://IFX-KeyId-6fc8a3609be1cef8b68480e1fb2dde5e9a961d9f.microsoftaik.azure.net/templates/Aik/scep failed: GetCACaps Method: GET(359ms) Stage: GetCACaps The server name or address could not be resolved 0x80072ee7 (WinHttp: 12007 ERROR_WINHTTP_NAME_NOT_RESOLVED)
Application  Warning  None  2026-07-13 17:14:08  1332  Microsoft-Windows-AppModel-State  23: Data error (cyclic redundancy check).
Application  Warning  None  2026-07-13 17:14:08  1332  Microsoft-Windows-AppModel-State  24: The program issued a command but the command length is incorrect.
Application  Warning  None  2026-07-13 17:14:08  1332  Microsoft-Windows-AppModel-State  23: Data error (cyclic redundancy check).
Application  Warning  None  2026-07-13 17:14:08  1332  Microsoft-Windows-AppModel-State  23: Data error (cyclic redundancy check).
Application  Warning  None  2026-07-13 17:14:08  1332  Microsoft-Windows-AppModel-State  24: The program issued a command but the command length is incorrect.
Application  Warning  None  2026-07-13 17:14:08  1332  Microsoft-Windows-AppModel-State  24: The program issued a command but the command length is incorrect.
Application  Warning  None  2026-07-13 17:14:26  1332  Microsoft-Windows-AppModel-State  23: Data error (cyclic redundancy check).
Application  Warning  None  2026-07-13 17:14:26  1332  Microsoft-Windows-AppModel-State  24: The program issued a command but the command length is incorrect.
Application  Error  None  2026-07-13 17:15:59    SecurityCenter  16: Error while updating Windows Defender status to SECURITY_PRODUCT_STATE_ON.
Application  Warning  None  2026-07-13 17:16:17  Marius  Microsoft-Windows-AppModel-State  23: Data error (cyclic redundancy check).
Application  Warning  None  2026-07-13 17:16:17  Marius  Microsoft-Windows-AppModel-State  24: The program issued a command but the command length is incorrect.
Application  Warning  None  2026-07-13 17:16:18  Marius  Microsoft-Windows-AppModel-State  23: Data error (cyclic redundancy check).
Application  Warning  None  2026-07-13 17:16:18  Marius  Microsoft-Windows-AppModel-State  24: The program issued a command but the command length is incorrect.
Application  Warning  None  2026-07-13 17:16:18  Marius  Microsoft-Windows-AppModel-State  23: Data error (cyclic redundancy check).
Application  Warning  None  2026-07-13 17:16:18  Marius  Microsoft-Windows-AppModel-State  23: Data error (cyclic redundancy check).
Application  Warning  None  2026-07-13 17:16:18  Marius  Microsoft-Windows-AppModel-State  24: The program issued a command but the command length is incorrect.
Application  Warning  None  2026-07-13 17:16:18  Marius  Microsoft-Windows-AppModel-State  23: Data error (cyclic redundancy check).
Application  Warning  None  2026-07-13 17:16:18  Marius  Microsoft-Windows-AppModel-State  24: The program issued a command but the command length is incorrect.
Application  Warning  None  2026-07-13 17:16:18  Marius  Microsoft-Windows-AppModel-State  24: The program issued a command but the command length is incorrect.
Application  Error  None  2026-07-13 17:16:23    Software Protection Platform Service  8200: License acquisition failure details. hr=0x80072EE7
Application  Error  None  2026-07-13 17:16:23    Software Protection Platform Service  1014: Acquisition of End User License failed. hr=0x80072EE7 Sku Id=1d873132-f09f-4eb2-bf5a-2e4fb48935e8
Application  Error  None  2026-07-13 17:16:23    Software Protection Platform Service  8198: License Activation (slui.exe) failed with the following error code: hr=0x80072EE7 Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=1d873132-f09f-4eb2-bf5a-2e4fb48935e8;NotificationInterval=1440;Trigger=UserLogon;SessionId=2
Application  Error  None  2026-07-13 17:29:11    Software Protection Platform Service  8200: License acquisition failure details. hr=0x80072EE7
Application  Error  None  2026-07-13 17:29:11    Software Protection Platform Service  1014: Acquisition of End User License failed. hr=0x80072EE7 Sku Id=1d873132-f09f-4eb2-bf5a-2e4fb48935e8
Application  Error  None  2026-07-13 17:29:11    Software Protection Platform Service  8198: License Activation (slui.exe) failed with the following error code: hr=0x80072EE7 Command-line arguments: RuleId=31e71c49-8da7-4a2f-ad92-45d98a1c79ba;Action=AutoActivate;AppId=55c92734-d682-4d71-983e-d6ec3f16059f;SkuId=1d873132-f09f-4eb2-bf5a-2e4fb48935e8;NotificationInterval=1440;Trigger=UserLogon;SessionId=1
Application  Error  None  2026-07-13 17:29:19  SYSTEM  CertEnroll  86: SCEP Certificate enrollment initialization for Local system via https://IFX-KeyId-6fc8a3609be1cef8b68480e1fb2dde5e9a961d9f.microsoftaik.azure.net/templates/Aik/scep failed: GetCACaps Method: GET(0ms) Stage: GetCACaps The server name or address could not be resolved 0x80072ee7 (WinHttp: 12007 ERROR_WINHTTP_NAME_NOT_RESOLVED)
Application  Error  None  2026-07-13 17:29:19  SYSTEM  CertEnroll  86: SCEP Certificate enrollment initialization for WORKGROUP\DESKTOP-M1V6K8T$ via https://IFX-KeyId-6fc8a3609be1cef8b68480e1fb2dde5e9a961d9f.microsoftaik.azure.net/templates/Aik/scep failed: GetCACaps Method: GET(594ms) Stage: GetCACaps The server name or address could not be resolved 0x80072ee7 (WinHttp: 12007 ERROR_WINHTTP_NAME_NOT_RESOLVED)
Application  Warning  None  2026-07-13 17:29:25  Marius  Microsoft-Windows-AppModel-State  23: Data error (cyclic redundancy check).
Application  Warning  None  2026-07-13 17:29:25  Marius  Microsoft-Windows-AppModel-State  24: The program issued a command but the command length is incorrect.
Security  Audit Success  13312  2026-07-13 17:12:21    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0xc8 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:12:21    Microsoft-Windows-Security-Auditing  4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0xc8 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
Security  Audit Success  13312  2026-07-13 17:12:21    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x27c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:12:21    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x290 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x27c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13573  2026-07-13 17:12:21    Microsoft-Windows-Security-Auditing  4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
Security  Audit Success  13312  2026-07-13 17:12:22    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x30c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x27c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  12288  2026-07-13 17:12:23    Microsoft-Windows-Security-Auditing  4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
Security  Audit Success  12290  2026-07-13 17:12:23    Microsoft-Windows-Security-Auditing  6417: The FIPS mode crypto selftests succeeded. Process ID: 0x2dc Process Name: C:\Windows\System32\lsass.exe
Security  Audit Success  12544  2026-07-13 17:12:23    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  13312  2026-07-13 17:12:23    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x374 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x324 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:12:23    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x380 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x36c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:12:23    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3d8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x36c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:12:23    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2d8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x374 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:12:23    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2dc New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x374 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:12:23    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x324 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x27c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:12:23    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x32c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x324 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:12:23    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x36c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x27c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x374 Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0x598eb Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x374 Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x3d8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0x598e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3d8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x3d8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x62966 Linked Logon ID: 0x6298c Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3d8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x6298c Linked Logon ID: 0x62966 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3d8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x62966 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0x6298c Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
Security  Audit Success  12548  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13568  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0x5911a
Security  Audit Success  13569  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-80-3169285310-278349998-1452333686-3865143136-4212226833 Access Granted: Access Right: SeServiceLogonRight
Security  Audit Success  13824  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4720: A user account was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: WDAGUtilityAccount Account Domain: MINWINPC Attributes: SAM Account Name: WDAGUtilityAccount Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 Allowed To Delegate To: - Old UAC Value: 0x0 New UAC Value: 0x15 User Account Control: %%2080 %%2082 %%2084 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges -
Security  Audit Success  13824  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: WDAGUtilityAccount Account Domain: MINWINPC Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: 0x15 New UAC Value: 0x11 User Account Control: %%2050 User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: WDAGUtilityAccount Account Domain: MINWINPC Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: - New UAC Value: - User Account Control: - User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: WDAGUtilityAccount Account Domain: MINWINPC Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: - New UAC Value: - User Account Control: - User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-558 Group Name: Performance Monitor Users Group Domain: Builtin Attributes: SAM Account Name: Performance Monitor Users SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-558 Group Name: Performance Monitor Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-559 Group Name: Performance Log Users Group Domain: Builtin Attributes: SAM Account Name: Performance Log Users SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-559 Group Name: Performance Log Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-562 Group Name: Distributed COM Users Group Domain: Builtin Attributes: SAM Account Name: Distributed COM Users SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-562 Group Name: Distributed COM Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Attributes: SAM Account Name: IIS_IUSRS SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Member: Security ID: S-1-5-17 Account Name: - Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-573 Group Name: Event Log Readers Group Domain: Builtin Attributes: SAM Account Name: Event Log Readers SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-573 Group Name: Event Log Readers Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-580 Group Name: Remote Management Users Group Domain: Builtin Attributes: SAM Account Name: Remote Management Users SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-580 Group Name: Remote Management Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4728: A member was added to a security-enabled global group. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Member: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: - Group: Security ID: S-1-5-21-3469770775-847581034-1203560767-513 Group Name: None Group Domain: MINWINPC Additional Information: Privileges: - Expiration time: (null)
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-585 Group Name: OpenSSH Users Group Domain: Builtin Attributes: SAM Account Name: OpenSSH Users SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-585 Group Name: OpenSSH Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4731: A security-enabled local group was created. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 New Group: Security ID: S-1-5-32-578 Group Name: Hyper-V Administrators Group Domain: Builtin Attributes: SAM Account Name: Hyper-V Administrators SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:24    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-578 Group Name: Hyper-V Administrators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  12544  2026-07-13 17:12:29    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:12:29    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:12:30    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:12:30    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:12:33    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:12:33    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12292  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  5033: The Windows Firewall Driver started successfully.
Security  Audit Success  12292  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  5024: The Windows Firewall service started successfully.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-546 Access Removed: Access Right: SeInteractiveLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-581 Access Removed: Access Right: SeInteractiveLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-581 Access Removed: Access Right: SeNetworkLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-583 Access Removed: Access Right: SeInteractiveLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-583 Access Removed: Access Right: SeNetworkLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-80-3169285310-278349998-1452333686-3865143136-4212226833 Access Removed: Access Right: SeServiceLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-544 Access Granted: Access Right: SeRemoteInteractiveLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-551 Access Granted: Access Right: SeNetworkLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-551 Access Granted: Access Right: SeBatchLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-559 Access Granted: Access Right: SeBatchLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-1-0 Access Removed: Access Right: SeInteractiveLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-1-0 Access Removed: Access Right: SeRemoteInteractiveLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-21-3469770775-847581034-1203560767-501 Access Granted: Access Right: SeInteractiveLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-21-3469770775-847581034-1203560767-501 Access Granted: Access Right: SeDenyInteractiveLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-21-3469770775-847581034-1203560767-501 Access Granted: Access Right: SeDenyNetworkLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4718: System security access was removed from an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-90-0 Access Removed: Access Right: SeInteractiveLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-32-555 Access Granted: Access Right: SeRemoteInteractiveLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4717: System security access was granted to an account. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Account Modified: Account Name: S-1-5-80-0 Access Granted: Access Right: SeServiceLogonRight
Security  Audit Success  13569  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4739: Domain Policy was changed. Change Type: Password Policy modified Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Domain: Domain Name: MINWINPC Domain ID: S-1-5-21-3469770775-847581034-1203560767 Changed Attributes: Min. Password Age: unavailable Max. Password Age: 42:00:00:00 Force Logoff: - Lockout Threshold: - Lockout Observation Window: - Lockout Duration: - Password Properties: 8 Min. Password Length: 0 Password History Length: 0 Machine Account Quota: - Mixed Domain Mode: - Domain Behavior Version: - OEM Information: - Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4725: A user account was disabled. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: MINWINPC
Security  Audit Success  13824  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: MINWINPC Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: 0x210 New UAC Value: 0x211 User Account Control: %%2080 User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4725: A user account was disabled. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-501 Account Name: Guest Account Domain: MINWINPC
Security  Audit Success  13824  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-501 Account Name: Guest Account Domain: MINWINPC Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: 0x214 New UAC Value: 0x215 User Account Control: %%2080 User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe
Security  Audit Success  13826  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Member: Security ID: S-1-5-4 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
Security  Audit Success  13826  2026-07-13 17:12:35    Microsoft-Windows-Security-Auditing  4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Member: Security ID: S-1-5-11 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
Security  Audit Success  12544  2026-07-13 17:12:48    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:12:48    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13826  2026-07-13 17:12:48    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x15f0 Process Name: C:\Program Files (x86)\Microsoft\Edge\Application\145.0.3800.97\Installer\setup.exe
Security  Audit Success  12544  2026-07-13 17:12:49    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:49    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:12:49    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:12:49    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:49    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:12:49    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:13:00    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:13:00    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:13:19    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:13:19    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:13:23    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:23    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:23    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:13:23    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:23    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:23    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:13:23    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: MINWINPC Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: 0x211 New UAC Value: 0x211 User Account Control: - User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
Security  Audit Success  12544  2026-07-13 17:13:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:24    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:13:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:24    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:13:25    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:25    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:25    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:25    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:25    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:13:25    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:25    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:25    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:25    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:25    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:13:26    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:13:26    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:13:27    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: MINWINPC$ Account Domain: Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x2d8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:13:27    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  103  2026-07-13 17:13:30    Microsoft-Windows-Eventlog  1100: The event logging service has shut down.
Security  Audit Success  13312  2026-07-13 17:13:49    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0xc8 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:13:49    Microsoft-Windows-Security-Auditing  4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0xc8 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
Security  Audit Success  13312  2026-07-13 17:13:49    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x27c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:13:49    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x290 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x27c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:13:49    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2f8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x27c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13573  2026-07-13 17:13:49    Microsoft-Windows-Security-Auditing  4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
Security  Audit Success  12288  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
Security  Audit Success  12290  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  6417: The FIPS mode crypto selftests succeeded. Process ID: 0x270 Process Name: C:\Windows\System32\lsass.exe
Security  Audit Success  12544  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x380 Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0x9d66 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x380 Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x3c8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0x9d67 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3c8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13312  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x324 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2f8 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x378 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x27c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x380 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2f8 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x388 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x378 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3c8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x378 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x29c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x380 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x270 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x380 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13568  2026-07-13 17:13:50    Microsoft-Windows-Security-Auditing  4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0x99a3
Security  Audit Success  12544  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x3c8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0xf83d Linked Logon ID: 0xf871 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3c8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0xf871 Linked Logon ID: 0xf83d Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3c8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0xf83d Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0xf871 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
Security  Audit Success  12548  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:51    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:13:55    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:55    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:55    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:13:55    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:55    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:55    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12292  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  5033: The Windows Firewall Driver started successfully.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x754 Process Name: C:\Windows\System32\oobe\msoobe.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1fbd5 Linked Logon ID: 0x1fd79 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x754 Process Name: C:\Windows\System32\oobe\msoobe.exe Network Information: Workstation Name: WIN-SLRHEC6PMT7 Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1fd79 Linked Logon ID: 0x1fbd5 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x754 Process Name: C:\Windows\System32\oobe\msoobe.exe Network Information: Workstation Name: WIN-SLRHEC6PMT7 Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12545  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4634: An account was logged off. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1fd79 Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Security  Audit Success  12545  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4634: An account was logged off. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1fbd5 Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1fbd5 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-544 Account Domain: Builtin Old Account Name: Administrators New Account Name: Administrators Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-545 Account Domain: Builtin Old Account Name: Users New Account Name: Users Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-546 Account Domain: Builtin Old Account Name: Guests New Account Name: Guests Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-558 Account Domain: Builtin Old Account Name: Performance Monitor Users New Account Name: Performance Monitor Users Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-559 Account Domain: Builtin Old Account Name: Performance Log Users New Account Name: Performance Log Users Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-562 Account Domain: Builtin Old Account Name: Distributed COM Users New Account Name: Distributed COM Users Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-568 Account Domain: Builtin Old Account Name: IIS_IUSRS New Account Name: IIS_IUSRS Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-573 Account Domain: Builtin Old Account Name: Event Log Readers New Account Name: Event Log Readers Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-580 Account Domain: Builtin Old Account Name: Remote Management Users New Account Name: Remote Management Users Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-581 Account Domain: Builtin Old Account Name: System Managed Accounts Group New Account Name: System Managed Accounts Group Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-583 Account Domain: Builtin Old Account Name: Device Owners New Account Name: Device Owners Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-584 Account Domain: Builtin Old Account Name: User Mode Hardware Operators New Account Name: User Mode Hardware Operators Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-32-585 Account Domain: Builtin Old Account Name: OpenSSH Users New Account Name: OpenSSH Users Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: Administrator Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x211 New UAC Value: 0x211 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: Administrator Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x211 New UAC Value: 0x211 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-501 Account Name: Guest Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: Guest Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x215 New UAC Value: 0x215 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-501 Account Name: Guest Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: Guest Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x215 New UAC Value: 0x215 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-503 Account Name: DefaultAccount Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: DefaultAccount Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x215 New UAC Value: 0x215 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-503 Account Name: DefaultAccount Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: DefaultAccount Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x215 New UAC Value: 0x215 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: WDAGUtilityAccount Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 7/13/2026 5:12:24 PM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x11 New UAC Value: 0x11 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: WDAGUtilityAccount Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 7/13/2026 5:12:24 PM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x11 New UAC Value: 0x11 User Account Control: - User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4781: The name of an account was changed: Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-513 Account Domain: DESKTOP-M1V6K8T Old Account Name: None New Account Name: None Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4720: A user account was created. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 New Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Attributes: SAM Account Name: defaultuser0 Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 Allowed To Delegate To: - Old UAC Value: 0x0 New UAC Value: 0x15 User Account Control: %%2080 %%2082 %%2084 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4722: A user account was enabled. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: defaultuser0 Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x15 New UAC Value: 0x14 User Account Control: %%2048 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: defaultuser0 Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 7/13/2026 5:13:56 PM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x14 New UAC Value: 0x14 User Account Control: - User Parameters: - SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4724: An attempt was made to reset an account's password. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: defaultuser0 Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 7/13/2026 5:13:56 PM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x14 New UAC Value: 0x214 User Account Control: %%2089 User Parameters: - SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4724: An attempt was made to reset an account's password. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x270 Process Name: C:\Windows\System32\lsass.exe
