SHARE
TWEET

PID 2116 - about.exe #MalwareMustDie 20130126

MalwareMustDie Jan 26th, 2013 95 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. ========================
  2. PID: 2116 - about1.exe
  3. ========================
  4.  
  5. 20:39:05.0514301","about1.exe","2116","QueryNameInformationFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","Name: \Documents and Settings\RIK\繝・せ繧ッ繝医ャ繝予about1.exe"
  6. 20:39:05.0541944","about1.exe","2116","QueryNameInformationFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","Name: \Documents and Settings\RIK\繝・せ繧ッ繝医ャ繝予about1.exe"
  7. 20:39:05.0545350","about1.exe","2116","CreateFile","C:\WINDOWS\Prefetch\ABOUT1.EXE-1D98EA3D.pf","NAME NOT FOUND","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a"
  8. 20:39:05.0551932","about1.exe","2116","ReadFile","C:\WINDOWS\System32\ntdll.dll","SUCCESS","Offset: 500,736, Length: 12,288, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  9. 20:39:05.0671894","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝・,"SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  10. 20:39:05.0673305","about1.exe","2116","FileSystemControl","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝・,"SUCCESS","Control: FSCTL_IS_VOLUME_MOUNTED"
  11. 20:39:05.0676691","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe.Local","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  12. 20:39:05.0689734","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\KERNEL32.DLL","SUCCESS","Offset: 538,112, Length: 9,728, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  13. 20:39:05.0796588","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\SHELL32.DLL","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  14. 20:39:05.1802607","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\SHLWAPI.DLL","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  15. 20:39:05.1896698","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予oleacc.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  16. 20:39:05.1900617","about1.exe","2116","CreateFile","C:\WINDOWS\system32\oleacc.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  17. 20:39:05.1908696","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\oleacc.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  18. 20:39:05.1910194","about1.exe","2116","CloseFile","C:\WINDOWS\system32\oleacc.dll","SUCCESS",""
  19. 20:39:05.1912423","about1.exe","2116","CreateFile","C:\WINDOWS\system32\oleacc.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  20. 20:39:05.1920390","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\oleacc.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  21. 20:39:05.1920670","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\oleacc.dll","SUCCESS","AllocationSize: 163,840, EndOfFile: 163,328, NumberOfLinks: 1, DeletePending: False, Directory: False"
  22. 20:39:05.1920921","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\oleacc.dll","SUCCESS","SyncType: SyncTypeOther"
  23. 20:39:05.1921156","about1.exe","2116","ReadFile","C:\WINDOWS\system32\oleacc.dll","SUCCESS","Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  24. 20:39:05.2066934","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\oleacc.dll","SUCCESS","SyncType: SyncTypeOther"
  25. 20:39:05.2070113","about1.exe","2116","CloseFile","C:\WINDOWS\system32\oleacc.dll","SUCCESS",""
  26. 20:39:05.2072862","about1.exe","2116","ReadFile","C:\WINDOWS\system32\oleacc.dll","SUCCESS","Offset: 134,144, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  27. 20:39:05.2143729","about1.exe","2116","ReadFile","C:\WINDOWS\system32\oleacc.dll","SUCCESS","Offset: 99,328, Length: 30,720, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  28. 20:39:05.2154155","about1.exe","2116","ReadFile","C:\WINDOWS\system32\oleacc.dll","SUCCESS","Offset: 1,024, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  29. 20:39:05.2169386","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予MSVCP60.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  30. 20:39:05.2173948","about1.exe","2116","CreateFile","C:\WINDOWS\system32\msvcp60.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  31. 20:39:05.2175753","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\msvcp60.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  32. 20:39:05.2183709","about1.exe","2116","CloseFile","C:\WINDOWS\system32\msvcp60.dll","SUCCESS",""
  33. 20:39:05.2186117","about1.exe","2116","CreateFile","C:\WINDOWS\system32\msvcp60.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  34. 20:39:05.2187936","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\msvcp60.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  35. 20:39:05.2188204","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\MSVCP60.DLL","SUCCESS","SyncType: SyncTypeOther"
  36. 20:39:05.2195939","about1.exe","2116","CloseFile","C:\WINDOWS\system32\msvcp60.dll","SUCCESS",""
  37. 20:39:05.2199116","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\MSVCP60.DLL","SUCCESS","Offset: 180,224, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  38. 20:39:05.2276092","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\OLE32.DLL","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  39. 20:39:05.2369372","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\OLEAUT32.DLL","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  40. 20:39:05.2429145","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予rasapi32.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  41. 20:39:05.2439931","about1.exe","2116","CreateFile","C:\WINDOWS\system32\rasapi32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  42. 20:39:05.2441770","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\rasapi32.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  43. 20:39:05.2443460","about1.exe","2116","CloseFile","C:\WINDOWS\system32\rasapi32.dll","SUCCESS",""
