Cannot profile aspnet 2 application

ggivatiggivati Posts: 2
edited October 8, 2008 7:58AM in ANTS Performance Profiler Previous Versions
Hi,

I'm evaluating Ants profiler and am testing it on my application. In the UI I see it's profiling status as witing for connection. the framework is using default configuration. I have generated log files from ants.

The ProfilerLog says the following:
=================
28/08/08 11:26:34 ANTSProfilerLog initialized
28/08/08 11:26:34 PID = 3452
28/08/08 11:26:34 Log file name = ANTSProfilerLog3452.txt
28/08/08 11:26:34 OS version = Microsoft Windows NT 5.1.2600 Service Pack 2
28/08/08 11:26:34 Machine name = EFFICENS-2
28/08/08 11:26:34 User name = IBM
28/08/08 11:26:34 PARAMHOST - Listening on port 8084
28/08/08 11:26:34 PARAMHOST - Listening on port 8084, channel registered
28/08/08 11:26:37 EditProjectClosingWizard start
28/08/08 11:26:37 EditProjectClosingWizard start
28/08/08 11:26:37 Couldn't find WebDev (2008) at: C:\Program Files\Common Files\Microsoft Shared\DevServer\9.0\WebDev.WebServer.EXE
28/08/08 11:26:37 Using IIS Version 5
28/08/08 11:26:37 About to show wizard
28/08/08 11:26:47 Wizard dialog returned
28/08/08 11:26:49 UI Start profiling
28/08/08 11:26:49 ENGINE - Core2.dll found in regisry
28/08/08 11:26:49 ENGINE Start profiling performance of ASP.NET web application http://localhost/Biaqm/default.aspx
28/08/08 11:26:49 ENGINE The profiler is enabled
28/08/08 11:26:49 TRANSFER - Waiting for pipe connection from core
28/08/08 11:26:49 Starting IIS Profile host - checking if service available
28/08/08 11:26:49 Found ANTS Profiler 3 Service, attempting start
28/08/08 11:26:49 Service started. Checking port available
28/08/08 11:26:49 WaitForPort on address 127.0.0.1, port 8086
28/08/08 11:26:49 Port is accepting connections - service now running
28/08/08 11:26:49 ENGINE - Managed to hook into status updates from IIS Profile Host
28/08/08 11:27:04 TESTHARNESS - Starting IE With URL: http://localhost/Biaqm/default.aspx
28/08/08 11:28:43 UI Take snapshot
28/08/08 11:28:43 ENGINE Start get performance results
28/08/08 11:28:43 TRANSFER - Not connected so returning last set of results
28/08/08 11:28:46 UI Stop profiling
28/08/08 11:28:46 ENGINE Stopping profiler
28/08/08 11:28:56 ENGINE Closing profiling session
28/08/08 11:40:59 ENGINE Closing profiling session


the Host log says the following:

==========================
28/08/2008 11:26:16 IISProfileHostLog initialized
28/08/2008 11:26:16 PID = 6560
28/08/2008 11:26:16 Log file name = IISProfileHostLog6560.txt
28/08/2008 11:26:16 OS version = Microsoft Windows NT 5.1.2600 Service Pack 2
28/08/2008 11:26:16 Machine name = EFFICENS-2
28/08/2008 11:26:16 User name = SYSTEM
28/08/2008 11:26:16 IISProfileHost starting as a service
28/08/2008 11:26:16 Listening on port 8086
28/08/2008 11:26:49 StartProfilingIIS currentUserName EFFICENS-2\IBM, url http://localhost/Biaqm/default.aspx, .NET 2.0 Two, IIS5
28/08/2008 11:26:49 Parse IIS metabase
28/08/2008 11:26:53 InitServiceList
28/08/2008 11:26:53 StartIIS
28/08/2008 11:26:53 StopServicesInOrder
28/08/2008 11:27:01 KillNamedProcess inetinfo.exe
28/08/2008 11:27:01 ENGINE - WARNING - Process to be killed, inetinfo.exe, was not found
28/08/2008 11:27:01 StartWebService IIS5, .NET Two
28/08/2008 11:27:01 ASPNET running as user ASPNET
28/08/2008 11:27:01 ASPNET user SID S-1-5-21-706756057-1368238319-2278122597-1003
28/08/2008 11:27:03 WaitForPort start, url = http://localhost/Biaqm/default.aspx
28/08/2008 11:27:03 WaitForPort on address 127.0.0.1, port 80
28/08/2008 11:27:03 WaitForPort done
28/08/2008 11:28:46 ENGINE - StopProfilingIIS


any ideas ???