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Changed Attributes: SAM Account Name: Administrators SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Changed Attributes: SAM Account Name: Users SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-546 Group Name: Guests Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-546 Group Name: Guests Group Domain: Builtin Changed Attributes: SAM Account Name: Guests SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-558 Group Name: Performance Monitor Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-558 Group Name: Performance Monitor Users Group Domain: Builtin Changed Attributes: SAM Account Name: Performance Monitor Users SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-559 Group Name: Performance Log Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-559 Group Name: Performance Log Users Group Domain: Builtin Changed Attributes: SAM Account Name: Performance Log Users SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-562 Group Name: Distributed COM Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-562 Group Name: Distributed COM Users Group Domain: Builtin Changed Attributes: SAM Account Name: Distributed COM Users SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Changed Attributes: SAM Account Name: IIS_IUSRS SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-573 Group Name: Event Log Readers Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-573 Group Name: Event Log Readers Group Domain: Builtin Changed Attributes: SAM Account Name: Event Log Readers SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-580 Group Name: Remote Management Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-580 Group Name: Remote Management Users Group Domain: Builtin Changed Attributes: SAM Account Name: Remote Management Users SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-581 Group Name: System Managed Accounts Group Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-581 Group Name: System Managed Accounts Group Group Domain: Builtin Changed Attributes: SAM Account Name: System Managed Accounts Group SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-583 Group Name: Device Owners Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-583 Group Name: Device Owners Group Domain: Builtin Changed Attributes: SAM Account Name: Device Owners SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-584 Group Name: User Mode Hardware Operators Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-584 Group Name: User Mode Hardware Operators Group Domain: Builtin Changed Attributes: SAM Account Name: User Mode Hardware Operators SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-585 Group Name: OpenSSH Users Group Domain: Builtin Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4735: A security-enabled local group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-585 Group Name: OpenSSH Users Group Domain: Builtin Changed Attributes: SAM Account Name: OpenSSH Users SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4737: A security-enabled global group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-21-3469770775-847581034-1203560767-513 Group Name: None Group Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: - SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4737: A security-enabled global group was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-21-3469770775-847581034-1203560767-513 Group Name: None Group Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: None SID History: - Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4728: A member was added to a security-enabled global group. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: - Group: Security ID: S-1-5-21-3469770775-847581034-1203560767-513 Group Name: None Group Domain: DESKTOP-M1V6K8T Additional Information: Privileges: - Expiration time: (null)
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x754 Process Name: C:\Windows\System32\oobe\msoobe.exe
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x754 Process Name: C:\Windows\System32\oobe\msoobe.exe
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: - Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x754 Process Name: C:\Windows\System32\oobe\msoobe.exe
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x754 Process Name: C:\Windows\System32\oobe\msoobe.exe
Security  Audit Success  13826  2026-07-13 17:13:56    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x60c Process Name: C:\Windows\System32\svchost.exe
Security  Audit Success  12292  2026-07-13 17:13:57    Microsoft-Windows-Security-Auditing  5024: The Windows Firewall service started successfully.
Security  Audit Success  12544  2026-07-13 17:13:57    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:57    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:57    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:13:57    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:13:57    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:57    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:57    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:13:57    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13568  2026-07-13 17:13:57    Microsoft-Windows-Security-Auditing  4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\Temp\winre\ExtractedFromWim Handle ID: 0x8b0 Process Information: Process ID: 0x754 Process Name: C:\Windows\System32\oobe\msoobe.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;DCLCRPCRSDWDWO;;;WD)
Security  Audit Success  13826  2026-07-13 17:13:57    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x8fc Process Name: C:\Windows\System32\svchost.exe
Security  Audit Success  12544  2026-07-13 17:13:58    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:13:58    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13826  2026-07-13 17:13:58    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x139c Process Name: C:\Windows\System32\SearchIndexer.exe
Security  Audit Success  13826  2026-07-13 17:13:59    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xf88 Process Name: C:\Windows\System32\svchost.exe
Security  Audit Success  12544  2026-07-13 17:14:00    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:14:00    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:14:06    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:14:06    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:14:06    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x664 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:14:06    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54648 Linked Logon ID: 0x54683 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x664 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: WIN-SLRHEC6PMT7 Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:14:06    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Linked Logon ID: 0x54648 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x664 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: WIN-SLRHEC6PMT7 Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:14:06    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:14:06    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:14:06    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54648 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:14:06    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x270 Process Name: C:\Windows\System32\lsass.exe
Security  Audit Success  13826  2026-07-13 17:14:06    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x60c Process Name: C:\Windows\System32\svchost.exe
Security  Audit Failure  12290  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
Security  Audit Failure  12290  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
Security  Audit Failure  12290  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
Security  Audit Failure  12290  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
Security  Audit Failure  12290  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
Security  Audit Failure  12290  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
Security  Audit Success  12290  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2481 Return Code: 0x0
Security  Audit Success  12290  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
Security  Audit Success  12290  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2481 Return Code: 0x0
Security  Audit Success  12290  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5058: Key file operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Process Information: Process ID: 6000 Process Creation Time: 2026-07-14T00:14:07.3298228Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\defaultuser0\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e35a81ea-e9f3-46c8-8766-e45e5ee1ea58 Operation: %%2459 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5058: Key file operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Process Information: Process ID: 6000 Process Creation Time: 2026-07-14T00:14:07.3298228Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\defaultuser0\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e35a81ea-e9f3-46c8-8766-e45e5ee1ea58 Operation: %%2458 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5059: Key migration operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Process Information: Process ID: 6000 Process Creation Time: 2026-07-14T00:14:07.3298228Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5059: Key migration operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Process Information: Process ID: 6000 Process Creation Time: 2026-07-14T00:14:07.3298228Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5059: Key migration operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Process Information: Process ID: 6000 Process Creation Time: 2026-07-14T00:14:07.3298228Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 4912 Process Creation Time: 2026-07-14T00:14:07.4319306Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e35a81ea-e9f3-46c8-8766-e45e5ee1ea58 Operation: %%2459 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 4912 Process Creation Time: 2026-07-14T00:14:07.4319306Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e35a81ea-e9f3-46c8-8766-e45e5ee1ea58 Operation: %%2458 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 4912 Process Creation Time: 2026-07-14T00:14:07.4319306Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 4912 Process Creation Time: 2026-07-14T00:14:07.4319306Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 4912 Process Creation Time: 2026-07-14T00:14:07.4319306Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
Security  Audit Success  12544  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x157c Process Name: C:\Windows\System32\DeviceCensus.exe
Security  Audit Success  13824  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:14:07    Microsoft-Windows-Security-Auditing  5382: Vault credentials were read. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 This event occurs when a user reads a stored vault credential.
Security  Audit Success  12544  2026-07-13 17:14:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:14:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:14:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:14:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:14:10    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:14:10    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:14:10    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:14:10    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:14:11    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:14:11    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:14:12    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:14:12    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:14:27    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:14:27    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:15:48    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:15:48    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13826  2026-07-13 17:15:52    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x2394 Process Name: C:\Windows\System32\svchost.exe
Security  Audit Success  12544  2026-07-13 17:15:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:15:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:15:57    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:15:57    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:15:57    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:15:57    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:15:57    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:15:57    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4720: A user account was created. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 New Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Attributes: SAM Account Name: Marius Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 Allowed To Delegate To: - Old UAC Value: 0x0 New UAC Value: 0x15 User Account Control: %%2080 %%2082 %%2084 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges -
Security  Audit Success  13824  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4722: A user account was enabled. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T
Security  Audit Success  13824  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: Marius Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: %%1794 Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x15 New UAC Value: 0x14 User Account Control: %%2048 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: Marius Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 7/13/2026 5:16:13 PM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x14 New UAC Value: 0x14 User Account Control: - User Parameters: - SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4724: An attempt was made to reset an account's password. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T
Security  Audit Success  13824  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: Marius Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 7/13/2026 5:16:13 PM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x14 New UAC Value: 0x214 User Account Control: %%2089 User Parameters: - SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4724: An attempt was made to reset an account's password. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T
Security  Audit Success  13824  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: - Display Name: - User Principal Name: - Home Directory: - Home Drive: - Script Path: - Profile Path: - User Workstations: - Password Last Set: - Account Expires: - Primary Group ID: - AllowedToDelegateTo: - Old UAC Value: - New UAC Value: - User Account Control: - User Parameters: - SID History: - Logon Hours: - Additional Information: Privileges: -
Security  Audit Success  13824  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4725: A user account was disabled. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T
Security  Audit Success  13824  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4738: A user account was changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Changed Attributes: SAM Account Name: defaultuser0 Display Name: %%1793 User Principal Name: - Home Directory: %%1793 Home Drive: %%1793 Script Path: %%1793 Profile Path: %%1793 User Workstations: %%1793 Password Last Set: 7/13/2026 5:13:56 PM Account Expires: %%1794 Primary Group ID: 513 AllowedToDelegateTo: - Old UAC Value: 0x214 New UAC Value: 0x211 User Account Control: %%2080 %%2050 User Parameters: %%1793 SID History: - Logon Hours: %%1797 Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4728: A member was added to a security-enabled global group. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: - Group: Security ID: S-1-5-21-3469770775-847581034-1203560767-513 Group Name: None Group Domain: DESKTOP-M1V6K8T Additional Information: Privileges: - Expiration time: (null)
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1850 Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1850 Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4732: A member was added to a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: - Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Additional Information: Privileges: - Expiration time: (null)
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1850 Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1850 Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x1850 Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x1850 Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x1850 Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4733: A member was removed from a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x1850 Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x1850 Process Name: C:\Windows\System32\CloudExperienceHostBroker.exe
Security  Audit Success  13826  2026-07-13 17:16:13    Microsoft-Windows-Security-Auditing  4733: A member was removed from a security-enabled local group. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Member: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: - Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Additional Information: Privileges: -
Security  Audit Success  12545  2026-07-13 17:16:14    Microsoft-Windows-Security-Auditing  4647: User initiated logoff: Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Logon ID: 0x54683 This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
Security  Audit Success  12544  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-2 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x5c8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-2 Account Name: UMFD-2 Account Domain: Font Driver Host Logon ID: 0xe5134 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x5c8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-2 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x5c8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-2 Account Name: DWM-2 Account Domain: Window Manager Logon ID: 0xe5629 Linked Logon ID: 0xe565a Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x5c8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-2 Account Name: DWM-2 Account Domain: Window Manager Logon ID: 0xe565a Linked Logon ID: 0xe5629 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x5c8 Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x664 Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f41 Linked Logon ID: 0xe7f87 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x664 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: WIN-SLRHEC6PMT7 Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Linked Logon ID: 0xe7f41 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x664 Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: WIN-SLRHEC6PMT7 Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12545  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4634: An account was logged off. Subject: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0x9d67 Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Security  Audit Success  12548  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-2 Account Name: DWM-2 Account Domain: Window Manager Logon ID: 0xe5629 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-2 Account Name: DWM-2 Account Domain: Window Manager Logon ID: 0xe565a Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
Security  Audit Success  12548  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f41 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:16:15    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x270 Process Name: C:\Windows\System32\lsass.exe
Security  Audit Failure  12290  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
Security  Audit Failure  12290  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
Security  Audit Failure  12290  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x80090016
Security  Audit Success  12290  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2481 Return Code: 0x0
Security  Audit Success  12290  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5058: Key file operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Process Information: Process ID: 5844 Process Creation Time: 2026-07-14T00:16:16.6092106Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\Marius\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e35a81ea-e9f3-46c8-8766-e45e5ee1ea58 Operation: %%2459 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5058: Key file operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Process Information: Process ID: 5844 Process Creation Time: 2026-07-14T00:16:16.6092106Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\Marius\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e35a81ea-e9f3-46c8-8766-e45e5ee1ea58 Operation: %%2458 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5059: Key migration operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Process Information: Process ID: 5844 Process Creation Time: 2026-07-14T00:16:16.6092106Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5059: Key migration operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Process Information: Process ID: 5844 Process Creation Time: 2026-07-14T00:16:16.6092106Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5059: Key migration operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Process Information: Process ID: 5844 Process Creation Time: 2026-07-14T00:16:16.6092106Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
Security  Audit Success  13824  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13826  2026-07-13 17:16:16    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x60c Process Name: C:\Windows\System32\svchost.exe
Security  Audit Success  12545  2026-07-13 17:16:17    Microsoft-Windows-Security-Auditing  4634: An account was logged off. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0xf871 Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Security  Audit Success  12545  2026-07-13 17:16:17    Microsoft-Windows-Security-Auditing  4634: An account was logged off. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0xf83d Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Security  Audit Success  12544  2026-07-13 17:16:18    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:16:18    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:16:18    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:16:18    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:16:20    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:16:20    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:16:21    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:16:21    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:16:21    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:16:21    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13826  2026-07-13 17:17:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1790 Process Name: C:\Windows\System32\svchost.exe
Security  Audit Success  12544  2026-07-13 17:17:52    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:17:52    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13826  2026-07-13 17:17:52    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xc9c Process Name: C:\Windows\System32\RuntimeBroker.exe
Security  Audit Success  13826  2026-07-13 17:17:52    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xc9c Process Name: C:\Windows\System32\RuntimeBroker.exe
Security  Audit Success  13826  2026-07-13 17:17:52    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xc9c Process Name: C:\Windows\System32\RuntimeBroker.exe
Security  Audit Success  13826  2026-07-13 17:17:52    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xc9c Process Name: C:\Windows\System32\RuntimeBroker.exe
Security  Audit Success  13826  2026-07-13 17:17:52    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xc9c Process Name: C:\Windows\System32\RuntimeBroker.exe
Security  Audit Success  13826  2026-07-13 17:17:52    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xc9c Process Name: C:\Windows\System32\RuntimeBroker.exe
Security  Audit Success  13826  2026-07-13 17:17:52    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xc9c Process Name: C:\Windows\System32\RuntimeBroker.exe
Security  Audit Success  13826  2026-07-13 17:17:52    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xc9c Process Name: C:\Windows\System32\RuntimeBroker.exe
Security  Audit Success  12544  2026-07-13 17:17:56    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:17:56    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13568  2026-07-13 17:17:56    Microsoft-Windows-Security-Auditing  4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\_0000000000000000.cdf-ms Handle ID: 0xe6c Process Information: Process ID: 0x2664 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8035_none_a54f1c79772e807e\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
Security  Audit Success  13568  2026-07-13 17:17:56    Microsoft-Windows-Security-Auditing  4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$.cdf-ms Handle ID: 0xe6c Process Information: Process ID: 0x2664 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8035_none_a54f1c79772e807e\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
Security  Audit Success  13568  2026-07-13 17:17:56    Microsoft-Windows-Security-Auditing  4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_21ffbdd2a2dd92e0.cdf-ms Handle ID: 0xe6c Process Information: Process ID: 0x2664 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8035_none_a54f1c79772e807e\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
Security  Audit Success  13568  2026-07-13 17:17:56    Microsoft-Windows-Security-Auditing  4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_wbem_1bf25d11bb30b33f.cdf-ms Handle ID: 0xe6c Process Information: Process ID: 0x2664 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8035_none_a54f1c79772e807e\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
Security  Audit Success  13568  2026-07-13 17:17:56    Microsoft-Windows-Security-Auditing  4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_syswow64_wbem_en-us_04f9ae10d0d40b09.cdf-ms Handle ID: 0xe6c Process Information: Process ID: 0x2664 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8035_none_a54f1c79772e807e\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
Security  Audit Success  13568  2026-07-13 17:17:56    Microsoft-Windows-Security-Auditing  4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_21f9a9c4a2f8b514.cdf-ms Handle ID: 0xe6c Process Information: Process ID: 0x2664 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8035_none_a54f1c79772e807e\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
Security  Audit Success  13568  2026-07-13 17:17:56    Microsoft-Windows-Security-Auditing  4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_06656d9fdf2f8577.cdf-ms Handle ID: 0xe6c Process Information: Process ID: 0x2664 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8035_none_a54f1c79772e807e\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
Security  Audit Success  13568  2026-07-13 17:17:56    Microsoft-Windows-Security-Auditing  4907: Auditing settings on object were changed. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Object: Object Server: Security Object Type: File Object Name: C:\Windows\WinSxS\FileMaps\$$_system32_wbem_en-us_4555b1beb1c13883.cdf-ms Handle ID: 0xe6c Process Information: Process ID: 0x2664 Process Name: C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.8035_none_a54f1c79772e807e\TiWorker.exe Auditing Settings: Original Security Descriptor: New Security Descriptor: S:(AU;SAFA;0x1f0116;;;WD)
Security  Audit Success  13824  2026-07-13 17:18:31    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:18:31    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:18:31    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:18:31    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:18:33    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:18:43    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:19:33    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  103  2026-07-13 17:19:52    Microsoft-Windows-Eventlog  1100: The event logging service has shut down.
Security  Audit Success  12544  2026-07-13 17:19:52    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: WIN-SLRHEC6PMT7$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x29c Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12545  2026-07-13 17:19:52    Microsoft-Windows-Security-Auditing  4647: User initiated logoff: Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xe7f87 This event is generated when a logoff is initiated. No further user-initiated activity can occur. This event can be interpreted as a logoff event.
Security  Audit Success  12548  2026-07-13 17:19:52    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13312  2026-07-13 17:29:07    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0xc8 New Process Name: R Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:29:07    Microsoft-Windows-Security-Auditing  4696: A primary token was assigned to process. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Process Information: Process ID: 0x4 Process Name: Target Process: Target Process ID: 0xc8 Target Process Name: Registry New Token Information: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x3e7