  44. 20:39:05.2451955","about1.exe","2116","CreateFile","C:\WINDOWS\system32\rasapi32.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  45. 20:39:05.2453807","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\rasapi32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  46. 20:39:05.2454377","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\RASAPI32.DLL","SUCCESS","SyncType: SyncTypeOther"
  47. 20:39:05.2456238","about1.exe","2116","CloseFile","C:\WINDOWS\system32\rasapi32.dll","SUCCESS",""
  48. 20:39:05.2464032","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\RASAPI32.DLL","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  49. 20:39:05.2518550","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予rasman.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  50. 20:39:05.2522861","about1.exe","2116","CreateFile","C:\WINDOWS\system32\rasman.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  51. 20:39:05.2524652","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\rasman.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  52. 20:39:05.2526345","about1.exe","2116","CloseFile","C:\WINDOWS\system32\rasman.dll","SUCCESS",""
  53. 20:39:05.2528767","about1.exe","2116","CreateFile","C:\WINDOWS\system32\rasman.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  54. 20:39:05.2530580","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\rasman.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  55. 20:39:05.2531111","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\RASMAN.DLL","SUCCESS","SyncType: SyncTypeOther"
  56. 20:39:05.2532957","about1.exe","2116","CloseFile","C:\WINDOWS\system32\rasman.dll","SUCCESS",""
  57. 20:39:05.2535918","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\RASMAN.DLL","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  58. 20:39:05.2655635","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\NETAPI32.DLL","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  59. 20:39:05.2777675","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予WS2_32.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  60. 20:39:05.2781939","about1.exe","2116","CreateFile","C:\WINDOWS\system32\ws2_32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  61. 20:39:05.2790093","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\ws2_32.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  62. 20:39:05.2791811","about1.exe","2116","CloseFile","C:\WINDOWS\system32\ws2_32.dll","SUCCESS",""
  63. 20:39:05.2794211","about1.exe","2116","CreateFile","C:\WINDOWS\system32\ws2_32.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  64. 20:39:05.2797535","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\ws2_32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  65. 20:39:05.2797815","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\WS2_32.DLL","SUCCESS","SyncType: SyncTypeOther"
  66. 20:39:05.2799620","about1.exe","2116","CloseFile","C:\WINDOWS\system32\ws2_32.dll","SUCCESS",""
  67. 20:39:05.2802760","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\WS2_32.DLL","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  68. 20:39:05.2994312","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予WS2HELP.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  69. 20:39:05.4068700","about1.exe","2116","CreateFile","C:\WINDOWS\system32\ws2help.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  70. 20:39:05.4070692","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\ws2help.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  71. 20:39:05.4072376","about1.exe","2116","CloseFile","C:\WINDOWS\system32\ws2help.dll","SUCCESS",""
  72. 20:39:05.4086431","about1.exe","2116","CreateFile","C:\WINDOWS\system32\ws2help.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  73. 20:39:05.4088297","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\ws2help.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  74. 20:39:05.4088599","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\WS2HELP.DLL","SUCCESS","SyncType: SyncTypeOther"
  75. 20:39:05.4090420","about1.exe","2116","CloseFile","C:\WINDOWS\system32\ws2help.dll","SUCCESS",""
  76. 20:39:05.4102604","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予TAPI32.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  77. 20:39:05.4112529","about1.exe","2116","CreateFile","C:\WINDOWS\system32\tapi32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  78. 20:39:05.4114370","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\tapi32.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  79. 20:39:05.4116066","about1.exe","2116","CloseFile","C:\WINDOWS\system32\tapi32.dll","SUCCESS",""
  80. 20:39:05.4125313","about1.exe","2116","CreateFile","C:\WINDOWS\system32\tapi32.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  81. 20:39:05.4127163","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\tapi32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  82. 20:39:05.4127738","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\TAPI32.DLL","SUCCESS","SyncType: SyncTypeOther"