Gil
· Share on Twitter

Comments

  • Brian DonahueBrian Donahue Posts: 6,590 Bronze 1
    Hi Gil,

    ASP .NET not loading the framework is a really common problem, and unfortunately it's hard to come up with a checklist to go through to fix it.

    Profiling ASP .NET on IIS 5 only works when the following conditions are met:
    • The proper user running ASP .NET was detected (ASPNET)
    • The ASPNET user profile is OK and can be written to by your account
    • The process ASPNET_WP.exe starts and runs as ASPNET user
    • ASPNET_WP.exe loads the runtime (mscorlib.dll is loaded into the process)
    • Managed code is invoked in the aspnet_wp.exe process. Static pages do not load managed code, and if the server-side cache is configured, static content will also be returned

    I do not see anything wrong in the log file, so I'd check to see that aspnet_wp.exe is running and it is doing so using the ASPNET user. To go further, you could use Microsoft's Process Explorer to see if mscorlib.dll is present in this process, but I don't know what to tell you if it's not, other than to make sure the aspx page doesn't have caching in the PAGE directive (at the top).

    I would also check the application and system event logs for a message similar to "failed to coCreate profiler" -- this means that for some unknown reason (probably security), your worker process fails to load in our RedGate.Profiler.Core2.dll.
    · Share on Twitter
  • WhatTheFuckWhatTheFuck Posts: 1
    Edit:
    The problem was solved. When I check "Manually specify ASP.NET Account Details" I was able to click on "Detect Automatically". It was detected as key in registry. This was because I forced "processModel" to use username and password from encrypted values in registry before a year and forgot to revert to "autoConfig="true". This was the reason of my problem. I set:
    <processModel autoConfig="true" />
    in machine.config file and now all is OK. "Detect Automatically" now detects it as "ASPNET". Below is my original post.

    Best Regards.

    Hi Brian,

    Configuration is: ASP.NET web application hosted in IIS 5 (detected), Windows XP SP3, .NET 2.0:

    I read about:
    Profiling ASP .NET on IIS 5 only works when the following conditions are met:
    1. The proper user running ASP .NET was detected (ASPNET)
    2. The ASPNET user profile is OK and can be written to by your account
    3. The process ASPNET_WP.exe starts and runs as ASPNET user
    4. ASPNET_WP.exe loads the runtime (mscorlib.dll is loaded into the process)
    5. Managed code is invoked in the aspnet_wp.exe process. Static pages do not load managed code, and if the server-side cache is configured, static content will also be returned

    How to make sure about "1. The proper user running..." ? And is my problem related to ASPNET user ?

    I get the following error message:

    Could not start IIS.
    RedGate.Profiler.Engine.Exceptions.CannotStartIisSessionException
    at bs.Launch()
    at RedGate.Profiler.Session.ProfilerSession.h()

    Caused by:

    Could not start IIS.
    RedGate.Profiler.Engine.Exceptions.CannotStartIisSessionException
    at bs.Launch()

    Caused by:

    Couldn't look up the account name (1332)
    System.Exception
    stack trace:
    at bs.b(String )
    at bs.a(String , FrameworkVersion , IisVersion )
    at bs.StartProfilingIIS(String currentUserName, Uri& url)
    at RedGate.Profiler.Engine.Startup.IIS.IISStarter.StartProfilingIIS(String currentUserName, Uri& url)
    at System.Runtime.Remoting.Messaging.StackBuilderSink._PrivateProcessMessage(IntPtr md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs)
    at System.Runtime.Remoting.Messaging.StackBuilderSink.PrivateProcessMessage(RuntimeMethodHandle md, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext, Object[]& outArgs)
    at System.Runtime.Remoting.Messaging.StackBuilderSink.SyncProcessMessage(IMessage msg, Int32 methodPtr, Boolean fExecuteInContext)
    rethrown at [0]:
    at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
    at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData& msgData, Int32 type)
    at RedGate.Profiler.Engine.Startup.IProxyIISSession.StartProfilingIIS(String currentUserName, Uri& url)
    at bs.Launch()

    Will provide you with all technical information you want if interested.
    As I can see from "Process Explorer" and "Process Monitor", ANTS is able to stop/start IIS Admin service.

    RedGate.Profiler.IISService.exe and inetinfo.exe (IIS Admin / WWW Service) are configured to start under "NT AUTHORITY\SYSTEM" account.