Security  Audit Success  13312  2026-07-13 17:29:07    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x268 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x4 Creator Process Name: Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:29:07    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x284 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x268 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:29:07    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x2e8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x268 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13573  2026-07-13 17:29:07    Microsoft-Windows-Security-Auditing  4826: Boot Configuration Data loaded. Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 General Settings: Load Options: - Advanced Options: %%1843 Configuration Access Policy: %%1846 System Event Logging: %%1843 Kernel Debugging: %%1843 VSM Launch Type: %%1848 Signature Settings: Test Signing: %%1843 Flight Signing: %%1843 Disable Integrity Checks: %%1843 HyperVisor Settings: HyperVisor Load Options: - HyperVisor Launch Type: %%1848 HyperVisor Debugging: %%1843
Security  Audit Success  12288  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4608: Windows is starting up. This event is logged when LSASS.EXE starts and the auditing subsystem is initialized.
Security  Audit Success  12290  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  6417: The FIPS mode crypto selftests succeeded. Process ID: 0x3fc Process Name: C:\Windows\System32\lsass.exe
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Logon Information: Logon Type: 0 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: - New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x4 Process Name: Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: - Authentication Package: - Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-0 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x34c Process Name: C:\Windows\System32\wininit.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-0 Account Name: UMFD-0 Account Domain: Font Driver Host Logon ID: 0x9b89 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x34c Process Name: C:\Windows\System32\wininit.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: UMFD-1 Account Domain: Font Driver Host Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x39c Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-96-0-1 Account Name: UMFD-1 Account Domain: Font Driver Host Logon ID: 0x9b6f Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x39c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: DWM-1 Account Domain: Window Manager Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x39c Process Name: C:\Windows\System32\winlogon.exe Network Information: Network Address: - Port: - This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0xfe6e Linked Logon ID: 0xfec9 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x39c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1842 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0xfec9 Linked Logon ID: 0xfe6e Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x39c Process Name: C:\Windows\System32\winlogon.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-20 Account Name: NETWORK SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e4 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0xfe6e Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-90-0-1 Account Name: DWM-1 Account Domain: Window Manager Logon ID: 0xfec9 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Privileges: SeAssignPrimaryTokenPrivilege SeAuditPrivilege SeImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13312  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x304 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2e8 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x344 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x268 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x34c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x2e8 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x354 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x344 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x39c New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x344 Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3e8 New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x34c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13312  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4688: A new process has been created. Creator Subject: Security ID: S-1-5-18 Account Name: - Account Domain: - Logon ID: 0x3e7 Target Subject: Security ID: S-1-0-0 Account Name: - Account Domain: - Logon ID: 0x0 Process Information: New Process ID: 0x3fc New Process Name: C Token Elevation Type: %%1936 Mandatory Label: S-1-16-16384 Creator Process ID: 0x34c Creator Process Name: C Process Command Line: Token Elevation Type indicates the type of token that was assigned to the new process in accordance with User Account Control policy. Type 1 is a full token with no privileges removed or groups disabled. A full token is only used if User Account Control is disabled or if the user is the built-in Administrator account or a service account. Type 2 is an elevated token with no privileges removed or groups disabled. An elevated token is used when User Account Control is enabled and the user chooses to start the program using Run as administrator. An elevated token is also used when an application is configured to always require administrative privilege or to always require maximum privilege, and the user is a member of the Administrators group. Type 3 is a limited token with administrative privileges removed and administrative groups disabled. The limited token is used when User Account Control is enabled, the application does not require administrative privilege, and the user does not choose to start the program using Run as administrator.
Security  Audit Success  13568  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  4902: The Per-user audit policy table was created. Number of Elements: 0 Policy ID: 0x97f6
Security  Audit Success  13824  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:29:08    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  12290  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
Security  Audit Success  12290  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  5061: Cryptographic operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Cryptographic Operation: Operation: %%2480 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  5033: The Windows Firewall Driver started successfully.
Security  Audit Success  12292  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  5058: Key file operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Process Information: Process ID: 1700 Process Creation Time: 2026-07-14T00:29:09.3717814Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\Users\Marius\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e35a81ea-e9f3-46c8-8766-e45e5ee1ea58 Operation: %%2458 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  5059: Key migration operation. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Process Information: Process ID: 1700 Process Creation Time: 2026-07-14T00:29:09.3717814Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  5058: Key file operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 4488 Process Creation Time: 2026-07-14T00:29:09.5148221Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: UNKNOWN Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Key File Operation Information: File Path: C:\WINDOWS\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Crypto\Keys\de7cf8a7901d2ad13e5c67c29e5d1662_e35a81ea-e9f3-46c8-8766-e45e5ee1ea58 Operation: %%2458 Return Code: 0x0
Security  Audit Success  12292  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  5059: Key migration operation. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Process Information: Process ID: 4488 Process Creation Time: 2026-07-14T00:29:09.5148221Z Cryptographic Parameters: Provider Name: Microsoft Software Key Storage Provider Algorithm Name: ECDSA_P256 Key Name: Microsoft Connected Devices Platform device certificate Key Type: %%2500 Additional Information: Operation: %%2464 Return Code: 0x0
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x86c Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Linked Logon ID: 0x1f42f Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x86c Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-M1V6K8T Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Linked Logon ID: 0x1f2d1 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x86c Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-M1V6K8T Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x3fc Process Name: C:\Windows\System32\lsass.exe
Security  Audit Success  13824  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13826  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-20 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e4 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x560 Process Name: C:\Windows\System32\svchost.exe
Security  Audit Success  13826  2026-07-13 17:29:09    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x7d0 Process Name: C:\Windows\System32\svchost.exe
Security  Audit Success  12292  2026-07-13 17:29:10    Microsoft-Windows-Security-Auditing  5024: The Windows Firewall service started successfully.
Security  Audit Success  12544  2026-07-13 17:29:10    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:10    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:10    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:10    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:29:10    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:10    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:10    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:10    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:29:10    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x514 Process Name: C:\Windows\System32\LogonUI.exe
Security  Audit Success  13824  2026-07-13 17:29:10    Microsoft-Windows-Security-Auditing  5382: Vault credentials were read. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 This event occurs when a user reads a stored vault credential.
Security  Audit Success  12544  2026-07-13 17:29:11    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:29:11    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:29:11    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:29:11    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:29:11    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-19 Account Name: LOCAL SERVICE Account Domain: NT AUTHORITY Logon ID: 0x3e5 Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  12544  2026-07-13 17:29:12    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:29:12    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:29:13    Microsoft-Windows-Security-Auditing  4726: A user account was deleted. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Target Account: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: defaultuser0 Account Domain: DESKTOP-M1V6K8T Additional Information: Privileges -
Security  Audit Success  13826  2026-07-13 17:29:13    Microsoft-Windows-Security-Auditing  4733: A member was removed from a security-enabled local group. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Member: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: - Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Additional Information: Privileges: -
Security  Audit Success  13826  2026-07-13 17:29:13    Microsoft-Windows-Security-Auditing  4729: A member was removed from a security-enabled global group. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Member: Security ID: S-1-5-21-3469770775-847581034-1203560767-1000 Account Name: - Group: Security ID: S-1-5-21-3469770775-847581034-1203560767-513 Group Name: None Group Domain: DESKTOP-M1V6K8T Additional Information: Privileges: -
Security  Audit Success  12544  2026-07-13 17:29:14    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:14    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:29:14    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:14    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13826  2026-07-13 17:29:14    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0xd80 Process Name: C:\Windows\System32\svchost.exe
Security  Audit Success  13826  2026-07-13 17:29:14    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x7d0 Process Name: C:\Windows\System32\svchost.exe
Security  Audit Success  13826  2026-07-13 17:29:14    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1d30 Process Name: C:\Windows\System32\SearchIndexer.exe
Security  Audit Success  12544  2026-07-13 17:29:16    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:29:16    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:29:17    Microsoft-Windows-Security-Auditing  4648: A logon was attempted using explicit credentials. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon GUID: {00000000-0000-0000-0000-000000000000} Account Whose Credentials Were Used: Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon GUID: {00000000-0000-0000-0000-000000000000} Target Server: Target Server Name: localhost Additional Information: localhost Process Information: Process ID: 0x86c Process Name: C:\Windows\System32\svchost.exe Network Information: Network Address: 127.0.0.1 Port: 0 This event is generated when a process attempts to log on an account by explicitly specifying that account’s credentials. This most commonly occurs in batch-type configurations such as scheduled tasks, or when using the RUNAS command.
Security  Audit Success  12544  2026-07-13 17:29:17    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xba7ce Linked Logon ID: 0xba81d Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x86c Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-M1V6K8T Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:17    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 2 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1843 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xba81d Linked Logon ID: 0xba7ce Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x86c Process Name: C:\Windows\System32\svchost.exe Network Information: Workstation Name: DESKTOP-M1V6K8T Source Network Address: 127.0.0.1 Source Port: 0 Detailed Authentication Information: Logon Process: User32 Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:17    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:29:17    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12545  2026-07-13 17:29:17    Microsoft-Windows-Security-Auditing  4634: An account was logged off. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xba81d Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Security  Audit Success  12545  2026-07-13 17:29:17    Microsoft-Windows-Security-Auditing  4634: An account was logged off. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xba7ce Logon Type: 2 This event is generated when a logon session is destroyed. It may be positively correlated with a logon event using the Logon ID value. Logon IDs are only unique between reboots on the same computer.
Security  Audit Success  12548  2026-07-13 17:29:17    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0xba7ce Privileges: SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:17    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:29:17    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:29:17    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x3fc Process Name: C:\Windows\System32\lsass.exe
Security  Audit Success  13824  2026-07-13 17:29:17    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  12544  2026-07-13 17:29:21    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:29:21    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13826  2026-07-13 17:29:22    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x1f18 Process Name: C:\Windows\System32\svchost.exe
Security  Audit Success  12544  2026-07-13 17:29:25    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:29:25    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:30:06    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:30:06    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:30:17    Microsoft-Windows-Security-Auditing  5379: Credential Manager credentials were read. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Read Operation: %%8100 This event occurs when a user performs a read operation on stored credentials in Credential Manager.
Security  Audit Success  13824  2026-07-13 17:31:01    Microsoft-Windows-Security-Auditing  4797: An attempt was made to query the existence of a blank password for an account. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Additional Information: Caller Workstation: DESKTOP-M1V6K8T Target Account Name: Administrator Target Account Domain: DESKTOP-M1V6K8T
Security  Audit Success  13824  2026-07-13 17:31:01    Microsoft-Windows-Security-Auditing  4797: An attempt was made to query the existence of a blank password for an account. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Additional Information: Caller Workstation: DESKTOP-M1V6K8T Target Account Name: DefaultAccount Target Account Domain: DESKTOP-M1V6K8T
Security  Audit Success  13824  2026-07-13 17:31:01    Microsoft-Windows-Security-Auditing  4797: An attempt was made to query the existence of a blank password for an account. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Additional Information: Caller Workstation: DESKTOP-M1V6K8T Target Account Name: Guest Target Account Domain: DESKTOP-M1V6K8T
Security  Audit Success  13824  2026-07-13 17:31:01    Microsoft-Windows-Security-Auditing  4797: An attempt was made to query the existence of a blank password for an account. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f42f Additional Information: Caller Workstation: DESKTOP-M1V6K8T Target Account Name: WDAGUtilityAccount Target Account Domain: DESKTOP-M1V6K8T
Security  Audit Success  12544  2026-07-13 17:31:09    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:31:09    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12544  2026-07-13 17:31:10    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:31:10    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:31:10    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12544  2026-07-13 17:31:10    Microsoft-Windows-Security-Auditing  4624: An account was successfully logged on. Subject: Security ID: S-1-5-18 Account Name: DESKTOP-M1V6K8T$ Account Domain: WORKGROUP Logon ID: 0x3e7 Logon Information: Logon Type: 5 Restricted Admin Mode: - Remote Credential Guard: - Virtual Account: %%1843 Elevated Token: %%1842 Impersonation Level: %%1833 New Logon: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Linked Logon ID: 0x0 Network Account Name: - Network Account Domain: - Logon GUID: {00000000-0000-0000-0000-000000000000} Process Information: Process ID: 0x3e8 Process Name: C:\Windows\System32\services.exe Network Information: Workstation Name: - Source Network Address: - Source Port: - Detailed Authentication Information: Logon Process: Advapi Authentication Package: Negotiate Transited Services: - Package Name (NTLM only): - Key Length: 0 This event is generated when a logon session is created. It is generated on the computer that was accessed. The subject fields indicate the account on the local system which requested the logon. This is most commonly a service such as the Server service, or a local process such as Winlogon.exe or Services.exe. The logon type field indicates the kind of logon that occurred. The most common types are 2 (interactive) and 3 (network). The New Logon fields indicate the account for whom the new logon was created, i.e. the account that was logged on. The network fields indicate where a remote logon request originated. Workstation name is not always available and may be left blank in some cases. The impersonation level field indicates the extent to which a process in the logon session can impersonate. The authentication information fields provide detailed information about this specific logon request. - Logon GUID is a unique identifier that can be used to correlate this event with a KDC event. - Transited services indicate which intermediate services have participated in this logon request. - Package name indicates which sub-protocol was used among the NTLM protocols. - Key length indicates the length of the generated session key. This will be 0 if no session key was requested.
Security  Audit Success  12548  2026-07-13 17:31:10    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:31:10    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:31:10    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  12548  2026-07-13 17:31:10    Microsoft-Windows-Security-Auditing  4672: Special privileges assigned to new logon. Subject: Security ID: S-1-5-18 Account Name: SYSTEM Account Domain: NT AUTHORITY Logon ID: 0x3e7 Privileges: SeAssignPrimaryTokenPrivilege SeTcbPrivilege SeSecurityPrivilege SeTakeOwnershipPrivilege SeLoadDriverPrivilege SeBackupPrivilege SeRestorePrivilege SeDebugPrivilege SeAuditPrivilege SeSystemEnvironmentPrivilege SeImpersonatePrivilege SeDelegateSessionUserImpersonatePrivilege
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-503 Account Name: DefaultAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-501 Account Name: Guest Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-503 Account Name: DefaultAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-501 Account Name: Guest Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-503 Account Name: DefaultAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-503 Account Name: DefaultAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-501 Account Name: Guest Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-501 Account Name: Guest Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-501 Account Name: Guest Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-501 Account Name: Guest Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-503 Account Name: DefaultAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-503 Account Name: DefaultAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-500 Account Name: Administrator Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-501 Account Name: Guest Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-501 Account Name: Guest Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-503 Account Name: DefaultAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-503 Account Name: DefaultAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-504 Account Name: WDAGUtilityAccount Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13824  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4798: A user's local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 User: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-544 Group Name: Administrators Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-583 Group Name: Device Owners Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-562 Group Name: Distributed COM Users Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-573 Group Name: Event Log Readers Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-546 Group Name: Guests Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-578 Group Name: Hyper-V Administrators Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-568 Group Name: IIS_IUSRS Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-585 Group Name: OpenSSH Users Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-559 Group Name: Performance Log Users Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-558 Group Name: Performance Monitor Users Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-580 Group Name: Remote Management Users Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-581 Group Name: System Managed Accounts Group Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-584 Group Name: User Mode Hardware Operators Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
Security  Audit Success  13826  2026-07-13 17:31:51    Microsoft-Windows-Security-Auditing  4799: A security-enabled local group membership was enumerated. Subject: Security ID: S-1-5-21-3469770775-847581034-1203560767-1001 Account Name: Marius Account Domain: DESKTOP-M1V6K8T Logon ID: 0x1f2d1 Group: Security ID: S-1-5-32-545 Group Name: Users Group Domain: Builtin Process Information: Process ID: 0x14b8 Process Name: C:\Program Files\FinalWire\AIDA64 Extreme\aida64.exe
System  Error  None  2026-07-13 17:12:35    Service Control Manager  7023: The netprofm service terminated with the following error: %%21
System  Warning  None  2026-07-13 17:12:48    e1i68x64  27: Intel(R) Ethernet Connection (19) I219-LM Network link is disconnected.
System  Error  None  2026-07-13 17:13:35  SYSTEM  DCOM  10010: The server {A47979D2-C419-11D9-A5B4-001185AD2B89} did not register with DCOM within the required timeout.
System  Warning  None  2026-07-13 17:13:50    e1i68x64  27: Intel(R) Ethernet Connection (19) I219-LM Network link is disconnected.
System  Warning  None  2026-07-13 17:13:56  LOCAL SERVICE  Microsoft-Windows-Time-Service  134: NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x9'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
System  Warning  None  2026-07-13 17:13:58  LOCAL SERVICE  Microsoft-Windows-Time-Service  134: NtpClient was unable to set a manual peer to use as a time source because of DNS resolution error on 'time.windows.com,0x9'. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: No such host is known. (0x80072AF9)
System  Error  None  2026-07-13 17:15:57    Service Control Manager  7030: The Printer Extensions and Notifications service is marked as an interactive service. However, the system is configured to not allow interactive services. This service may not function properly.
System  Error  None  2026-07-13 17:18:57  SYSTEM  Microsoft-Windows-TPM-WMI  1796: The Secure Boot update failed to update DBX with error -2147020471. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931
System  Error  None  2026-07-13 17:18:57  SYSTEM  Microsoft-Windows-TPM-WMI  1796: The Secure Boot update failed to update SBAT with error -2147020471. For more information, please see https://go.microsoft.com/fwlink/?linkid=2169931
System  Error  None  2026-07-13 17:19:47  Marius  DCOM  10010: The server {544C4C52-DE0B-4D14-9510-21745381D5CA} did not register with DCOM within the required timeout.
System  Warning  None  2026-07-13 17:19:52  SYSTEM  winsrvext  100: Process C:\Users\Marius\AppData\Local\Microsoft\OneDrive\25.087.0506.0001\Microsoft.SharePoint.exe is delaying system shutdown after 5032 milliseconds.
System  Warning  None  2026-07-13 17:19:52  SYSTEM  winsrvext  100: Process C:\Users\Marius\AppData\Local\Microsoft\OneDrive\OneDrive.exe is delaying system shutdown after 5032 milliseconds.
System  Warning  None  2026-07-13 17:29:08    e1i68x64  27: Intel(R) Ethernet Connection (19) I219-LM Network link is disconnected.
System  Error  None  2026-07-13 17:29:11  Marius  DCOM  10001: Unable to start a DCOM Server: {297FDBDE-595D-4083-82B1-768BEE65F6C9} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
System  Error  None  2026-07-13 17:29:11  Marius  DCOM  10001: Unable to start a DCOM Server: {3E11DF0F-42EB-4747-9A35-802D98B5BCF0} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
System  Error  None  2026-07-13 17:29:11  Marius  DCOM  10001: Unable to start a DCOM Server: {3E11DF0F-42EB-4747-9A35-802D98B5BCF0} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
System  Error  None  2026-07-13 17:29:11  Marius  DCOM  10001: Unable to start a DCOM Server: {3E11DF0F-42EB-4747-9A35-802D98B5BCF0} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
System  Error  None  2026-07-13 17:29:12  Marius  DCOM  10001: Unable to start a DCOM Server: {740FE937-01F7-4482-AA62-C83F0AD3D6D0} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
System  Error  None  2026-07-13 17:29:12  Marius  DCOM  10001: Unable to start a DCOM Server: {6FA05A24-B1DF-4155-909E-7B424F2D2BB5} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
System  Error  None  2026-07-13 17:29:17  Marius  DCOM  10001: Unable to start a DCOM Server: {297FDBDE-595D-4083-82B1-768BEE65F6C9} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
System  Error  None  2026-07-13 17:29:17  Marius  DCOM  10001: Unable to start a DCOM Server: {3E11DF0F-42EB-4747-9A35-802D98B5BCF0} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
System  Error  None  2026-07-13 17:29:17  Marius  DCOM  10001: Unable to start a DCOM Server: {3E11DF0F-42EB-4747-9A35-802D98B5BCF0} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
System  Error  None  2026-07-13 17:29:18  Marius  DCOM  10001: Unable to start a DCOM Server: {3E11DF0F-42EB-4747-9A35-802D98B5BCF0} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
System  Error  None  2026-07-13 17:29:19  Marius  DCOM  10001: Unable to start a DCOM Server: {740FE937-01F7-4482-AA62-C83F0AD3D6D0} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
System  Error  None  2026-07-13 17:29:19  Marius  DCOM  10001: Unable to start a DCOM Server: {6FA05A24-B1DF-4155-909E-7B424F2D2BB5} as Unavailable/Unavailable. The error: "2147943631" Happened while starting this command: "C:\Program Files\WindowsApps\Microsoft.WidgetsPlatformRuntime_1.6.14.0_x64__8wekyb3d8bbwe\WidgetService\WidgetService.exe" -RegisterProcessAsComServer -Embedding
System  Warning  None  2026-07-13 17:31:10  SYSTEM  DCOM  10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscBrokerManager and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
System  Warning  None  2026-07-13 17:31:10  SYSTEM  DCOM  10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.SecurityAppBroker and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.
System  Warning  None  2026-07-13 17:31:10  SYSTEM  DCOM  10016: The application-specific permission settings do not grant Local Launch permission for the COM Server application with CLSID Windows.SecurityCenter.WscDataProtection and APPID Unavailable to the user NT AUTHORITY\SYSTEM SID (S-1-5-18) from address LocalHost (Using LRPC) running in the application container Unavailable SID (Unavailable). This security permission can be modified using the Component Services administrative tool.