  83. 20:39:05.4129585","about1.exe","2116","CloseFile","C:\WINDOWS\system32\tapi32.dll","SUCCESS",""
  84. 20:39:05.4139231","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\TAPI32.DLL","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  85. 20:39:05.4167319","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予rtutils.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  86. 20:39:05.4183544","about1.exe","2116","CreateFile","C:\WINDOWS\system32\rtutils.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  87. 20:39:05.4185324","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\rtutils.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  88. 20:39:05.4186997","about1.exe","2116","CloseFile","C:\WINDOWS\system32\rtutils.dll","SUCCESS",""
  89. 20:39:05.4199211","about1.exe","2116","CreateFile","C:\WINDOWS\system32\rtutils.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  90. 20:39:05.4201041","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\rtutils.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  91. 20:39:05.4201594","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\RTUTILS.DLL","SUCCESS","SyncType: SyncTypeOther"
  92. 20:39:05.4203432","about1.exe","2116","CloseFile","C:\WINDOWS\system32\rtutils.dll","SUCCESS",""
  93. 20:39:05.4218959","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\RTUTILS.DLL","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  94. 20:39:05.4279484","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予WINMM.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  95. 20:39:05.4283761","about1.exe","2116","CreateFile","C:\WINDOWS\system32\winmm.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  96. 20:39:05.4292030","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\winmm.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  97. 20:39:05.4293692","about1.exe","2116","CloseFile","C:\WINDOWS\system32\winmm.dll","SUCCESS",""
  98. 20:39:05.4296056","about1.exe","2116","CreateFile","C:\WINDOWS\system32\winmm.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  99. 20:39:05.4305087","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\winmm.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  100. 20:39:05.4305621","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\WINMM.DLL","SUCCESS","SyncType: SyncTypeOther"
  101. 20:39:05.4307451","about1.exe","2116","CloseFile","C:\WINDOWS\system32\winmm.dll","SUCCESS",""
  102. 20:39:05.4322115","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予setupapi.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  103. 20:39:05.4326344","about1.exe","2116","CreateFile","C:\WINDOWS\system32\setupapi.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  104. 20:39:05.4334692","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\setupapi.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  105. 20:39:05.4336351","about1.exe","2116","CloseFile","C:\WINDOWS\system32\setupapi.dll","SUCCESS",""
  106. 20:39:05.4338703","about1.exe","2116","CreateFile","C:\WINDOWS\system32\setupapi.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  107. 20:39:05.4349976","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\setupapi.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  108. 20:39:05.4350241","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\SETUPAPI.DLL","SUCCESS","SyncType: SyncTypeOther"
  109. 20:39:05.4352057","about1.exe","2116","CloseFile","C:\WINDOWS\system32\setupapi.dll","SUCCESS",""
  110. 20:39:05.4364595","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\SETUPAPI.DLL","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  111. 20:39:05.4474573","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予winspool.drv","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  112. 20:39:05.4478922","about1.exe","2116","CreateFile","C:\WINDOWS\system32\winspool.drv","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  113. 20:39:05.4480733","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\winspool.drv","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  114. 20:39:05.4489530","about1.exe","2116","CloseFile","C:\WINDOWS\system32\winspool.drv","SUCCESS",""
  115. 20:39:05.4491958","about1.exe","2116","CreateFile","C:\WINDOWS\system32\winspool.drv","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  116. 20:39:05.4493790","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\winspool.drv","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  117. 20:39:05.4494318","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\WINSPOOL.DRV","SUCCESS","SyncType: SyncTypeOther"
  118. 20:39:05.4502314","about1.exe","2116","CloseFile","C:\WINDOWS\system32\winspool.drv","SUCCESS",""
  119. 20:39:05.4514505","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\WINSPOOL.DRV","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  120. 20:39:05.4601418","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予winsta.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  121. 20:39:05.4611691","about1.exe","2116","CreateFile","C:\WINDOWS\system32\winsta.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  122. 20:39:05.4613425","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\winsta.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  123. 20:39:05.4615071","about1.exe","2116","CloseFile","C:\WINDOWS\system32\winsta.dll","SUCCESS",""