    Here is the "Process Monitor" log after I click on "Start Profiling" button:
    Filter is:
    "Process Name" - contains - "redgate"/"inetinfo"/"aspnet"
    I also created "log" and "logs" directory under "C:\Program Files\Red Gate\ANTS Profiler 4\" but they are empty.

    "Sequence","Time of Day","Process Name","PID","Operation","Path","Result","Detail","User","Authentication ID","Command Line"
    "17645","14:50:12,7178176","RedGate.Profiler.UI.exe","1572","Thread Exit","","SUCCESS","User Time: 0.0000000, Kernel Time: 0.0000000","MyDomain\MyDomainName","00000000:0000d223","""C:\Program Files\Red Gate\ANTS Profiler 4\RedGate.Profiler.UI.exe"" "
    "17646","14:50:12,7182654","RedGate.Profiler.UI.exe","1572","Thread Exit","","SUCCESS","User Time: 0.0000000, Kernel Time: 0.0000000","MyDomain\MyDomainName","00000000:0000d223","""C:\Program Files\Red Gate\ANTS Profiler 4\RedGate.Profiler.UI.exe"" "
    "17647","14:50:12,7184432","RedGate.Profiler.UI.exe","1572","Thread Exit","","SUCCESS","User Time: 0.0000000, Kernel Time: 0.0000000","MyDomain\MyDomainName","00000000:0000d223","""C:\Program Files\Red Gate\ANTS Profiler 4\RedGate.Profiler.UI.exe"" "
    "17648","14:50:12,7186781","RedGate.Profiler.UI.exe","1572","Thread Exit","","SUCCESS","User Time: 0.0000000, Kernel Time: 0.0000000","MyDomain\MyDomainName","00000000:0000d223","""C:\Program Files\Red Gate\ANTS Profiler 4\RedGate.Profiler.UI.exe"" "
    "17649","14:50:12,7206532","RedGate.Profiler.UI.exe","1572","Thread Exit","","SUCCESS","User Time: 0.0000000, Kernel Time: 0.0000000","MyDomain\MyDomainName","00000000:0000d223","""C:\Program Files\Red Gate\ANTS Profiler 4\RedGate.Profiler.UI.exe"" "
    "17650","14:50:12,7215347","RedGate.Profiler.UI.exe","1572","Thread Exit","","SUCCESS","User Time: 0.0156250, Kernel Time: 0.0156250","MyDomain\MyDomainName","00000000:0000d223","""C:\Program Files\Red Gate\ANTS Profiler 4\RedGate.Profiler.UI.exe"" "
    "17703","14:50:12,7364692","RedGate.Profiler.UI.exe","1572","Thread Create","","SUCCESS","Thread ID: 2936","MyDomain\MyDomainName","00000000:0000d223","""C:\Program Files\Red Gate\ANTS Profiler 4\RedGate.Profiler.UI.exe"" "
    "17704","14:50:12,7368008","RedGate.Profiler.UI.exe","1572","Thread Create","","SUCCESS","Thread ID: 2160","MyDomain\MyDomainName","00000000:0000d223","""C:\Program Files\Red Gate\ANTS Profiler 4\RedGate.Profiler.UI.exe"" "
    "18618","14:50:12,7871449","inetinfo.exe","1784","Process Start","","SUCCESS","Parent PID: 884","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18619","14:50:12,7871475","inetinfo.exe","1784","Thread Create","","SUCCESS","Thread ID: 2672","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18625","14:50:12,7875876","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\inetsrv\inetinfo.exe","SUCCESS","Image Base: 0x1000000, Image Size: 0x6000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18629","14:50:12,7878873","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\ntdll.dll","SUCCESS","Image Base: 0x7c900000, Image Size: 0xaf000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18657","14:50:12,7893334","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\kernel32.dll","SUCCESS","Image Base: 0x7c800000, Image Size: 0xf6000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18680","14:50:12,7902957","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\msvcrt.dll","SUCCESS","Image Base: 0x77c10000, Image Size: 0x58000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18684","14:50:12,7906280","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\advapi32.dll","SUCCESS","Image Base: 0x77dd0000, Image Size: 0x9b000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18688","14:50:12,7908653","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\rpcrt4.dll","SUCCESS","Image Base: 0x77e70000, Image Size: 0x92000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18695","14:50:12,7910557","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\secur32.dll","SUCCESS","Image Base: 0x77fe0000, Image Size: 0x11000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18697","14:50:12,7913790","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\user32.dll","SUCCESS","Image Base: 0x7e410000, Image Size: 0x91000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18699","14:50:12,7915658","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\gdi32.dll","SUCCESS","Image Base: 0x77f10000, Image Size: 0x49000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18705","14:50:12,7919446","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\ole32.dll","SUCCESS","Image Base: 0x774e0000, Image Size: 0x13d000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18777","14:50:12,7945580","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\iisrtl.dll","SUCCESS","Image Base: 0x68a20000, Image Size: 0x23000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18817","14:50:12,7966490","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\ws2_32.dll","SUCCESS","Image Base: 0x71ab0000, Image Size: 0x17000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18850","14:50:12,7979487","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\ws2help.dll","SUCCESS","Image Base: 0x71aa0000, Image Size: 0x8000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "18964","14:50:12,8022092","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\imm32.dll","SUCCESS","Image