Database Software
 
Database Drivers:
Borland Database Engine  -
Borland InterBase Client  -
Easysoft ODBC-InterBase 6  -
Easysoft ODBC-InterBase 7  -
Firebird Client  -
Jet Engine  10.0.26100.5074
MDAC  10.0.26100.5074 (WinBuild.160101.0800)
ODBC  10.0.26100.7309 (WinBuild.160101.0800)
MySQL Connector/ODBC  -
Oracle Client  -
PsqlODBC  -
Sybase ASE ODBC  -
 
Database Servers:
Borland InterBase Server  -
Firebird Server  -
Microsoft SQL Server  -
Microsoft SQL Server Compact Edition  -
Microsoft SQL Server Express Edition  -
MySQL Server  -
Oracle Server  -
PostgreSQL Server  -
Sybase SQL Server  -


ODBC Drivers
 
Driver Description  File Name  Version  File Extensions Supported
Driver da Microsoft para arquivos texto (*.txt; *.csv)  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.,*.asc,*.csv,*.tab,*.txt,*.csv
Driver do Microsoft Access (*.mdb)  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.mdb
Driver do Microsoft dBase (*.dbf)  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.dbf,*.ndx,*.mdx
Driver do Microsoft Excel(*.xls)  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.xls
Driver do Microsoft Paradox (*.db )  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.db
Microsoft Access Driver (*.mdb)  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.mdb
Microsoft Access-Treiber (*.mdb)  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.mdb
Microsoft dBase Driver (*.dbf)  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.dbf,*.ndx,*.mdx
Microsoft dBase-Treiber (*.dbf)  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.dbf,*.ndx,*.mdx
Microsoft Excel Driver (*.xls)  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.xls
Microsoft Excel-Treiber (*.xls)  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.xls
Microsoft ODBC for Oracle  msorcl32.dll  10.0.26100.1 (WinBuild.160101.0800)  
Microsoft Paradox Driver (*.db )  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.db
Microsoft Paradox-Treiber (*.db )  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.db
Microsoft Text Driver (*.txt; *.csv)  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.,*.asc,*.csv,*.tab,*.txt,*.csv
Microsoft Text-Treiber (*.txt; *.csv)  odbcjt32.dll  10.0.26100.1 (WinBuild.160101.0800)  *.,*.asc,*.csv,*.tab,*.txt,*.csv
SQL Server  sqlsrv32.dll  10.0.26100.3624 (WinBuild.160101.0800)  


Memory Read
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
232454 MB/s
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
110854 MB/s
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
87829 MB/s
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
84515 MB/s
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
80730 MB/s
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
77068 MB/s
16x Xeon E5-2670 HT  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
74969 MB/s
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
73393 MB/s
16x Core i9-12900K HT  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
70134 MB/s
10x Core Ultra 5 225T  3700 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
68245 MB/s
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
67728 MB/s
32x Ryzen Threadripper 2990WX HT  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
61080 MB/s
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
52191 MB/s
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
48413 MB/s
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
48367 MB/s
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
47746 MB/s
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
47738 MB/s
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
45337 MB/s
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
44784 MB/s
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
44517 MB/s
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
43000 MB/s
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
41166 MB/s
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
40759 MB/s
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
38338 MB/s
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
38006 MB/s
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
35470 MB/s
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
31176 MB/s
4x Core i7-7700K HT  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
30618 MB/s
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
27404 MB/s
8x FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
27235 MB/s
8x FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
26179 MB/s
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
24126 MB/s
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
23639 MB/s
4x Core i7-3770K HT  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
23564 MB/s
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
23227 MB/s
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
23148 MB/s
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
21478 MB/s
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
21436 MB/s
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
21435 MB/s
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
21316 MB/s
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
21146 MB/s
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
20842 MB/s
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
19330 MB/s
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
18848 MB/s
8x Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
17443 MB/s
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
16574 MB/s
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
16448 MB/s
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
15663 MB/s
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
14744 MB/s
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
14046 MB/s
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
13414 MB/s
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
13158 MB/s
8x Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1
11433 MB/s
4x Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
11214 MB/s
2x Core i5-650 HT  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
10731 MB/s
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
10347 MB/s
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
9697 MB/s
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
8965 MB/s
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
8667 MB/s
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
8581 MB/s
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
8160 MB/s
2x Pentium EE 955 HT  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
7986 MB/s
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
7778 MB/s
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
7620 MB/s
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
6936 MB/s
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
6548 MB/s
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
6431 MB/s
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
6220 MB/s
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
6011 MB/s
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
5970 MB/s
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
5841 MB/s
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
5397 MB/s
2x Atom D525 HT  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
5340 MB/s
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
4596 MB/s
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
3971 MB/s
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
3938 MB/s
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
3672 MB/s
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
3624 MB/s
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12
3364 MB/s
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2
3324 MB/s
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
2927 MB/s
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2


Memory Write
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
387199 MB/s
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
93766 MB/s
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
86866 MB/s
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
84821 MB/s
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
77739 MB/s
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
76684 MB/s
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
73328 MB/s
16x Xeon E5-2670 HT  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
71135 MB/s
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
70987 MB/s
32x Ryzen Threadripper 2990WX HT  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
69581 MB/s
10x Core Ultra 5 225T  3600 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
60842 MB/s
16x Core i9-12900K HT  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
58969 MB/s
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
57891 MB/s
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
52397 MB/s
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
47582 MB/s
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
46987 MB/s
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
46958 MB/s
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
46696 MB/s
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
45891 MB/s
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
44275 MB/s
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
43946 MB/s
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
41584 MB/s
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
40867 MB/s
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
39885 MB/s
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
33260 MB/s
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
33235 MB/s
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
32373 MB/s
4x Core i7-7700K HT  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
27388 MB/s
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
23902 MB/s
4x Core i7-3770K HT  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
23763 MB/s
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
23721 MB/s
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
23472 MB/s
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
19532 MB/s
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
17670 MB/s
8x FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
17365 MB/s
8x FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
17079 MB/s
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
17035 MB/s
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
16894 MB/s
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
16684 MB/s
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
15668 MB/s
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
14803 MB/s
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
13147 MB/s
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
12775 MB/s
8x Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
12404 MB/s
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
11957 MB/s
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
10653 MB/s
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
10232 MB/s
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
10160 MB/s
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
10102 MB/s
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
9949 MB/s
2x Core i5-650 HT  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
9536 MB/s
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
9521 MB/s
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
8885 MB/s
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
8646 MB/s
8x Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1
7911 MB/s
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
7706 MB/s
4x Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
7114 MB/s
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
7090 MB/s
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
7084 MB/s
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
6736 MB/s
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
5654 MB/s
2x Pentium EE 955 HT  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
5638 MB/s
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
5518 MB/s
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
5461 MB/s
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
4867 MB/s
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
4856 MB/s
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
4716 MB/s
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
4703 MB/s
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
4254 MB/s
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
4218 MB/s
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
4096 MB/s
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
4083 MB/s
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
3803 MB/s
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
3652 MB/s
2x Atom D525 HT  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
3563 MB/s
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
3154 MB/s
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2
2831 MB/s
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12
2797 MB/s
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
2478 MB/s
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
2333 MB/s
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2
2327 MB/s
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12


Memory Copy
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
270129 MB/s
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
104482 MB/s
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
86377 MB/s
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
78900 MB/s
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
71913 MB/s
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
68825 MB/s
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
68557 MB/s
32x Ryzen Threadripper 2990WX HT  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
66492 MB/s
16x Xeon E5-2670 HT  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
66049 MB/s
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
62104 MB/s
10x Core Ultra 5 225T  3700 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
61763 MB/s
16x Core i9-12900K HT  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
54823 MB/s
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
51527 MB/s
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
50548 MB/s
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
47272 MB/s
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
43944 MB/s
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
42971 MB/s
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
42898 MB/s
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
41976 MB/s
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
39374 MB/s
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
38430 MB/s
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
38042 MB/s
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
37456 MB/s
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
37419 MB/s
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
34772 MB/s
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
31136 MB/s
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
30063 MB/s
4x Core i7-7700K HT  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
27101 MB/s
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
24893 MB/s
8x FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
24709 MB/s
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
24331 MB/s
8x FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
23558 MB/s
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
23430 MB/s
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
22688 MB/s
4x Core i7-3770K HT  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
21815 MB/s
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
21592 MB/s
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
21476 MB/s
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
20448 MB/s
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
19382 MB/s
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
18129 MB/s
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
17683 MB/s
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
17343 MB/s
8x Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
17007 MB/s
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
16446 MB/s
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
15924 MB/s
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
15858 MB/s
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
15742 MB/s
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
15513 MB/s
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
14072 MB/s
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
14015 MB/s
2x Core i5-650 HT  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
12439 MB/s
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
12113 MB/s
8x Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1
11477 MB/s
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
11285 MB/s
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
9642 MB/s
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
9482 MB/s
4x Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
8914 MB/s
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
8178 MB/s
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
7739 MB/s
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
7641 MB/s
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
7429 MB/s
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
6278 MB/s
2x Pentium EE 955 HT  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
6186 MB/s
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
5924 MB/s
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
5531 MB/s
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
5517 MB/s
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
5311 MB/s
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
4879 MB/s
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
4782 MB/s
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
4680 MB/s
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
4561 MB/s
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
4215 MB/s
2x Atom D525 HT  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
4199 MB/s
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
4163 MB/s
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
3681 MB/s
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
3269 MB/s
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2
3145 MB/s
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
3051 MB/s
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12
2997 MB/s
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
2986 MB/s
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
2578 MB/s
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2


Memory Latency
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
55.2 ns
Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
57.1 ns
Core i7-3770K  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
58.1 ns
Xeon E3-1245 v3  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
58.1 ns
Core i7-4770  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
58.3 ns
Core i9-10900K  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
58.9 ns
Core i9-11900K  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
59.7 ns
A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
60.4 ns
Core i7-8700K  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
60.9 ns
FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
61.2 ns
Core i7-4930K  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
61.2 ns
FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
62.5 ns
A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
63.1 ns
Core i7-965 Extreme  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
63.5 ns
Core i7-6700K  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
63.5 ns
FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
63.8 ns
Core i7-7700K  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
66.2 ns
Core i7-2600  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
66.5 ns
Core i7-990X Extreme  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
66.5 ns
Ryzen 9 5900X  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
66.7 ns
Ryzen 9 7950X  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
67.1 ns
Ryzen Threadripper Pro 7975WX  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
67.7 ns
Core i7-3960X Extreme  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
67.9 ns
Core i7-5775C  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
69.8 ns
Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
70.3 ns
Xeon X5550  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
70.5 ns
Core i7-6850K  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
71.1 ns
Ryzen Threadripper 2990WX  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
72.5 ns
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
72.5 ns
Core i7-5820K  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
73.4 ns
Ryzen 5 2400G  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
74.0 ns
Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
74.2 ns
Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
75.3 ns
Ryzen 7 2700X  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
75.9 ns
A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
76.6 ns
Core i9-13900K  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
76.7 ns
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2
76.7 ns
Ryzen 9 3950X  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
77.2 ns
Core i9-12900K  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
77.3 ns
Core i7-7800X  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
78.5 ns
Pentium EE 955  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
79.5 ns
Xeon E5-2670  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
79.9 ns
Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
79.9 ns
Ryzen 9 9950X  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
81.0 ns
Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
81.2 ns
Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
82.3 ns
A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
82.5 ns
P4EE  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
83.0 ns
Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
84.0 ns
Xeon E5-2660 v3  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
84.2 ns
Ryzen 7 1800X  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
84.5 ns
Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
86.8 ns
Ryzen Threadripper 3970X  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
88.1 ns
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
88.5 ns
Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
91.0 ns
Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
91.5 ns
Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
92.9 ns
Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
94.6 ns
Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
95.2 ns
Atom D525  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
96.2 ns
A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
99.5 ns
Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
100.0 ns
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
100.4 ns
Core i5-650  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
100.8 ns
Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
101.5 ns
Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
103.9 ns
Core Ultra 5 225T  4100 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
104.0 ns
Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
105.6 ns
Atom 230  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12
109.3 ns
E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
112.5 ns
Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
113.4 ns
Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
114.8 ns
Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
119.9 ns
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
122.1 ns
Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
124.7 ns
Xeon  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
127.8 ns
Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
128.1 ns
Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
128.5 ns
Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
138.7 ns
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2
153.6 ns
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
159.8 ns
Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1


CPU CheckMate
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
26637 MP/s
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
20853 MP/s
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
13755 MP/s
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
10711 MP/s
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
6818 MP/s
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
5482 MP/s
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
5367 MP/s
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
4584 MP/s
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
3788 MP/s
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
3421 MP/s
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
3052 MP/s
10x Core Ultra 5 225T  3600 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
2676 MP/s
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
1802 MP/s
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
1621 MP/s
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
1527 MP/s
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
1458 MP/s
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
1337 MP/s
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
1111 MP/s
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
968 MP/s
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
946 MP/s
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
941 MP/s
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
883 MP/s
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
762 MP/s
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
573 MP/s
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
559 MP/s
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
446 MP/s
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
405 MP/s
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
402 MP/s
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
364 MP/s
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
358 MP/s
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
263 MP/s
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
262 MP/s
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
254 MP/s
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
252 MP/s
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
242 MP/s
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
219 MP/s
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
202 MP/s
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
186 MP/s
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
180 MP/s
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
177 MP/s
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
175 MP/s
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
162 MP/s
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
144 MP/s
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
134 MP/s
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
127 MP/s
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
110 MP/s
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
105 MP/s
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
104 MP/s
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
87 MP/s
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
76 MP/s
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
70 MP/s
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
70 MP/s
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
62 MP/s
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
52 MP/s
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
36 MP/s
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
33 MP/s
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
31 MP/s
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
24 MP/s
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
22 MP/s
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
20 MP/s
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
19 MP/s
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
18 MP/s
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
11 MP/s
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
9.8 MP/s
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12
8.9 MP/s
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2