  124. 20:39:05.4626167","about1.exe","2116","CreateFile","C:\WINDOWS\system32\winsta.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  125. 20:39:05.4627947","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\winsta.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  126. 20:39:05.4628458","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\WINSTA.DLL","SUCCESS","SyncType: SyncTypeOther"
  127. 20:39:05.4630249","about1.exe","2116","CloseFile","C:\WINDOWS\system32\winsta.dll","SUCCESS",""
  128. 20:39:05.4643427","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\SECUR32.DLL","SUCCESS","Offset: 50,688, Length: 1,536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  129. 20:39:05.4712567","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\RPCRT4.DLL","SUCCESS","Offset: 562,688, Length: 3,072, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  130. 20:39:05.4744451","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\ADVAPI32.DLL","SUCCESS","Offset: 477,696, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  131. 20:39:05.4871495","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\USER32.DLL","SUCCESS","Offset: 391,168, Length: 3,072, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  132. 20:39:05.4914704","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\GDI32.DLL","SUCCESS","Offset: 272,896, Length: 4,608, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  133. 20:39:05.4951994","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\COMCTL32.DLL","SUCCESS","Offset: 462,848, Length: 9,728, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  134. 20:39:05.5053537","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\MSVCRT.DLL","SUCCESS","Offset: 315,904, Length: 8,192, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  135. 20:39:05.5134872","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\SHLWAPI.DLL","SUCCESS","Offset: 442,368, Length: 3,072, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  136. 20:39:05.5231588","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\SHELL32.DLL","SUCCESS","Offset: 2,153,984, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  137. 20:39:05.5372441","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\COMDLG32.DLL","SUCCESS","Offset: 197,632, Length: 3,584, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  138. 20:39:05.5494272","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\MSVCP60.DLL","SUCCESS","Offset: 389,120, Length: 8,192, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  139. 20:39:05.5645180","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\OLE32.DLL","SUCCESS","Offset: 1,201,152, Length: 12,288, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  140. 20:39:05.5797098","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\OLEAUT32.DLL","SUCCESS","Offset: 520,704, Length: 8,192, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  141. 20:39:05.5952051","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\NETAPI32.DLL","SUCCESS","Offset: 315,392, Length: 10,240, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  142. 20:39:05.6054905","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\WS2HELP.DLL","SUCCESS","Offset: 16,896, Length: 512, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  143. 20:39:05.6144056","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\WS2_32.DLL","SUCCESS","Offset: 75,264, Length: 2,560, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  144. 20:39:05.6145419","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\RASMAN.DLL","SUCCESS","Offset: 56,832, Length: 512, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  145. 20:39:05.6227723","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\RTUTILS.DLL","SUCCESS","Offset: 39,936, Length: 512, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  146. 20:39:05.6265208","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\WINMM.DLL","SUCCESS","Offset: 127,488, Length: 5,120, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  147. 20:39:05.6371473","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\TAPI32.DLL","SUCCESS","Offset: 170,496, Length: 1,536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  148. 20:39:05.6621843","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\RASAPI32.DLL","SUCCESS","Offset: 221,184, Length: 1,024, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  149. 20:39:05.6623703","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\SETUPAPI.DLL","SUCCESS","Offset: 513,024, Length: 6,144, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  150. 20:39:05.6699666","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\WINSPOOL.DRV","SUCCESS","Offset: 132,096, Length: 6,144, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  151. 20:39:05.6803966","about1.exe","2116","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  152. 20:39:05.6805796","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  153. 20:39:05.6807478","about1.exe","2116","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
  154. 20:39:05.6809928","about1.exe","2116","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  155. 20:39:05.6811741","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  156. 20:39:05.6811892","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\IMM32.DLL","SUCCESS","AllocationSize: 114,688, EndOfFile: 110,080, NumberOfLinks: 1, DeletePending: False, Directory: False"
  157. 20:39:05.6813688","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeOther"
  158. 20:39:05.6815499","about1.exe","2116","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
