[Vol-users] Question

Ayers, Robert roayers at pa.gov
Tue Mar 5 12:29:42 CST 2013


Anyone ever seen anything like this? It came out of a  WinXPSP3x86 ram capture.

PCSXView results;

Offset(P)  Name                    PID pslist psscan thrdproc pspcid csrss session deskthrd
---------- -------------------- ------ ------ ------ -------- ------ ----- ------- --------
0x0a074da0 X???E?P??(O'?     23...6 False  True   False    False  False False   False


PSSCan results;

Offset(P)  Name                PID   PPID PDB        Time created                   Time exited
---------- ---------------- ------ ------ ---------- ------------------------------ ------------------------------
0x0a074da0 X???E?P??(O'? 23...6 23...4 0x8a274dc0

Thanks,
Robert Ayers,

-------------- next part --------------
An HTML attachment was scrubbed...
URL: https://lists.volatilityfoundation.org/pipermail/vol-users/attachments/20130305/2d347d71/attachment.html


More information about the Vol-users mailing list