CPU PhotoWorxx
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
198814 MPixel/s
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
62207 MPixel/s
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
55874 MPixel/s
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
49893 MPixel/s
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
49607 MPixel/s
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
46788 MPixel/s
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
41700 MPixel/s
10x Core Ultra 5 225T  4900 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
39964 MPixel/s
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
39906 MPixel/s
16x Core i9-12900K HT  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
38828 MPixel/s
16x Xeon E5-2670 HT  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
37679 MPixel/s
32x Ryzen Threadripper 2990WX HT  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
35641 MPixel/s
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
30405 MPixel/s
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
26622 MPixel/s
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
26212 MPixel/s
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
24186 MPixel/s
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
23726 MPixel/s
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
23456 MPixel/s
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
23401 MPixel/s
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
23072 MPixel/s
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
22800 MPixel/s
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
20682 MPixel/s
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
20497 MPixel/s
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
20446 MPixel/s
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
20401 MPixel/s
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
19791 MPixel/s
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
19333 MPixel/s
4x Core i7-7700K HT  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
17052 MPixel/s
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
15649 MPixel/s
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
14159 MPixel/s
4x Core i7-3770K HT  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
14075 MPixel/s
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
13992 MPixel/s
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
12969 MPixel/s
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
12418 MPixel/s
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
12359 MPixel/s
8x FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
12350 MPixel/s
8x FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
11889 MPixel/s
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
11702 MPixel/s
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
11118 MPixel/s
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
10676 MPixel/s
8x Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
9632 MPixel/s
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
9060 MPixel/s
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
8831 MPixel/s
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
8819 MPixel/s
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
8653 MPixel/s
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
8565 MPixel/s
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
8073 MPixel/s
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
8064 MPixel/s
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
7751 MPixel/s
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
6982 MPixel/s
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
6876 MPixel/s
2x Core i5-650 HT  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
6111 MPixel/s
8x Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1
5628 MPixel/s
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
5278 MPixel/s
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
4830 MPixel/s
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
4726 MPixel/s
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
4252 MPixel/s
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
4211 MPixel/s
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
3816 MPixel/s
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
3701 MPixel/s
4x Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
3461 MPixel/s
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
3041 MPixel/s
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
2927 MPixel/s
2x Pentium EE 955 HT  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
2838 MPixel/s
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
2790 MPixel/s
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
2537 MPixel/s
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
2146 MPixel/s
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
1998 MPixel/s
2x Atom D525 HT  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
1902 MPixel/s
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
1894 MPixel/s
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
1869 MPixel/s
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
1864 MPixel/s
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
1851 MPixel/s
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
1788 MPixel/s
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
1676 MPixel/s
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
1253 MPixel/s
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2
1220 MPixel/s
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
1102 MPixel/s
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12
1096 MPixel/s
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
878 MPixel/s
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
827 MPixel/s
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2


CPU ZLib
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
4727.2 MB/s
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
3250.5 MB/s
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
2591.7 MB/s
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
2482.3 MB/s
32x Ryzen Threadripper 2990WX HT  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
2428.4 MB/s
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
2340.5 MB/s
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
1655.2 MB/s
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
1592.6 MB/s
16x Core i9-12900K HT  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
1302.4 MB/s
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
1251.0 MB/s
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
1074.8 MB/s
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
977.6 MB/s
16x Xeon E5-2670 HT  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
935.6 MB/s
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
745.5 MB/s
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
695.3 MB/s
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
673.4 MB/s
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
653.2 MB/s
10x Core Ultra 5 225T  4100 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
570.5 MB/s
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
521.8 MB/s
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
493.2 MB/s
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
454.4 MB/s
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
437.8 MB/s
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
431.7 MB/s
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
415.9 MB/s
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
408.8 MB/s
4x Core i7-7700K HT  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
367.0 MB/s
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
359.9 MB/s
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
357.7 MB/s
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
356.6 MB/s
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
351.5 MB/s
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
345.2 MB/s
8x FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
324.7 MB/s
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
316.1 MB/s
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
313.7 MB/s
4x Core i7-3770K HT  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
307.6 MB/s
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
290.0 MB/s
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
282.0 MB/s
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
275.1 MB/s
8x FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
256.8 MB/s
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
243.7 MB/s
8x Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
225.3 MB/s
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
210.0 MB/s
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
189.5 MB/s
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
189.2 MB/s
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
186.2 MB/s
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
185.4 MB/s
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
176.6 MB/s
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
173.8 MB/s
8x Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1
172.3 MB/s
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
154.7 MB/s
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
153.3 MB/s
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
152.0 MB/s
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
136.2 MB/s
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
127.9 MB/s
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
117.8 MB/s
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
112.6 MB/s
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
108.5 MB/s
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
105.3 MB/s
2x Core i5-650 HT  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
99.0 MB/s
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
97.6 MB/s
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
95.5 MB/s
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
84.1 MB/s
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
82.8 MB/s
4x Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
75.0 MB/s
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
73.7 MB/s
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
60.0 MB/s
2x Pentium EE 955 HT  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
58.1 MB/s
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
57.5 MB/s
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
41.7 MB/s
2x Atom D525 HT  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
41.3 MB/s
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
33.4 MB/s
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
33.0 MB/s
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
32.8 MB/s
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
31.5 MB/s
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
24.0 MB/s
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
22.9 MB/s
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
20.3 MB/s
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
18.6 MB/s
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12
17.4 MB/s
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
16.4 MB/s
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2
15.3 MB/s
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2


CPU AES
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
718615 MB/s
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
710297 MB/s
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
379767 MB/s
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
286949 MB/s
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
283070 MB/s
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
222804 MB/s
32x Ryzen Threadripper 2990WX HT  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
207691 MB/s
16x Core i9-12900K HT  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
205628 MB/s
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
172201 MB/s
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
146639 MB/s
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
89257 MB/s
10x Core Ultra 5 225T  3400 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
70021 MB/s
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
65840 MB/s
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
62756 MB/s
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
55796 MB/s
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
46884 MB/s
16x Xeon E5-2670 HT  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
38015 MB/s
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
32722 MB/s
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
29351 MB/s
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
27362 MB/s
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
25199 MB/s
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
23199 MB/s
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
21098 MB/s
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
21093 MB/s
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
20676 MB/s
4x Core i7-7700K HT  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
18233 MB/s
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
17941 MB/s
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
17292 MB/s
8x FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
16802 MB/s
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
16357 MB/s
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
16332 MB/s
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
15377 MB/s
8x FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
14455 MB/s
4x Core i7-3770K HT  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
13712 MB/s
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
12249 MB/s
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
10318 MB/s
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
9817 MB/s
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
9199 MB/s
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
9012 MB/s
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
8643 MB/s
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
8557 MB/s
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
6550 MB/s
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
4926 MB/s
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
4052 MB/s
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
3781 MB/s
2x Core i5-650 HT  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
2908 MB/s
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
1930 MB/s
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
1621 MB/s
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
1452 MB/s
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2
1332 MB/s
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
1286 MB/s
8x Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
1212 MB/s
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
1153 MB/s
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
914 MB/s
8x Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1
802 MB/s
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
790 MB/s
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
789 MB/s
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
721 MB/s
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
651 MB/s
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
587 MB/s
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
566 MB/s
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
524 MB/s
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
493 MB/s
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
473 MB/s
4x Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
421 MB/s
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
387 MB/s
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
311 MB/s
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
277 MB/s
2x Pentium EE 955 HT  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
269 MB/s
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
244 MB/s
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
242 MB/s
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
152 MB/s
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
148 MB/s
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
144 MB/s
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
131 MB/s
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
108 MB/s
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
105 MB/s
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2
99 MB/s
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
99 MB/s
2x Atom D525 HT  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
85 MB/s
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
44 MB/s
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12


CPU SHA3
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
21513 MB/s
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
11077 MB/s
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
10763 MB/s
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
10063 MB/s
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
8320 MB/s
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
7279 MB/s
32x Ryzen Threadripper 2990WX HT  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
6040 MB/s
16x Core i9-12900K HT  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
5627 MB/s
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
5164 MB/s
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
5111 MB/s
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
5074 MB/s
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
5062 MB/s
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
3472 MB/s
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
3107 MB/s
10x Core Ultra 5 225T  3400 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
2667 MB/s
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
2665 MB/s
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
2524 MB/s
16x Xeon E5-2670 HT  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
2203 MB/s
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
2065 MB/s
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
2023 MB/s
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
1885 MB/s
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
1868 MB/s
4x Core i7-7700K HT  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
1652 MB/s
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
1367 MB/s
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
1331 MB/s
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
1329 MB/s
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
1314 MB/s
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
1180 MB/s
8x FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
1178 MB/s
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
1136 MB/s
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
1076 MB/s
8x FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
1037 MB/s
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
1031 MB/s
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
1012 MB/s
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
912 MB/s
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
876 MB/s
8x Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
845 MB/s
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
834 MB/s
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
796 MB/s
4x Core i7-3770K HT  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
758 MB/s
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
738 MB/s
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
726 MB/s
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
684 MB/s
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
626 MB/s
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
625 MB/s
8x Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1
586 MB/s
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
582 MB/s
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
555 MB/s
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
547 MB/s
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
532 MB/s
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
524 MB/s
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
523 MB/s
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
488 MB/s
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
428 MB/s
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
418 MB/s
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
401 MB/s
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
386 MB/s
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
329 MB/s
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
327 MB/s
4x Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
291 MB/s
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
272 MB/s
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
269 MB/s
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
260 MB/s
2x Core i5-650 HT  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
243 MB/s
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
214 MB/s
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
208 MB/s
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
205 MB/s
2x Pentium EE 955 HT  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
200 MB/s
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
146 MB/s
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
110 MB/s
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
107 MB/s
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
106 MB/s
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
105 MB/s
2x Atom D525 HT  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
99 MB/s
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
96 MB/s
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
90 MB/s
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
73 MB/s
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
72 MB/s
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2
65 MB/s
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
51 MB/s
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2
47 MB/s
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12


FPU Julia
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
404307
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
363725
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
302434
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
253491
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
160591
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
150176
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
148544
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
137260
32x Ryzen Threadripper 2990WX HT  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
133033
16x Core i9-12900K HT  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
111030
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
103870
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
78707
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
78361
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
73505
10x Core Ultra 5 225T  3900 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
62489
16x Xeon E5-2670 HT  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
54731
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
40797
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
40349
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
38538
4x Core i7-7700K HT  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
38478
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
36088
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
34023
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
30183
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
28493
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
27638
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
26930
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
26830
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
24768
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
19514
4x Core i7-3770K HT  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
19092
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
18514
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
18312
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
18001
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
17670
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
15945
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
15289
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
13498
8x FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
12632
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
12205
8x Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
11912
8x FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
11124
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
8955
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
8745
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
8686
8x Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1
8213
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
8070
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
7959
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
7607
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
7437
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
7077
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
6986
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
6583
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
6409
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
6231
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
6180
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
5653
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
5597
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
5579
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
5577
2x Core i5-650 HT  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
5233
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
4062
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
3533
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
3492
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
3078
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
2443
2x Pentium EE 955 HT  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
2384
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
2308
4x Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
2053
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
1988
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
1865
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
1333
2x Atom D525 HT  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
1307
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
1116
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
958
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
912
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
892
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
794
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2
701
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
640
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
589
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12
513
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2


FPU Mandel
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
205460
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
160699
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
156652
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
131979
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
83472
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
80861
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
79344
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
70345
32x Ryzen Threadripper 2990WX HT  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
68656
16x Core i9-12900K HT  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
53728
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
53584
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
48665
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
40325
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
35373
10x Core Ultra 5 225T  3000 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
32939
16x Xeon E5-2670 HT  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
29444
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
21688
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
21334
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
20739
4x Core i7-7700K HT  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
20161
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
19155
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
18302
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
15403
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
15096
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
14853
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
14424
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
14255
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
12530
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
10344
4x Core i7-3770K HT  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
10019
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
9811
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
9319
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
8673
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
8614
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
8066
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
7276
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
6913
8x FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
6435
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
6212
8x Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
6096
8x FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
5395
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
4624
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
4421
8x Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1
4333
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
4179
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
4071
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
3972
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
3874
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
3642
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
3527
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
3357
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
3313
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
3229
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
3178
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
3066
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
2980
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
2890
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
2841
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
2675
2x Core i5-650 HT  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
2335
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
1823
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
1624
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
1482
2x Pentium EE 955 HT  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
1449
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
1384
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
1191
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
1182
4x Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
1062
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
1051
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
855
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
794
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
494
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
476
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
438
2x Atom D525 HT  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
426
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
406
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2
402
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
359
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
328
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
263
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2
193
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12


FPU SinJulia
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
62314
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
55953
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
46565
32x Ryzen Threadripper 2990WX HT  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
34679
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
33218
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
28757
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
19891
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
19124
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
18481
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
16033
16x Xeon E5-2670 HT  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
14720
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
14698
16x Core i9-12900K HT  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
13534
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
12662
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
11160
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
7752
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
7470
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
7273
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
7233
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
7215
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
7114
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
6993
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
6822
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
6500
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
6323
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
5461
4x Core i7-7700K HT  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
5213
10x Core Ultra 5 225T  4100 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
4978
4x Core i7-3770K HT  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
4825
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
4713
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
4688
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
4658
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
4617
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
4587
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
4583
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
4137
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
3542
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
3213
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
3100
8x Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
2831
8x FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
2642
8x FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
2589
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
2304
2x Core i5-650 HT  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
2266
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
2221
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
2210
8x Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1
2042
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
1934
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
1871
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
1855
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
1737
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
1618
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
1574
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
1478
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
1478
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
1420
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
1376
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
1257
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
1178
4x Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
1170
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
1049
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
1021
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
974
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
959
2x Pentium EE 955 HT  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
948
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
942
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
834
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
811
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
516
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
505
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
463
2x Atom D525 HT  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
452
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
359
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
327
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
284
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
277
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
262
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
262
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2
205
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12
202
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
131
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2


FP32 Ray-Trace
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
124679 KRay/s
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
82609 KRay/s
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
62174 KRay/s
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
57124 KRay/s
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
34131 KRay/s
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
28225 KRay/s
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
28059 KRay/s
16x Core i9-12900K HT  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
26187 KRay/s
32x Ryzen Threadripper 2990WX HT  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
23594 KRay/s
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
20336 KRay/s
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
19740 KRay/s
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
18704 KRay/s
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
17934 KRay/s
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
15026 KRay/s
10x Core Ultra 5 225T  2800 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
11759 KRay/s
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
11356 KRay/s
16x Xeon E5-2670 HT  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
8402 KRay/s
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
8266 KRay/s
4x Core i7-7700K HT  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
7485 KRay/s
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
7451 KRay/s
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
7302 KRay/s
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
7257 KRay/s
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
6002 KRay/s
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
5196 KRay/s
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
5055 KRay/s
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
4854 KRay/s
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
4847 KRay/s
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
4818 KRay/s
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
3774 KRay/s
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
3562 KRay/s
4x Core i7-3770K HT  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
3374 KRay/s
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
2867 KRay/s
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
2654 KRay/s
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
2599 KRay/s
8x FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
2559 KRay/s
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
2556 KRay/s
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
2541 KRay/s
8x FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
2180 KRay/s
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
1982 KRay/s
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
1911 KRay/s
8x Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
1645 KRay/s
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
1630 KRay/s
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
1552 KRay/s
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
1405 KRay/s
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
1383 KRay/s
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
1316 KRay/s
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
1283 KRay/s
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
1215 KRay/s
8x Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1
1212 KRay/s
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
1174 KRay/s
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
1161 KRay/s
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
1129 KRay/s
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
1104 KRay/s
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
979 KRay/s
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
977 KRay/s
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
852 KRay/s
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
801 KRay/s
2x Core i5-650 HT  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
788 KRay/s
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
785 KRay/s
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
772 KRay/s
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
572 KRay/s
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
527 KRay/s
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
524 KRay/s
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
450 KRay/s
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
370 KRay/s
2x Pentium EE 955 HT  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
354 KRay/s
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
319 KRay/s
4x Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
299 KRay/s
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
272 KRay/s
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
268 KRay/s
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
213 KRay/s
2x Atom D525 HT  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
203 KRay/s
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
165 KRay/s
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
144 KRay/s
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
130 KRay/s
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
123 KRay/s
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
117 KRay/s
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2
105 KRay/s
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
95 KRay/s
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12
92 KRay/s
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
70 KRay/s
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2