Base: 0x76390000, Image Size: 0x1d000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19016","14:50:12,8045553","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\lpk.dll","SUCCESS","Image Base: 0x629c0000, Image Size: 0x9000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19053","14:50:12,8057794","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\usp10.dll","SUCCESS","Image Base: 0x74d90000, Image Size: 0x6b000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19221","14:50:12,8119522","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\inetsrv\rpcref.dll","SUCCESS","Image Base: 0x5d900000, Image Size: 0x5000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19260","14:50:12,8137322","inetinfo.exe","1784","Thread Create","","SUCCESS","Thread ID: 3812","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19309","14:50:12,8157262","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\inetsrv\iisadmin.dll","SUCCESS","Image Base: 0x66d00000, Image Size: 0xa000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19341","14:50:12,8170826","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\vssapi.dll","SUCCESS","Image Base: 0x753e0000, Image Size: 0x6d000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19362","14:50:12,8182177","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\atl.dll","SUCCESS","Image Base: 0x76b20000, Image Size: 0x11000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19366","14:50:12,8184321","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\oleaut32.dll","SUCCESS","Image Base: 0x77120000, Image Size: 0x8b000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19370","14:50:12,8187715","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\netapi32.dll","SUCCESS","Image Base: 0x5b860000, Image Size: 0x55000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19398","14:50:12,8197808","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\inetsrv\coadmin.dll","SUCCESS","Image Base: 0x6e780000, Image Size: 0xe000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19400","14:50:12,8199940","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\shell32.dll","SUCCESS","Image Base: 0x7c9c0000, Image Size: 0x817000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19403","14:50:12,8202031","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\shlwapi.dll","SUCCESS","Image Base: 0x77f60000, Image Size: 0x76000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19442","14:50:12,8214853","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\admwprox.dll","SUCCESS","Image Base: 0x71440000, Image Size: 0xe000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "19805","14:50:12,8416892","inetinfo.exe","1784","Load Image","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll","SUCCESS","Image Base: 0x773d0000, Image Size: 0x103000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "20079","14:50:12,8568764","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\comctl32.dll","SUCCESS","Image Base: 0x5d090000, Image Size: 0x9a000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "20181","14:50:12,8622533","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\kbdus.dll","SUCCESS","Image Base: 0x5fff0000, Image Size: 0x4000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "20238","14:50:12,8646881","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","Image Base: 0x5ad70000, Image Size: 0x38000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "20322","14:50:12,8681084","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","Image Base: 0x780000, Image Size: 0x2c5000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "20357","14:50:12,8694300","inetinfo.exe","1784","Thread Create","","SUCCESS","Thread ID: 984","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "20403","14:50:12,8709891","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","Image Base: 0x76fd0000, Image Size: 0x7f000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "20432","14:50:12,8722198","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\comres.dll","SUCCESS","Image Base: 0x77050000, Image Size: 0xc5000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "20436","14:50:12,8724562","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\version.dll","SUCCESS","Image Base: 0x77c00000, Image Size: 0x8000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "20595","14:50:12,8774400","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\inetsrv\metadata.dll","SUCCESS","Image Base: 0x61c20000, Image Size: 0x17000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "20955","14:50:12,8940490","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\rsaenh.dll","SUCCESS","Image Base: 0x68000000, Image Size: 0x36000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "22234","14:50:12,9768541","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\crypt32.dll","SUCCESS","Image Base: 0x77a80000, Image Size: 0x95000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "22236","14:50:12,9771122","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\msasn1.dll","SUCCESS","Image Base: 0x77b20000, Image Size: 0x12000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "22282","14:50:12,9952723","inetinfo.exe","1784","Thread