  159. 20:39:05.6815853","about1.exe","2116","ReadFile","C:\WINDOWS\system32\IMM32.DLL","SUCCESS","Offset: 0, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  160. 20:39:05.6980796","about1.exe","2116","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  161. 20:39:05.6982542","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  162. 20:39:05.6984207","about1.exe","2116","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
  163. 20:39:05.6986590","about1.exe","2116","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  164. 20:39:05.6988381","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  165. 20:39:05.6988512","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\IMM32.DLL","SUCCESS","AllocationSize: 114,688, EndOfFile: 110,080, NumberOfLinks: 1, DeletePending: False, Directory: False"
  166. 20:39:05.6988744","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\IMM32.DLL","SUCCESS","SyncType: SyncTypeOther"
  167. 20:39:05.6990538","about1.exe","2116","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
  168. 20:39:05.6995024","about1.exe","2116","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  169. 20:39:05.6996759","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  170. 20:39:05.6998430","about1.exe","2116","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
  171. 20:39:05.7000866","about1.exe","2116","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  172. 20:39:05.7002763","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  173. 20:39:05.7003291","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\IMM32.DLL","SUCCESS","SyncType: SyncTypeOther"
  174. 20:39:05.7005143","about1.exe","2116","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
  175. 20:39:05.7008956","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\IMM32.DLL","SUCCESS","Offset: 86,016, Length: 512, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  176. 20:39:05.7047511","about1.exe","2116","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  177. 20:39:05.7049243","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  178. 20:39:05.7050903","about1.exe","2116","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
  179. 20:39:05.7068296","about1.exe","2116","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  180. 20:39:05.7070037","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  181. 20:39:05.7077834","about1.exe","2116","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
  182. 20:39:05.7091182","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予LPK.DLL","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  183. 20:39:05.7095897","about1.exe","2116","CreateFile","C:\WINDOWS\system32\lpk.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  184. 20:39:05.7097889","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\lpk.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  185. 20:39:05.7099767","about1.exe","2116","CloseFile","C:\WINDOWS\system32\lpk.dll","SUCCESS",""
  186. 20:39:05.7102370","about1.exe","2116","CreateFile","C:\WINDOWS\system32\lpk.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  187. 20:39:05.7104385","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\lpk.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  188. 20:39:05.7104653","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\LPK.DLL","SUCCESS","SyncType: SyncTypeOther"
  189. 20:39:05.7106687","about1.exe","2116","CloseFile","C:\WINDOWS\system32\lpk.dll","SUCCESS",""
  190. 20:39:05.7112651","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予USP10.dll","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  191. 20:39:05.7117733","about1.exe","2116","CreateFile","C:\WINDOWS\system32\usp10.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  192. 20:39:05.7141940","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\usp10.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  193. 20:39:05.7144018","about1.exe","2116","CloseFile","C:\WINDOWS\system32\usp10.dll","SUCCESS",""
  194. 20:39:05.7146803","about1.exe","2116","CreateFile","C:\WINDOWS\system32\usp10.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  195. 20:39:05.7157204","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\usp10.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  196. 20:39:05.7157467","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\USP10.DLL","SUCCESS","SyncType: SyncTypeOther"
  197. 20:39:05.7162694","about1.exe","2116","CloseFile","C:\WINDOWS\system32\usp10.dll","SUCCESS",""
  198. 20:39:05.7176578","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\USP10.DLL","SUCCESS","Offset: 306,688, Length: 12,800, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  199. 20:39:05.7368452","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\LPK.DLL","SUCCESS","Offset: 19,456, Length: 512, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  200. 20:39:05.7546410","about1.exe","2116","CreateFile","C:\WINDOWS\system32\comctl32.dll","SUCCESS","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
  201. 20:39:05.7548824","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\comctl32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  202. 20:39:05.7549016","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\COMCTL32.dll","SUCCESS","AllocationSize: 622,592, EndOfFile: 617,472, NumberOfLinks: 1, DeletePending: False, Directory: False"
  203. 20:39:05.7549335","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\COMCTL32.DLL","SUCCESS","SyncType: SyncTypeOther"