FP64 Ray-Trace
 
CPU  CPU Clock  Motherboard  Chipset  Memory  CL-RCD-RP-RAS
68484 KRay/s
32x Ryzen Threadripper Pro 7975WX HT  4000 MHz  Asus Pro WS WRX90E-Sage SE  WRX90  Octal DDR5-6400  32-38-38-36 CR1
43605 KRay/s
16x Ryzen 9 9950X HT  4300 MHz  Asus ROG Crosshair X870E Hero  X870E Int.  Dual DDR5-6400  32-39-39-80 CR1
33025 KRay/s
16x Ryzen 9 7950X HT  4500 MHz  MSI X670E Gaming Plus WiFi  X670E Int.  Dual DDR5-6000  36-38-38-80 CR1
31678 KRay/s
32x Ryzen Threadripper 3970X HT  3800 MHz  Gigabyte TRX40 Aorus Xtreme  TRX40  Quad DDR4-3200  16-18-18-36 CR1
18512 KRay/s
24x Core i9-13900K HT  3000 MHz  Asus ROG Maximus Z790 Extreme  Z790 Int.  Dual DDR5-5600  40-40-40-80 CR2
15402 KRay/s
16x Ryzen 9 3950X HT  3500 MHz  Gigabyte X570 Aorus Elite  X570  Dual DDR4-3200  18-21-21-39 CR1
15375 KRay/s
16x Core i9-12900K HT  3200 MHz  Asus ROG Maximus Z690 Extreme  Z690 Int.  Dual DDR5-4800  40-39-39-76 CR2
13224 KRay/s
32x Ryzen Threadripper 2990WX HT  3000 MHz  MSI MEG X399 Creation  X399  Quad DDR4-2933  16-18-18-38 CR1
12596 KRay/s
12x Ryzen 9 5900X HT  3700 MHz  Asus Prime B550M-K  B550  Dual DDR4-3200  22-22-22-52 CR1
11114 KRay/s
10x Core i9-10900K HT  3700 MHz  Gigabyte Z490 Aorus Elite AC  Z490 Int.  Dual DDR4-2933  21-21-21-47 CR2
10887 KRay/s
8x Core i9-11900K HT  3500 MHz  Gigabyte Z590 Aorus Master  Z590 Int.  Dual DDR4-3200  22-22-22-52 CR2
10043 KRay/s
20x Xeon E5-2660 v3 HT  2600 MHz  Supermicro X10DRi  C612  Octal DDR4-1866R  13-13-13-31 CR1
10034 KRay/s
6x Core i7-7800X HT  3500 MHz  Asus Prime X299-A  X299  Quad DDR4-2667  16-18-18-38 CR2
7100 KRay/s
10x Core Ultra 5 225T  2900 MHz  HP ProDesk 4 Mini G1i Desktop AI PC  Q870 Int.  Dual DDR5-5600  46-45-45-90 CR2
6318 KRay/s
6x Core i7-8700K HT  3700 MHz  Gigabyte Z370 Aorus Gaming 7  Z370 Int.  Dual DDR4-2667  16-18-18-38 CR2
5969 KRay/s
16x Xeon E5-2670 HT  2600 MHz  Supermicro X9DR6-F  C600  Octal DDR3-1333  9-9-9-24 CR1
4528 KRay/s
4x Core i7-7700K HT  4200 MHz  ASRock Z270 Extreme4  Z270 Ext.  Dual DDR4-2133  15-15-15-36 CR2
4194 KRay/s
8x Ryzen 7 2700X HT  3700 MHz  Asus ROG Crosshair VII Hero  X470  Dual DDR4-2933  16-20-21-49 CR1
4132 KRay/s
6x Core i7-6850K HT  3600 MHz  Asus Strix X99 Gaming  X99  Quad DDR4-2400  16-16-16-39 CR2
4048 KRay/s
6x Core i7-5820K HT  3300 MHz  Gigabyte GA-X99-UD4  X99  Quad DDR4-2133  15-15-15-36 CR2
4000 KRay/s
8x Ryzen 7 1800X HT  3600 MHz  Asus Crosshair VI Hero  X370  Dual DDR4-2667  16-17-17-35 CR1
3964 KRay/s
4x Core i7-6700K HT  4000 MHz  Gigabyte GA-Z170X-UD3  Z170 Int.  Dual DDR4-2133  14-14-14-35 CR2
3256 KRay/s
32x Opteron 6274  2200 MHz  Supermicro H8DGI-F  SR5690  Octal DDR3-1600R  11-11-11-28 CR1
2806 KRay/s
6x Core i7-4930K HT  3400 MHz  Gigabyte GA-X79-UD3  X79  Quad DDR3-1866  9-10-9-27 CR2
2763 KRay/s
4x Core i7-4770 HT  3400 MHz  Intel DZ87KLT-75K  Z87 Int.  Dual DDR3-1600  9-9-9-27 CR2
2692 KRay/s
4x Xeon E3-1245 v3 HT  3400 MHz  Supermicro X10SAE  C226 Int.  Dual DDR3-1600  11-11-11-28 CR1
2638 KRay/s
6x Core i7-3960X Extreme HT  3300 MHz  Intel DX79SI  X79  Quad DDR3-1600  9-9-9-24 CR2
2599 KRay/s
4x Core i7-5775C HT  3300 MHz  Gigabyte GA-Z97MX-Gaming 5  Z97 Int.  Dual DDR3-1600  11-11-11-28 CR1
1978 KRay/s
4x Ryzen 5 2400G HT  3600 MHz  ASRock A320M Pro4  A320  Dual DDR4-2933  16-15-15-35 CR1
1918 KRay/s
4x Core i7-3770K HT  3500 MHz  MSI Z77A-GD55  Z77 Int.  Dual DDR3-1600  9-9-9-24 CR2
1822 KRay/s
4x Core i7-2600 HT  3400 MHz  Asus P8P67  P67  Dual DDR3-1333  9-9-9-24 CR1
1559 KRay/s
12x Opteron 2431  2400 MHz  Supermicro H8DI3+-F  SR5690  Unganged Quad DDR2-800R  6-6-6-18 CR1
1457 KRay/s
6x Core i7-990X Extreme HT  3466 MHz  Intel DX58SO2  X58  Triple DDR3-1333  9-9-9-24 CR1
1388 KRay/s
8x FX-8350  4000 MHz  Asus M5A99X Evo R2.0  AMD990X  Dual DDR3-1866  9-10-9-27 CR2
1380 KRay/s
8x Xeon X5550 HT  2666 MHz  Supermicro X8DTN+  i5520  Hexa DDR3-1333  9-9-9-24 CR1
1367 KRay/s
16x Atom C3958  2000 MHz  Supermicro A2SDi-H-TP4F  Denverton  Dual DDR4-2400  17-17-17-39
1313 KRay/s
8x FX-8150  3600 MHz  Asus M5A97  AMD970  Dual DDR3-1866  9-10-9-27 CR2
1158 KRay/s
8x Xeon E5462  2800 MHz  Intel S5400SF  i5400  Quad DDR2-640FB  5-5-5-15
1039 KRay/s
8x Opteron 2378  2400 MHz  Tyan Thunder n3600R  nForcePro-3600  Unganged Quad DDR2-800R  6-6-6-18 CR1
1037 KRay/s
6x Phenom II X6 Black 1100T  3300 MHz  Gigabyte GA-890GPA-UD3H v2  AMD890GX Int.  Unganged Dual DDR3-1333  9-9-9-24 CR2
900 KRay/s
4x Core i7-965 Extreme HT  3200 MHz  Asus P6T Deluxe  X58  Triple DDR3-1333  9-9-9-24 CR1
875 KRay/s
6x FX-6100  3300 MHz  Asus Sabertooth 990FX  AMD990FX  Dual DDR3-1866  9-10-9-27 CR2
854 KRay/s
4x A12-9800  3800 MHz  Gigabyte GA-AB350M-Gaming 3  B350 Int.  Dual DDR4-2400  14-16-16-31 CR1
757 KRay/s
4x A10-6800K  4100 MHz  Gigabyte GA-F2A85X-UP4  A85X Int.  Dual DDR3-2133  9-11-10-27 CR2
740 KRay/s
4x A10-7850K  3700 MHz  Gigabyte GA-F2A88XM-D3H  A88X Int.  Dual DDR3-2133  9-11-10-31 CR2
731 KRay/s
8x Xeon L5320  1866 MHz  Intel S5000VCL  i5000V  Dual DDR2-533FB  4-4-4-12
697 KRay/s
4x A10-5800K  3800 MHz  Asus F2A55-M  A55 Int.  Dual DDR3-1866  9-10-9-27 CR2
669 KRay/s
8x Opteron 2344 HE  1700 MHz  Supermicro H8DME-2  nForcePro-3600  Unganged Quad DDR2-667R  5-5-5-15 CR1
625 KRay/s
4x Phenom II X4 Black 940  3000 MHz  Asus M3N78-EM  GeForce8300 Int.  Ganged Dual DDR2-800  5-5-5-18 CR2
624 KRay/s
4x A8-3850  2900 MHz  Gigabyte GA-A75M-UD2H  A75 Int.  Dual DDR3-1333  9-9-9-24 CR1
623 KRay/s
4x Xeon X3430  2400 MHz  Supermicro X8SIL-F  i3420  Dual DDR3-1333  9-9-9-24 CR1
615 KRay/s
4x Core 2 Extreme QX9650  3000 MHz  Gigabyte GA-EP35C-DS3R  P35  Dual DDR3-1066  8-8-8-20 CR2
542 KRay/s
4x Core 2 Extreme QX6700  2666 MHz  Intel D975XBX2  i975X  Dual DDR2-667  5-5-5-15
541 KRay/s
4x Celeron J4105  1500 MHz  ASRock J4105-ITX  GeminiLakeD Int.  Dual DDR4-2400  17-17-17-39
475 KRay/s
4x Xeon 5140  2333 MHz  Intel S5000VSA  i5000V  Dual DDR2-667FB  5-5-5-15
458 KRay/s
8x Atom C2750  2400 MHz  Supermicro A1SAi-2750F  Avoton  Dual DDR3-1600  11-11-11-28 CR1
451 KRay/s
4x Phenom X4 9500  2200 MHz  Asus M3A  AMD770  Ganged Dual DDR2-800  5-5-5-18 CR2
443 KRay/s
2x Core i5-650 HT  3200 MHz  Supermicro C7SIM-Q  Q57 Int.  Dual DDR3-1333  9-9-9-24 CR1
433 KRay/s
4x Athlon 5350  2050 MHz  ASRock AM1B-ITX  Yangtze Int.  DDR3-1600 SDRAM  11-11-11-28 CR2
428 KRay/s
4x Celeron J3455  1500 MHz  ASRock J3455B-ITX  ApolloLakeD Int.  Dual DDR3-1866  11-11-11-32 CR1
293 KRay/s
2x Core 2 Extreme X6800  2933 MHz  Abit AB9  P965  Dual DDR2-800  5-5-5-18 CR2
236 KRay/s
2x Core 2 Duo P8400  2266 MHz  MSI MegaBook PR201  GM45 Int.  Dual DDR2-667  5-5-5-15
211 KRay/s
4x Celeron J1900  2000 MHz  Gigabyte GA-J1900N-D3V  BayTrailD Int.  Dual DDR3-1333  9-9-9-24 CR1
205 KRay/s
2x Pentium EE 955 HT  3466 MHz  Intel D955XBK  i955X  Dual DDR2-667  4-4-4-11
197 KRay/s
2x Xeon HT  3400 MHz  Intel SE7320SP2  iE7320  Dual DDR333R  2.5-3-3-7
193 KRay/s
4x Opteron 2210 HE  1800 MHz  Tyan Thunder h2000M  BCM5785  Quad DDR2-600R  5-5-5-15 CR1
185 KRay/s
4x Celeron N3150  1600 MHz  ASRock N3150B-ITX  Braswell Int.  Dual DDR3-1600  11-11-11-28 CR2
176 KRay/s
2x Athlon64 X2 Black 6400+  3200 MHz  MSI K9N SLI Platinum  nForce570SLI  Dual DDR2-800  4-4-4-11 CR1
138 KRay/s
2x Pentium D 820  2800 MHz  Abit Fatal1ty F-I90HD  RS600 Int.  Dual DDR2-800  5-5-5-18 CR2
120 KRay/s
Nano X2 L4350  1600 MHz  VIA EPIA-M900  VX900H Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
109 KRay/s
P4EE HT  3733 MHz  Intel SE7230NH1LX  iE7230  Dual DDR2-667  5-5-5-15
79 KRay/s
2x E-350  1600 MHz  ASRock E350M1  A50M Int.  DDR3-1066 SDRAM  8-8-8-20 CR1
75 KRay/s
Celeron 420  1600 MHz  Intel DQ965GF  Q965 Int.  Dual DDR2-667  5-5-5-15
64 KRay/s
2x Atom D525 HT  1800 MHz  Gigabyte GA-D525TUD  NM10 Int.  DDR3-800 SDRAM  6-6-6-15 CR2
62 KRay/s
Celeron D 326  2533 MHz  ASRock 775Twins-HDTV  RC410 Ext.  DDR2-533 SDRAM  4-4-4-11 CR2
59 KRay/s
Opteron 248  2200 MHz  MSI K8T Master1-FAR  K8T800  Dual DDR266R  2-3-3-6 CR1
56 KRay/s
Nano L2200  1600 MHz  VIA VB8001  CN896 Int.  DDR2-667 SDRAM  5-5-5-15 CR2
54 KRay/s
Athlon64 3200+  2000 MHz  ASRock 939S56-M  SiS756  Dual DDR400  2.5-3-3-8 CR2
46 KRay/s
2x Atom D2500  1866 MHz  Intel D2500CC  NM10 Int.  DDR3-1066 SDRAM  7-7-7-20 CR2
43 KRay/s
Sempron 2600+  1600 MHz  ASRock K8NF4G-SATA2  GeForce6100 Int.  DDR400 SDRAM  2.5-3-3-8 CR2
28 KRay/s
Atom 230 HT  1600 MHz  Intel D945GCLF  i945GC Int.  DDR2-533 SDRAM  4-4-4-12


Debug - PCI
 
B00 D00 F00:  Intel Arrow Lake-S 6+4 - Host Controller
  
Offset 000:  86 80 35 7D 06 00 90 00 01 00 00 06 00 00 00 00
Offset 010:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 E0 00 00 00 00 00 00 00 00 00 00 00
Offset 040:  00 00 00 00 00 00 00 00 01 00 DC FE 00 00 00 00
Offset 050:  C1 04 00 00 91 08 02 00 01 00 00 00 01 00 00 00
Offset 060:  01 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  08 02 00 01 00 04 00 00 00 00 00 00 88 06 44 23
Offset 080:  30 33 33 33 33 33 33 10 00 00 00 00 00 00 00 00
Offset 090:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0A0:  01 00 00 00 08 00 00 00 01 00 00 70 08 00 00 00
Offset 0B0:  01 00 80 80 01 00 00 80 01 00 00 7C 01 00 00 90
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  1A 02 00 01 00 04 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  09 00 14 01 10 21 00 02 00 00 00 81 00 00 00 00
Offset 0F0:  00 02 07 00 00 00 00 00 00 00 00 00 00 00 00 00
 
B00 D01 F00:  Intel Meteor Lake-H/U / Arrow Lake - PCI Express Root Port 12
  
Offset 000:  86 80 CC 7E 06 05 10 00 10 00 04 06 00 00 81 00
Offset 010:  00 00 00 00 00 00 00 00 00 01 01 00 F0 00 00 00
Offset 020:  00 90 00 90 F1 FF 01 00 00 00 00 00 00 00 00 00
Offset 030:  00 00 00 00 40 00 00 00 00 00 00 00 00 01 02 00
Offset 040:  10 80 42 01 01 80 00 00 2F 00 10 00 44 6C 73 0C
Offset 050:  42 00 44 70 00 FD 24 00 00 00 40 01 08 00 00 00
Offset 060:  00 00 00 00 F7 0B B1 00 20 04 00 00 1E 00 80 01
Offset 070:  04 00 1F 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  05 98 81 00 38 01 E0 FE 00 00 00 00 00 00 00 00
Offset 090:  00 00 00 00 00 00 00 00 0D A0 00 00 3C 10 17 8D
Offset 0A0:  01 00 03 C8 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  77 80 00 0E 42 18 00 00 48 40 3F 09 00 00 00 00
Offset 0E0:  00 77 B1 00 46 88 46 88 14 80 83 00 00 20 00 00
Offset 0F0:  70 07 00 00 00 03 00 50 00 0F 10 00 00 40 03 01
 
B00 D02 F00:  Intel Arrow Lake-HX/S - Integrated Graphics Controller
  
Offset 000:  86 80 67 7D 06 00 10 00 06 00 00 03 00 00 00 00
Offset 010:  0C 00 00 18 A0 00 00 00 0C 00 00 00 A0 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 40 00 00 00 00 00 00 00 FF 00 00 00
Offset 040:  09 70 0C 01 0B 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  C0 04 00 00 00 00 00 00 20 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  10 AC 92 00 20 80 00 10 10 09 00 00 11 0C 40 00
Offset 080:  00 00 11 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 090:  00 00 00 00 12 08 13 00 00 00 00 00 02 00 00 00
Offset 0A0:  00 00 00 00 00 00 00 00 00 00 00 00 05 D0 80 01
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  01 00 03 48 08 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  47 09 40 88 00 00 00 00 00 00 00 00 18 D0 E9 71
 
B00 D04 F00:  Intel Arrow Lake - Dynamic Tuning Technology (DTT)
  
Offset 000:  86 80 03 AD 00 00 90 00 01 00 80 11 00 00 00 00
Offset 010:  04 00 04 19 A0 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 90 00 00 00 00 00 00 00 FF 01 00 00
Offset 040:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  00 00 00 00 91 4C 02 00 00 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 090:  05 D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  01 E0 03 00 08 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  09 00 0C 01 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
B00 D0A F00:  Intel Arrow Lake - Crash Log & Telemetry
  
Offset 000:  86 80 0D AD 00 00 10 00 01 00 80 11 00 00 00 00
Offset 010:  04 00 00 19 A0 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00
Offset 040:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  10 D0 92 00 E0 0F 00 00 00 00 00 00 00 00 00 00
Offset 080:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 090:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  01 00 03 00 08 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
B00 D0B F00:  Intel Arrow Lake - VPU
  
Offset 000:  86 80 1D AD 00 00 10 00 01 00 00 12 00 00 00 00
Offset 010:  04 00 00 10 A0 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  04 50 07 19 A0 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 80 00 00 00 00 00 00 00 FF 00 00 00
Offset 040:  10 00 92 00 C0 8F 00 10 00 00 00 00 00 00 00 00
Offset 050:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  01 90 03 00 08 00 00 00 00 00 00 00 00 00 00 00
Offset 090:  09 D0 14 F0 10 00 40 01 00 00 00 00 61 00 00 00
Offset 0A0:  00 00 0E 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  05 40 80 01 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
B00 D0D F00:  Intel Meteor Lake-H/U / Arrow Lake - USB xHCI Host Controller
  
Offset 000:  86 80 C0 7E 00 04 90 02 02 30 03 0C 00 00 80 00
Offset 010:  04 00 FF BF FF 03 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00
Offset 040:  FD 01 34 C0 88 CA 3F 80 00 00 00 00 00 00 00 00
Offset 050:  3F 6D DF 0F 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  32 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  01 80 C3 C1 0B 01 00 00 00 00 00 00 00 00 00 00
Offset 080:  05 90 86 00 38 03 E0 FE 00 00 00 00 00 00 00 00
Offset 090:  09 B0 14 F0 10 00 40 01 00 00 00 00 C1 0A 08 00
Offset 0A0:  00 08 0E 00 00 18 00 00 8F 50 02 00 00 01 00 00
Offset 0B0:  09 00 00 01 86 80 C0 00 09 00 80 0D 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 0F 00 00 12 00 00 00
 
B00 D14 F00:  Intel Arrow Lake SoC - Shared SRAM
  
Offset 000:  86 80 7F AE 06 00 10 00 10 00 00 05 00 00 00 00
Offset 010:  04 00 07 19 A0 00 00 00 04 40 07 19 A0 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 80 00 00 00 00 00 00 00 FF 00 00 00
Offset 040:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  01 00 03 00 08 00 00 00 00 00 00 00 00 00 00 00
Offset 090:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00
 
