lsproc
Thierry Bremard
[email protected]
list binary files and driver with their local path on disks
most of code retreived from msdn site
--------------------
Process ID: 0
--------------------
Process ID: 4
<unknown> (PID: 4)
<unknown>
PageFaultCount : 0x00002E4B
PeakWorkingSetSize : 0x00419000
WorkingSetSize (Mem usage) : 0x0003A000 (232 ko)
QuotaPeakPagedPoolUsage : 0x00000000
QuotaPagedPoolUsage : 0x00000000
QuotaPeakNonPagedPoolUsage : 0x00000000
QuotaNonPagedPoolUsage : 0x00000000
PagefileUsage : 0x00000000
PeakPagefileUsage : 0x00000000
--------------------
Process ID: 764
smss.exe (PID: 764)
\SystemRoot\System32\smss.exe
PageFaultCount : 0x000000D6
PeakWorkingSetSize : 0x00082000
WorkingSetSize (Mem usage) : 0x0006C000 (432 ko)
QuotaPeakPagedPoolUsage : 0x00006C34
QuotaPagedPoolUsage : 0x00001854
QuotaPeakNonPagedPoolUsage : 0x000004D8
QuotaNonPagedPoolUsage : 0x00000280
PagefileUsage : 0x0002C000
PeakPagefileUsage : 0x00030000
--------------------
Process ID: 816
--------------------
Process ID: 844
winlogon.exe (PID: 844)
\??\C:\WINDOWS\system32\winlogon.exe
PageFaultCount : 0x0000261D
PeakWorkingSetSize : 0x00B58000
WorkingSetSize (Mem usage) : 0x0029B000 (2668 ko)
QuotaPeakPagedPoolUsage : 0x0001B054
QuotaPagedPoolUsage : 0x000185A4
QuotaPeakNonPagedPoolUsage : 0x0000C988
QuotaNonPagedPoolUsage : 0x0000B6A0
PagefileUsage : 0x005EC000
PeakPagefileUsage : 0x006C6000
--------------------
...
PeakPagefileUsage : 0x03277000
--------------------
Process ID: 2712
lsproc.exe (PID: 2712)
C:\Documents and Settings\LoginX\Bureau\lsproc.exe
PageFaultCount : 0x000000EC
PeakWorkingSetSize : 0x000F1000
WorkingSetSize (Mem usage) : 0x000E4000 (912 ko)
QuotaPeakPagedPoolUsage : 0x000032B4
QuotaPagedPoolUsage : 0x000032B4
QuotaPeakNonPagedPoolUsage : 0x00000400
QuotaNonPagedPoolUsage : 0x00000398
PagefileUsage : 0x00042000
PeakPagefileUsage : 0x0005C000
There are 131 drivers:
--------------------
1: ntkrnlpa.exe
\WINDOWS\system32\ntkrnlpa.exe
--------------------
2: hal.dll
\WINDOWS\system32\hal.dll
--------------------
3: KDCOM.DLL
\WINDOWS\system32\KDCOM.DLL
--------------------
4: BOOTVID.dll
\WINDOWS\system32\BOOTVID.dll
...
--------------------
129: HTTP.sys
\SystemRoot\System32\Drivers\HTTP.sys
--------------------
130: hiber_WMILIB.SYS
\SystemRoot\System32\Drivers\hiber_WMILIB.SYS
--------------------
131: ntdll.dll
\WINDOWS\system32\ntdll.dll
--------------