Create","","SUCCESS","Thread ID: 1824","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "22608","14:50:13,0040810","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\inetsrv\nsepm.dll","SUCCESS","Image Base: 0x5f2f0000, Image Size: 0xd000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "22826","14:50:13,0138220","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\iismap.dll","SUCCESS","Image Base: 0x669f0000, Image Size: 0x13000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "22874","14:50:13,0186337","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\schannel.dll","SUCCESS","Image Base: 0x767f0000, Image Size: 0x27000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "22876","14:50:13,0189173","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\userenv.dll","SUCCESS","Image Base: 0x769c0000, Image Size: 0xb4000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "23166","14:50:13,0379897","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\es.dll","SUCCESS","Image Base: 0x77710000, Image Size: 0x44000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "23192","14:50:13,0439084","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\wtsapi32.dll","SUCCESS","Image Base: 0x76f50000, Image Size: 0x8000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "23205","14:50:13,0453698","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\winsta.dll","SUCCESS","Image Base: 0x76360000, Image Size: 0x10000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "23241","14:50:13,0463531","inetinfo.exe","1784","Thread Create","","SUCCESS","Thread ID: 272","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "23242","14:50:13,0467830","inetinfo.exe","1784","Thread Create","","SUCCESS","Thread ID: 3468","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "23434","14:50:13,0512026","inetinfo.exe","1784","Thread Create","","SUCCESS","Thread ID: 456","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "23573","14:50:13,0556585","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\inetsrv\wamreg.dll","SUCCESS","Image Base: 0x5a800000, Image Size: 0x10000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "23871","14:50:13,0631674","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\inetsrv\admexs.dll","SUCCESS","Image Base: 0x71470000, Image Size: 0xb000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "24210","14:50:13,0718813","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\inetsrv\svcext.dll","SUCCESS","Image Base: 0x5bc20000, Image Size: 0xf000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "24243","14:50:13,0731559","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\security.dll","SUCCESS","Image Base: 0x71f80000, Image Size: 0x4000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "24256","14:50:13,0742179","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\samlib.dll","SUCCESS","Image Base: 0x71bf0000, Image Size: 0x13000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "25947","14:50:13,1263151","inetinfo.exe","1784","Load Image","C:\WINDOWS\system32\wamregps.dll","SUCCESS","Image Base: 0x5a7f0000, Image Size: 0x6000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "41601","14:50:13,5786597","inetinfo.exe","1784","Thread Create","","SUCCESS","Thread ID: 3320","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "41602","14:50:13,5788143","inetinfo.exe","1784","Thread Create","","SUCCESS","Thread ID: 1656","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "48575","14:50:13,7821535","inetinfo.exe","1784","Thread Exit","","SUCCESS","User Time: 0.0000000, Kernel Time: 0.0468750","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "73248","14:50:21,2013220","inetinfo.exe","1784","Thread Exit","","SUCCESS","User Time: 0.0000000, Kernel Time: 0.0000000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "73280","14:50:21,2043454","inetinfo.exe","1784","Thread Exit","","SUCCESS","User Time: 0.1093750, Kernel Time: 0.0781250","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "73281","14:50:21,2043522","inetinfo.exe","1784","Thread Exit","","SUCCESS","User Time: 0.0468750, Kernel Time: 0.0000000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "73282","14:50:21,2044043","inetinfo.exe","1784","Thread Exit","","SUCCESS","User Time: 0.0312500, Kernel Time: 0.0156250","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "73283","14:50:21,2044401","inetinfo.exe","1784","Thread Exit","","SUCCESS","User Time: 0.0000000, Kernel Time: 0.0000000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "73284","14:50:21,2044888","inetinfo.exe","1784","Thread Exit","","SUCCESS","User Time: 0.0000000, Kernel Time: 0.0000000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "73285","14:50:21,2044941","inetinfo.exe","1784","Thread Exit","","SUCCESS","User Time: 0.0000000, Kernel Time: 0.0000000","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "73289","14:50:21,2053152","inetinfo.exe","1784","Thread Exit","","SUCCESS","User Time: 0.0000000, Kernel Time: 0.0312500","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    "73290","14:50:21,2059707","inetinfo.exe","1784","Process Exit","","SUCCESS","Exit Status: 0, User Time: 0.2031250, Kernel Time: 0.1562500","NT AUTHORITY\SYSTEM","00000000:000003e7","C:\WINDOWS\system32\inetsrv\inetinfo.exe"
    · Share on Twitter
Sign In or Register to comment.