B00 D1F F00:  Intel Arrow Point PCH - Direct eSPI Controller
  
Offset 000:  86 80 0D AE 07 04 00 00 10 00 01 06 00 00 80 00
Offset 010:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 040:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  00 00 08 7F 01 09 FC 00 01 0A FC 00 01 02 3C 00
Offset 090:  81 00 0C 00 10 24 00 00 01 00 50 FE 00 00 00 00
Offset 0A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  00 00 00 00 00 00 00 00 CF FF 00 80 A6 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00
 
B00 D1F F05:  Intel Arrow Point PCH - SPI (Flash) Controller
  
Offset 000:  86 80 23 AE 02 04 00 00 10 00 80 0C 00 00 00 00
Offset 010:  00 00 01 FE 00 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 040:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 090:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 81 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  00 00 00 00 00 00 00 00 CF FF 00 80 AA 08 00 19
Offset 0E0:  00 00 00 F8 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00
 
B01 D00 F00:  Standard NVM Express Controller [2646-502E] [NoDB]
  
Offset 000:  46 26 2E 50 06 04 10 00 01 02 08 01 00 00 00 00
Offset 010:  04 00 00 90 00 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 46 26 2E 50
Offset 030:  00 00 00 00 80 00 00 00 00 00 00 00 00 01 00 00
Offset 040:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  10 D0 02 00 E2 8F E8 17 37 20 00 00 44 F8 43 01
Offset 090:  42 00 44 10 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0A0:  00 00 00 00 1F 08 11 00 00 04 00 00 1E 00 80 01
Offset 0B0:  04 00 1E 01 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  11 E0 20 80 00 20 00 00 00 30 00 00 00 00 00 00
Offset 0E0:  05 F8 8A 01 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 01 00 03 00 08 00 00 00
 
B80 D14 F00:  Intel Arrow Point PCH - USB 3.2 Gen 2x2 (20 Gb/s) xHCI Host Controller
  
Offset 000:  86 80 6E 7F 06 04 90 02 10 30 03 0C 00 00 80 00
Offset 010:  04 00 20 00 80 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 70 00 00 00 00 00 00 00 00 01 00 00
Offset 040:  FD 01 34 C0 89 C2 7F 80 00 00 00 00 00 00 00 00
Offset 050:  3F 6D DE 0F 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  32 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  01 80 C3 C1 08 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  05 90 87 00 D8 02 E0 FE 00 00 00 00 00 00 00 00
Offset 090:  09 B0 14 F0 10 00 40 01 00 00 00 00 C1 0A 08 00
Offset 0A0:  00 08 0E 00 00 18 00 00 8F 50 02 00 00 01 00 00
Offset 0B0:  09 00 00 01 86 80 C0 00 09 00 10 14 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 0F 10 00 12 00 00 00
 
B80 D14 F03:  Intel Arrow Point PCH - CNVi: WiFi Controller
  
Offset 000:  86 80 70 7F 00 00 10 00 10 00 80 02 00 00 80 00
Offset 010:  04 40 21 00 80 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 86 80 94 00
Offset 030:  00 00 00 00 C8 00 00 00 00 00 00 00 FF 03 00 00
Offset 040:  10 80 92 00 C0 0E 00 10 10 0C 10 00 00 00 00 00
Offset 050:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 12 08 08 00 05 04 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  11 00 0F 00 00 20 00 00 00 30 00 00 00 00 00 00
Offset 090:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 01 D0 23 C8 08 00 00 0D
Offset 0D0:  05 40 80 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
B80 D14 F05:  Intel Arrow Point PCH - Error Aggregation Handler (EAH)
  
Offset 000:  86 80 2F 7F 00 00 10 00 10 00 00 00 00 00 00 00
Offset 010:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00
Offset 040:  10 00 92 00 01 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  1A 00 20 01 00 04 00 00 1F 00 20 01 00 04 00 00
Offset 070:  1F 00 20 01 00 04 00 00 00 00 00 00 00 00 00 00
Offset 080:  1A 00 20 01 00 04 00 00 1E 00 20 01 00 04 00 00
Offset 090:  1E 00 20 01 00 04 00 00 00 00 00 00 00 00 00 00
Offset 0A0:  1E 00 20 01 00 04 00 00 1E 00 20 01 00 04 00 00
Offset 0B0:  1E 00 20 01 00 04 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 80 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00
 
B80 D16 F00:  Intel Arrow Point PCH - CSME: HECI Controller 1
  
Offset 000:  86 80 68 7F 02 00 10 00 10 00 80 07 00 00 80 00
Offset 010:  04 90 21 00 80 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 50 00 00 00 00 00 00 00 FF 01 00 00
Offset 040:  45 02 00 90 00 00 00 80 00 85 F1 09 00 00 00 00
Offset 050:  01 8C 03 40 08 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  30 00 00 00 00 00 00 00 03 1F F6 02 00 00 20 40
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  00 00 00 00 00 00 00 00 00 00 00 00 05 A4 80 00
Offset 090:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0A0:  04 00 00 00 09 00 14 F0 10 00 40 01 00 00 00 00
Offset 0B0:  01 80 00 00 38 0D 0E 00 00 00 00 00 00 00 00 40
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00
 
B80 D16 F03:  Intel Arrow Point PCH - CSME: Keyboard and Text (KT) Redirection
  
Offset 000:  86 80 6B 7F 00 00 B0 00 10 02 00 07 00 00 80 00
Offset 010:  21 30 00 00 00 10 02 B8 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 40 00 00 00 00 00 00 00 FF 04 00 00
Offset 040:  05 50 80 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  01 00 23 00 08 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 090:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00
 
B80 D1F F00:  Intel Q870 Chipset - eSPI Controller
  
Offset 000:  86 80 03 7F 03 04 00 00 10 00 01 06 00 00 80 00
Offset 010:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 040:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  00 00 0F 7F 01 09 FC 00 01 0A FC 00 01 02 3C 00
Offset 090:  81 00 0C 00 10 20 00 00 01 00 50 FE 00 00 00 00
Offset 0A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  00 00 00 00 00 00 00 00 CF FF 00 80 A6 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00
 
B80 D1F F03:  Intel Arrow Point PCH - Audio Context Engine
  
Offset 000:  86 80 50 7F 06 00 10 00 10 00 03 04 00 00 80 00
Offset 010:  04 C0 DF DF 9F 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  04 00 E0 DF 9F 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 50 00 00 00 00 00 00 00 10 01 00 00
Offset 040:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  01 C0 43 C0 08 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  05 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  10 00 92 00 00 00 00 00 00 28 10 00 00 00 00 00
Offset 090:  10 00 92 00 00 00 00 00 00 28 10 00 00 00 00 00
Offset 0A0:  10 00 92 00 00 00 00 00 00 28 10 00 00 00 00 00
Offset 0B0:  10 00 92 00 00 00 00 00 00 28 10 00 00 00 00 00
Offset 0C0:  09 60 14 F0 10 00 40 01 00 00 00 00 A1 D4 01 00
Offset 0D0:  00 08 28 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00
 
B80 D1F F04:  Intel Arrow Point PCH - SMBus Controller
  
Offset 000:  86 80 23 7F 03 00 80 02 10 00 05 0C 00 00 00 00
Offset 010:  04 80 21 00 80 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  01 30 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 00 00 00 00 00 00 00 00 FF 03 00 00
Offset 040:  11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  01 8E 00 00 00 01 00 00 00 00 00 00 00 00 00 00
Offset 060:  04 05 05 00 00 00 0A 0A 00 00 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 090:  1A 00 20 01 00 0C 00 00 1F 00 20 01 00 0E 00 00
Offset 0A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00
 
B80 D1F F05:  Intel Arrow Point PCH - SPI (Flash) Controller
  
Offset 000:  86 80 24 7F 00 04 00 00 10 00 80 0C 00 00 00 00
Offset 010:  00 00 02 B8 00 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 040:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 090:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0D0:  00 00 00 00 00 00 00 00 CF FF 00 80 AA 00 00 00
Offset 0E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00
 
B80 D1F F06:  Intel Arrow Point - Gigabit Ethernet Controller
  
Offset 000:  86 80 0C 55 06 04 18 00 10 00 00 02 00 00 00 00
Offset 010:  00 00 FE BD 00 00 00 00 00 00 00 00 00 00 00 00
Offset 020:  00 00 00 00 00 00 00 00 00 00 00 00 3C 10 17 8D
Offset 030:  00 00 00 00 C8 00 00 00 00 00 00 00 00 03 00 00
Offset 040:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 050:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 060:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 070:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 080:  28 00 00 00 08 00 00 00 00 00 00 00 00 00 00 00
Offset 090:  00 00 00 00 1F 00 00 00 00 00 00 00 00 00 00 00
Offset 0A0:  FF FF FF FF FF FF FF FF 03 10 03 10 00 00 00 00
Offset 0B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0C0:  00 00 00 00 00 00 00 00 01 D0 23 C8 08 21 00 00
Offset 0D0:  05 00 81 00 18 03 E0 FE 00 00 00 00 00 00 00 00
Offset 0E0:  13 00 06 03 00 00 00 00 00 00 00 00 00 00 00 00
Offset 0F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
PCI-8086-7D35:  Intel TGL-H/ADL/RPL/MTL/ARL/LNL MCHBAR
  
Offset 5900:  00 00 00 01 00 00 00 01 80 00 21 02 00 00 00 04
Offset 5910:  00 00 00 00 01 00 00 00 00 00 00 00 24 00 00 00
Offset 5920:  00 80 00 80 10 00 00 00 6A 08 A7 04 18 00 00 00
Offset 5930:  18 01 00 00 00 00 12 00 03 0E 0A 00 3C AF 0E 07
Offset 5940:  FF 3F 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 5950:  00 00 00 00 00 00 04 00 00 19 81 F0 38 08 04 08
Offset 5960:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 5970:  00 00 00 00 00 00 00 00 50 00 00 00 50 00 00 00
Offset 5980:  49 00 00 00 36 AA D8 F1 00 00 00 00 00 00 00 00
Offset 5990:  00 00 00 00 FF 00 00 00 6C 00 21 00 00 16 69 80
Offset 59A0:  18 81 DD 00 50 82 00 00 00 00 00 00 00 00 00 00
Offset 59B0:  78 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 59C0:  00 00 20 88 00 00 00 00 00 00 00 00 00 00 00 00
 
PCI-8086-7D35:  Intel TGL-H/ADL/RPL/MTL/ARL/LNL MCHBAR
  
Offset 5E00:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 5E10:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
PCI-8086-7D35:  Intel TGL-H/ADL/RPL/MTL/ARL/LNL MCHBAR
  
Offset 5F00:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 5F10:  00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00
Offset 5F20:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 5F30:  00 00 00 00 00 00 00 00 00 00 00 00 19 00 00 00
Offset 5F40:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 5F50:  00 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00
Offset 5F60:  A9 85 01 00 A9 85 01 00 00 00 00 00 00 00 00 00
Offset 5F70:  01 00 00 00 FF FF FF FF 00 00 00 00 00 00 00 00
 
PCI-8086-7D35:  Intel MTL/ARL/LNL MCHBAR
  
Offset 13D90:  FF FF FF FF 00 00 00 00 EB EF 10 00 00 00 00 00
 
PCI-8086-7D35:  Intel TGL-H/ADL/RPL/MTL/ARL/LNL IMC0 MCHBAR [Shared]
  
Offset D800:  01 00 01 08 00 81 01 01 00 81 01 01 10 00 00 00
Offset D810:  10 00 00 00 02 00 00 00 00 00 00 00 00 42 00 00
Offset D820:  00 00 00 00 00 4C 02 02 00 00 00 00 F8 00 40 00
Offset D830:  09 10 01 00 00 00 00 00 F2 0A 00 00 40 20 08 00
Offset D840:  15 C2 52 E2 03 00 00 00 00 00 00 00 00 00 00 00
Offset D850:  00 00 00 00 00 00 00 00 35 8B 45 2B 02 00 00 00
Offset D860:  00 00 00 00 00 00 00 00 42 00 98 01 00 00 00 00
Offset D870:  00 00 00 00 10 00 00 00 44 18 00 00 44 18 00 00
Offset D880:  20 40 50 24 00 00 00 00 00 00 00 00 00 00 00 00
Offset D890:  00 00 F0 FF 7F 00 00 00 00 00 00 00 00 00 00 00
Offset D8A0:  A2 7B DE C4 01 00 00 00 21 55 19 74 06 00 00 00
 
PCI-8086-7D35:  Intel TGL-H/ADL/RPL/MTL/ARL/LNL IMC0 MCHBAR [Ch0]
  
Offset E000:  2D B4 50 21 14 41 0B 00 00 00 00 00 0E 08 10 10
Offset E010:  15 15 15 15 50 76 34 1A 38 08 0E 0E BC 12 AF 00
Offset E020:  49 19 19 19 00 00 00 00 00 00 00 00 40 02 00 02
Offset E030:  00 00 00 00 78 01 01 06 00 0C 00 00 00 00 00 00
Offset E040:  E9 CA 2B 02 00 06 00 00 00 00 00 00 00 00 00 00
Offset E050:  95 8A BB 49 44 95 06 22 00 00 00 00 00 00 00 00
Offset E060:  00 00 00 00 00 00 00 00 38 28 3B 14 20 30 3F 00
Offset E070:  1C 00 2E 2C 00 00 00 00 04 00 00 00 0A 19 00 00
Offset E080:  00 00 00 00 00 00 00 00 09 00 C0 00 00 80 10 00
Offset E090:  10 02 16 06 08 02 10 04 04 02 0C 02 00 00 00 00
Offset E0A0:  0A 45 86 D0 00 00 00 00 40 00 C4 02 58 20 41 02
Offset E0B0:  0F 00 00 00 04 00 00 00 08 11 42 F4 10 08 00 00
Offset E0C0:  00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E0D0:  0F 00 00 00 66 1A 49 E6 00 00 00 00 00 00 00 00
Offset E0E0:  00 00 00 00 00 00 00 00 C3 BE 17 00 00 00 00 00
Offset E0F0:  00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00
Offset E100:  00 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00
Offset E110:  26 00 00 00 12 04 E4 01 CB 80 00 D8 CB B2 01 00
Offset E120:  E0 00 00 00 00 00 00 00 80 01 04 00 08 60 01 08
Offset E130:  00 00 00 00 00 00 00 00 20 1C 44 0B 2D 00 00 00
Offset E140:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E150:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E160:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E170:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E180:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E190:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E1A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E1B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E1C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E1D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E1E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E1F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E200:  86 86 08 21 30 40 2F 3F 4F 37 CB 57 5A 31 90 12
Offset E210:  00 66 94 00 C7 00 C6 C9 30 00 00 13 13 23 00 40
Offset E220:  00 3D 3E 3D 40 06 06 06 06 7F 00 00 00 00 00 00
Offset E230:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E240:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E250:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E260:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E270:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E280:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E290:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E2A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E2B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E2C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E2D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E2E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E2F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E300:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E310:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E320:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E330:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E340:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E350:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E360:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E370:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E380:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E390:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E3A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E3B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E3C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E3D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E3E0:  28 B0 52 01 8E 60 38 00 00 00 00 00 00 00 00 00
Offset E3F0:  E1 10 49 53 CE BD 19 FC 00 00 00 00 00 00 00 00
Offset E400:  C3 2E 00 11 00 00 00 00 00 00 00 00 6C 01 00 00
Offset E410:  00 0D 20 00 00 00 00 00 03 03 00 00 03 03 00 00
Offset E420:  00 00 00 00 01 01 01 01 00 3B 00 00 20 18 18 00
Offset E430:  58 6A 3F 00 00 00 00 00 40 86 58 00 00 00 00 00
Offset E440:  00 00 00 00 00 40 02 00 54 00 78 05 00 01 00 00
Offset E450:  00 00 00 00 01 00 00 00 00 1C 00 00 00 00 00 00
Offset E460:  00 00 00 00 00 00 00 00 00 00 00 00 01 01 08 00
Offset E470:  01 01 08 00 73 1B 00 00 04 00 00 00 00 00 00 00
Offset E480:  88 46 44 23 88 46 44 23 10 00 C0 0A 00 00 00 00
Offset E490:  00 1F 00 14 28 00 00 00 00 00 00 00 00 00 00 00
Offset E4A0:  54 15 FC 06 2F 6C A9 02 00 00 00 00 00 00 00 00
Offset E4B0:  78 F3 1E 97 41 00 00 00 E4 00 00 00 E4 00 00 00
Offset E4C0:  38 03 00 00 00 A0 03 38 00 80 08 00 00 00 00 00
Offset E4D0:  28 80 F0 03 00 00 00 00 00 00 00 00 00 00 00 00
Offset E4E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E4F0:  00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF
Offset E500:  DA E5 48 2B 02 00 00 00 00 00 00 00 00 00 00 00
Offset E510:  A2 0F DE C4 01 00 00 00 00 00 00 00 00 00 00 00
Offset E520:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E530:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E540:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E550:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E560:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E570:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E580:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E590:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E5A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E5B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E5C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E5D0:  85 01 00 B0 00 A4 00 02 00 00 00 00 00 00 00 00
Offset E5E0:  00 20 00 00 0F 00 00 00 00 00 00 00 00 00 00 00
Offset E5F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
PCI-8086-7D35:  Intel TGL-H/ADL/RPL/MTL/ARL/LNL IMC0 MCHBAR [Ch1]
  
Offset E800:  2D B4 50 21 14 41 0B 00 00 00 00 00 0E 08 10 10
Offset E810:  15 15 15 15 50 76 34 1A 38 08 0E 0E BC 12 AF 00
Offset E820:  49 19 19 19 00 00 00 00 00 00 00 00 40 02 00 02
Offset E830:  00 00 00 00 80 01 01 06 00 0C 00 00 00 00 00 00
Offset E840:  F1 CA 2B 02 00 06 00 00 00 00 00 00 00 00 00 00
Offset E850:  95 8A BB 49 44 95 06 22 00 00 00 00 00 00 00 00
Offset E860:  00 00 00 00 00 00 00 00 38 28 3B 14 20 30 3F 00
Offset E870:  1C 00 2E 2C 00 00 00 00 04 00 00 00 0A 19 00 00
Offset E880:  00 00 00 00 00 00 00 00 09 00 C0 00 00 80 10 00
Offset E890:  10 02 16 06 08 02 10 04 04 02 0C 02 00 00 00 00
Offset E8A0:  0A 45 86 D0 00 00 00 00 40 00 C4 02 58 20 41 02
Offset E8B0:  0F 00 00 00 04 00 00 00 08 11 42 F4 10 08 00 00
Offset E8C0:  00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E8D0:  0F 00 00 00 66 1A 49 E6 00 00 00 00 00 00 00 00
Offset E8E0:  00 00 00 00 00 00 00 00 4D BF 17 00 00 00 00 00
Offset E8F0:  00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00
Offset E900:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E910:  26 00 00 00 12 04 E4 01 CB 80 00 D8 CB B2 01 00
Offset E920:  E0 00 00 00 00 00 00 00 80 01 04 00 08 60 01 08
Offset E930:  00 00 00 00 00 00 00 00 20 1C 44 0B 2D 00 00 00
Offset E940:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E950:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E960:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E970:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E980:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E990:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E9A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E9B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E9C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E9D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E9E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset E9F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EA00:  86 86 08 21 30 40 2F 3F 4F 32 B2 56 59 31 90 12
Offset EA10:  40 66 94 00 C7 00 C3 C3 20 00 00 13 13 23 00 40
Offset EA20:  00 3B 3A 39 39 05 04 04 05 7F 00 00 00 00 00 00
Offset EA30:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EA40:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EA50:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EA60:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EA70:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EA80:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EA90:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EAA0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EAB0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EAC0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EAD0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EAE0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EAF0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EB00:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EB10:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EB20:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EB30:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EB40:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EB50:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EB60:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EB70:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EB80:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EB90:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EBA0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EBB0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EBC0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EBD0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EBE0:  28 B0 52 01 8E 60 38 00 00 00 00 00 00 00 00 00
Offset EBF0:  EE 79 8F 08 AE 32 EE F4 00 00 00 00 00 00 00 00
Offset EC00:  C3 2E 01 11 00 00 00 00 00 00 00 00 6C 01 00 00
Offset EC10:  00 0D 20 00 00 00 00 00 03 03 00 00 03 03 00 00
Offset EC20:  00 00 00 00 00 01 01 01 00 3B 00 00 20 18 18 00
Offset EC30:  90 0F 10 00 00 00 00 00 40 86 58 00 00 00 00 00
Offset EC40:  00 00 00 00 00 40 02 00 54 00 78 05 00 01 00 00
Offset EC50:  00 00 00 00 01 00 00 00 00 1C 00 00 00 00 00 00
Offset EC60:  00 00 00 00 00 00 00 00 00 00 00 00 01 01 08 00
Offset EC70:  01 01 08 00 73 1B 00 00 04 00 00 00 00 00 00 00
Offset EC80:  88 46 44 23 88 46 44 23 10 00 C0 0A 00 00 00 00
Offset EC90:  00 1F 00 14 28 00 00 00 00 00 00 00 00 00 00 00
Offset ECA0:  54 15 FC 06 2F 6C A9 02 00 00 00 00 00 00 00 00
Offset ECB0:  0E E7 73 97 41 00 00 00 E4 00 00 00 E4 00 00 00
Offset ECC0:  38 03 00 00 00 A0 03 38 00 80 08 00 00 00 00 00
Offset ECD0:  28 80 F0 03 00 00 00 00 00 00 00 00 00 00 00 00
Offset ECE0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset ECF0:  00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF
Offset ED00:  74 21 44 2B 02 00 00 00 00 00 00 00 00 00 00 00
Offset ED10:  B6 E8 DE C4 01 00 00 00 00 00 00 00 00 00 00 00
Offset ED20:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset ED30:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset ED40:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset ED50:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset ED60:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset ED70:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset ED80:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset ED90:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EDA0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EDB0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EDC0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset EDD0:  85 01 00 B0 00 A4 00 02 00 00 00 00 00 00 00 00
Offset EDE0:  00 20 00 00 0F 00 00 00 00 00 00 00 00 00 00 00
Offset EDF0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
PCI-8086-7D35:  Intel TGL-H/ADL/RPL/MTL/ARL/LNL IMC1 MCHBAR [Shared]
  
Offset 1D800:  01 00 01 08 00 81 01 01 00 81 01 01 10 00 00 00
Offset 1D810:  10 00 00 00 02 00 00 00 00 00 00 00 00 42 00 00
Offset 1D820:  00 00 00 00 00 4C 02 02 00 00 00 00 F8 00 40 00
Offset 1D830:  09 10 01 00 00 00 00 00 F2 0A 00 00 40 20 08 00
Offset 1D840:  69 A5 55 E2 03 00 00 00 00 00 00 00 00 00 00 00
Offset 1D850:  00 00 00 00 00 00 00 00 BC CB 0B 2B 02 00 00 00
Offset 1D860:  00 00 00 00 00 00 00 00 DA 33 99 01 00 00 00 00
Offset 1D870:  00 00 00 00 10 00 00 00 44 18 00 00 44 18 00 00
Offset 1D880:  20 40 50 24 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1D890:  00 00 F0 FF 7F 00 00 00 00 00 00 00 00 00 00 00
Offset 1D8A0:  F1 3D B9 C4 01 00 00 00 B0 35 8E 73 06 00 00 00
 
PCI-8086-7D35:  Intel TGL-H/ADL/RPL/MTL/ARL/LNL IMC1 MCHBAR [Ch0]
  
Offset 1E000:  2D B4 50 21 14 41 0B 00 00 00 00 00 0E 08 10 10
Offset 1E010:  15 15 15 15 50 76 34 1A 38 08 0E 0E BC 12 AF 00
Offset 1E020:  52 19 19 19 00 00 00 00 00 00 00 00 40 02 00 02
Offset 1E030:  00 00 00 00 80 01 01 06 00 0C 00 00 00 00 00 00
Offset 1E040:  F1 CA 2B 02 00 06 00 00 00 00 00 00 00 00 00 00
Offset 1E050:  95 8A BB 49 44 95 06 22 00 00 00 00 00 00 00 00
Offset 1E060:  00 00 00 00 00 00 00 00 38 28 3B 14 20 30 3F 00
Offset 1E070:  1C 00 2E 2C 00 00 00 00 04 00 00 00 0A 19 00 00
Offset 1E080:  00 00 00 00 00 00 00 00 09 00 C0 00 00 80 10 00
Offset 1E090:  10 02 16 06 08 02 10 04 04 02 0C 02 00 00 00 00
Offset 1E0A0:  0A 45 86 D0 00 00 00 00 40 00 C4 02 58 20 41 02
Offset 1E0B0:  0F 00 00 00 04 00 00 00 08 11 42 F4 10 08 00 00
Offset 1E0C0:  00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E0D0:  0F 00 00 00 66 1A 49 E6 00 00 00 00 00 00 00 00
Offset 1E0E0:  00 00 00 00 00 00 00 00 7B BE 17 00 00 00 00 00
Offset 1E0F0:  00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00
Offset 1E100:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E110:  26 00 00 00 12 04 E4 01 CB 80 00 D8 CB B2 01 00
Offset 1E120:  E0 00 00 00 00 00 00 00 80 01 04 00 08 60 01 08
Offset 1E130:  00 00 00 00 00 00 00 00 20 1C 44 0B 2D 00 00 00
Offset 1E140:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E150:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E160:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E170:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E180:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E190:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E1A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E1B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E1C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E1D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E1E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E1F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E200:  86 86 08 21 30 40 2F 3F 4F 38 C6 54 5E 31 90 12
Offset 1E210:  42 66 94 00 C7 C6 CC C9 28 00 00 13 13 23 00 40
Offset 1E220:  00 3D 3F 3E 3F 06 06 06 06 7F 00 00 00 00 00 00
Offset 1E230:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E240:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E250:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E260:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E270:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E280:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E290:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E2A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E2B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E2C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E2D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E2E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E2F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E300:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E310:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E320:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E330:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E340:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E350:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E360:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E370:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E380:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E390:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E3A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E3B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E3C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E3D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E3E0:  28 B0 52 01 8E 60 38 00 00 00 00 00 00 00 00 00
Offset 1E3F0:  BC 21 B5 BD 36 DE 82 74 00 00 00 00 00 00 00 00
Offset 1E400:  C3 2E 00 11 00 00 00 00 00 00 00 00 6C 01 00 00
Offset 1E410:  00 0D 20 00 00 00 00 00 03 03 00 00 03 03 00 00
Offset 1E420:  00 00 00 00 01 01 01 01 00 3B 00 00 20 18 18 00
Offset 1E430:  D0 17 10 00 00 00 00 00 40 86 58 00 00 00 00 00
Offset 1E440:  00 00 00 00 00 40 02 00 54 00 78 05 00 01 00 00
Offset 1E450:  00 00 00 00 01 00 00 00 00 1C 00 00 00 00 00 00
Offset 1E460:  00 00 00 00 00 00 00 00 00 00 00 00 01 01 08 00
Offset 1E470:  01 01 08 00 73 1B 00 00 04 00 00 00 00 00 00 00
Offset 1E480:  88 46 44 23 88 46 44 23 10 00 C0 0A 00 00 00 00
Offset 1E490:  00 1F 00 14 28 00 00 00 00 00 00 00 00 00 00 00
Offset 1E4A0:  54 15 FC 06 2F 6C A9 02 00 00 00 00 00 00 00 00
Offset 1E4B0:  8B DA CD 98 41 00 00 00 E4 00 00 00 E4 00 00 00
Offset 1E4C0:  38 03 00 00 00 A0 03 38 00 80 08 00 00 00 00 00
Offset 1E4D0:  28 80 F0 03 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E4E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E4F0:  00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF
Offset 1E500:  04 56 26 2B 02 00 00 00 00 00 00 00 00 00 00 00
Offset 1E510:  B8 49 BE C4 01 00 00 00 00 00 00 00 00 00 00 00
Offset 1E520:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E530:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E540:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E550:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E560:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E570:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E580:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E590:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E5A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E5B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E5C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E5D0:  85 01 00 B0 00 A4 00 02 00 00 00 00 00 00 00 00
Offset 1E5E0:  00 20 00 00 0F 00 00 00 00 00 00 00 00 00 00 00
Offset 1E5F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 
PCI-8086-7D35:  Intel TGL-H/ADL/RPL/MTL/ARL/LNL IMC1 MCHBAR [Ch1]
  
Offset 1E800:  2D B4 50 21 14 41 0B 00 00 00 00 00 0E 08 10 10
Offset 1E810:  15 15 15 15 50 76 34 1A 38 08 0E 0E BC 12 AF 00
Offset 1E820:  54 19 19 19 00 00 00 00 00 00 00 00 40 02 00 02
Offset 1E830:  00 00 00 00 78 01 01 06 00 0C 00 00 00 00 00 00
Offset 1E840:  E9 CA 2B 02 00 06 00 00 00 00 00 00 00 00 00 00
Offset 1E850:  95 8A BB 49 44 95 06 22 00 00 00 00 00 00 00 00
Offset 1E860:  00 00 00 00 00 00 00 00 38 28 3B 14 20 30 3F 00
Offset 1E870:  1C 00 2E 2C 00 00 00 00 04 00 00 00 0A 19 00 00
Offset 1E880:  00 00 00 00 00 00 00 00 09 00 C0 00 00 80 10 00
Offset 1E890:  10 02 16 06 08 02 10 04 04 02 0C 02 00 00 00 00
Offset 1E8A0:  0A 45 86 D0 00 00 00 00 40 00 C4 02 58 20 41 02
Offset 1E8B0:  0F 00 00 00 04 00 00 00 08 11 42 F4 10 08 00 00
Offset 1E8C0:  00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E8D0:  0F 00 00 00 66 1A 49 E6 00 00 00 00 00 00 00 00
Offset 1E8E0:  00 00 00 00 00 00 00 00 46 BE 17 00 00 00 00 00
Offset 1E8F0:  00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 00
Offset 1E900:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E910:  26 00 00 00 12 04 E4 01 CB 80 00 D8 CB B2 01 00
Offset 1E920:  E0 00 00 00 00 00 00 00 80 01 04 00 08 60 01 08
Offset 1E930:  00 00 00 00 00 00 00 00 20 1C 44 0B 2D 00 00 00
Offset 1E940:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E950:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E960:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E970:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E980:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E990:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E9A0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E9B0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E9C0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E9D0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E9E0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1E9F0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EA00:  86 86 08 21 30 40 2F 3F 4F 35 B5 56 58 31 90 12
Offset 1EA10:  00 66 94 00 C7 C3 C3 C3 20 00 00 13 13 23 00 40
Offset 1EA20:  00 3C 3E 3D 3E 04 05 04 05 7F 00 00 00 00 00 00
Offset 1EA30:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EA40:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EA50:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EA60:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EA70:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EA80:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EA90:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EAA0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EAB0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EAC0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EAD0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EAE0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EAF0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EB00:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EB10:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EB20:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EB30:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EB40:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EB50:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EB60:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EB70:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EB80:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EB90:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EBA0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EBB0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EBC0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EBD0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EBE0:  28 B0 52 01 8E 60 38 00 00 00 00 00 00 00 00 00
Offset 1EBF0:  4A 97 CC A6 E6 E8 D9 32 00 00 00 00 00 00 00 00
Offset 1EC00:  C3 2E 01 11 00 00 00 00 00 00 00 00 6C 01 00 00
Offset 1EC10:  00 0D 20 00 00 00 00 00 03 03 00 00 03 03 00 00
Offset 1EC20:  00 00 00 00 00 01 01 01 00 3B 00 00 20 18 18 00
Offset 1EC30:  00 F0 49 00 00 00 00 00 40 86 58 00 00 00 00 00
Offset 1EC40:  00 00 00 00 00 40 02 00 54 00 78 05 00 01 00 00
Offset 1EC50:  00 00 00 00 01 00 00 00 00 1C 00 00 00 00 00 00
Offset 1EC60:  00 00 00 00 00 00 00 00 00 00 00 00 01 01 08 00
Offset 1EC70:  01 01 08 00 73 1B 00 00 04 00 00 00 00 00 00 00
Offset 1EC80:  88 46 44 23 88 46 44 23 10 00 C0 0A 00 00 00 00
Offset 1EC90:  00 1F 00 14 28 00 00 00 00 00 00 00 00 00 00 00
Offset 1ECA0:  54 15 FC 06 2F 6C A9 02 00 00 00 00 00 00 00 00
Offset 1ECB0:  4C 0D D7 98 41 00 00 00 E4 00 00 00 E4 00 00 00
Offset 1ECC0:  38 03 00 00 00 A0 03 38 00 80 08 00 00 00 00 00
Offset 1ECD0:  28 80 F0 03 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1ECE0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1ECF0:  00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF
Offset 1ED00:  34 31 F3 2A 02 00 00 00 00 00 00 00 00 00 00 00
Offset 1ED10:  9C 32 B4 C4 01 00 00 00 00 00 00 00 00 00 00 00
Offset 1ED20:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1ED30:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1ED40:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1ED50:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1ED60:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1ED70:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1ED80:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1ED90:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EDA0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EDB0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EDC0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Offset 1EDD0:  85 01 00 B0 00 A4 00 02 00 00 00 00 00 00 00 00
Offset 1EDE0:  00 20 00 00 0F 00 00 00 00 00 00 00 00 00 00 00
Offset 1EDF0:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00


Debug - Video BIOS
 
C000:0000  >...j....z3..I....eD.,#......c.A.C.D^.".@.......&...t..\...l..z.
C000:0040  d4...S.da]Mx..z@0......e`g.p.@B....9....3J.".C.j.:d7k.LM9....;
C000:0080  .6....}>MR.'L.....................C.....Y..f.S......~......U....
C000:00C0  ...^R.;.{+..G.n?..?.5.:XB......v.`.........[..&...5..r......Qc5
C000:0100  ......A........*..^.H.p.X..<7..fi2...M~..%[..h'.6..z..3/j.2...l.
C000:0140  ..vP<q.(.8W.....4.Z.......v'...U.{n..,.90...u.....,.......=.D.-.
C000:0180  .E1...s....U1`~Qv....B..i....t.+..m..l.w.........T6zg.p.7~KX.~g.
C000:01C0  QE..x.#.y.y96.O..6..;O).eV-).A.V..B...v.7....._....|..`,.s._E...
C000:0200  .p..{r.X...9L,Gr...y.........\.yp../_.S3.|h.q9...3x q...<P.&..
C000:0240  ...\...`T......q{3.#..............b.o.bV.....[~.pL.r..U...7N...
C000:0280  Dq. ,H..F.G...9.A...G....>...?E^...J..m+R..$.....B.+.~F"......HQ
C000:02C0  ./..<......X..T-.95.4{u...'.U...*...2..(6.0......z..9.Q.i...dq
C000:0300  NjJ.....3.R.twA..%P...r~.R...q1.~.w...G.......;i.NKvI....m*..vQ.
C000:0340  ..s..Xwky.5.kE6.0H.O.....WQ....C.....jN......L.......I..8.S.A..8
C000:0380  {....).'6..i%[z...._efo...i>.......}Dm. .L.|`R."$.e......>.c..i.
C000:03C0  .6....).H.*PJ...E.n..... .q.....{..%X(.W).[>.s`..q.8g2j....Q[.g


Debug - Unknown
 
PCI/AGP  2646-502E [SubSys: 2646-502E]: Standard NVM Express Controller [2646-502E] [NoDB]
PnP  IFX1524: Trusted Platform Module 2.0 [NoDB]
SSD  KINGSTON OM8PJP4512K3-AH0



The names of actual companies and products mentioned herein may be the trademarks of their respective owners.