  204. 20:39:05.7551553","about1.exe","2116","CreateFile","C:\WINDOWS\system32\COMCTL32.dll.124.Manifest","NAME NOT FOUND","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
  205. 20:39:05.7558509","about1.exe","2116","CreateFile","C:\WINDOWS\system32\COMCTL32.dll.124.Config","NAME NOT FOUND","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
  206. 20:39:05.7586382","about1.exe","2116","CloseFile","C:\WINDOWS\system32\comctl32.dll","SUCCESS",""
  207. 20:39:05.7618685","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\MSVCRT.DLL","SUCCESS","Offset: 328,192, Length: 2,048, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  208. 20:39:05.8138513","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\SHELL32.DLL","SUCCESS","Offset: 2,170,368, Length: 8,192, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  209. 20:39:05.8235688","about1.exe","2116","CreateFile","C:\WINDOWS\system32\shell32.dll","SUCCESS","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
  210. 20:39:05.8238012","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\shell32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  211. 20:39:05.8238193","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\SHELL32.dll","SUCCESS","AllocationSize: 8,372,224, EndOfFile: 8,367,104, NumberOfLinks: 1, DeletePending: False, Directory: False"
  212. 20:39:05.8238501","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\shell32.dll","SUCCESS","SyncType: SyncTypeOther"
  213. 20:39:05.8240674","about1.exe","2116","CreateFile","C:\WINDOWS\system32\SHELL32.dll.124.Manifest","NAME NOT FOUND","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
  214. 20:39:05.8244518","about1.exe","2116","CreateFile","C:\WINDOWS\system32\SHELL32.dll.124.Config","NAME NOT FOUND","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
  215. 20:39:05.8491972","about1.exe","2116","CloseFile","C:\WINDOWS\system32\shell32.dll","SUCCESS",""
  216. 20:39:05.8533038","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe.Local","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  217. 20:39:05.8536919","about1.exe","2116","CreateFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  218. 20:39:05.8538363","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83","SUCCESS","CreationTime: 2012/10/07 18:19:17, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2012/10/07 18:19:18, ChangeTime: 1601/01/01 9:00:00, FileAttributes: D"
  219. 20:39:05.8539648","about1.exe","2116","CloseFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83","SUCCESS",""
  220. 20:39:05.8541757","about1.exe","2116","CreateFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  221. 20:39:05.8544545","about1.exe","2116","CreateFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  222. 20:39:05.8546618","about1.exe","2116","CreateFileMapping","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  223. 20:39:05.8546814","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll","SUCCESS","AllocationSize: 1,064,960, EndOfFile: 1,054,208, NumberOfLinks: 1, DeletePending: False, Directory: False"
  224. 20:39:05.8548792","about1.exe","2116","CreateFileMapping","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll","SUCCESS","SyncType: SyncTypeOther"
  225. 20:39:05.8550803","about1.exe","2116","CloseFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll","SUCCESS",""
  226. 20:39:05.8551311","about1.exe","2116","ReadFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll","SUCCESS","Offset: 0, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  227. 20:39:05.8713919","about1.exe","2116","CreateFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  228. 20:39:05.8715978","about1.exe","2116","CreateFileMapping","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  229. 20:39:05.8716729","about1.exe","2116","CreateFileMapping","C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.5512_X-WW_35D4CE83\COMCTL32.DLL","SUCCESS","SyncType: SyncTypeOther"
  230. 20:39:05.8718766","about1.exe","2116","CloseFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll","SUCCESS",""
  231. 20:39:05.8725294","about1.exe","2116","ReadFile","C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.5512_X-WW_35D4CE83\COMCTL32.DLL","SUCCESS","Offset: 1,024, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  232. 20:39:05.8730764","about1.exe","2116","ReadFile","C:\WINDOWS\WINSXS\X86_MICROSOFT.WINDOWS.COMMON-CONTROLS_6595B64144CCF1DF_6.0.2600.5512_X-WW_35D4CE83\COMCTL32.DLL","SUCCESS","Offset: 593,920, Length: 1,536, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  233. 20:39:05.8849481","about1.exe","2116","CreateFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  234. 20:39:05.8850858","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","CreationTime: 2012/10/07 18:40:07, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2012/10/07 18:40:08, ChangeTime: 1601/01/01 9:00:00, FileAttributes: RHA"
  235. 20:39:05.8851593","about1.exe","2116","CloseFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS",""
  236. 20:39:05.8853244","about1.exe","2116","CreateFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  237. 20:39:05.8854166","about1.exe","2116","CreateFileMapping","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  238. 20:39:05.8854495","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","AllocationSize: 16,384, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False"
  239. 20:39:05.8855515","about1.exe","2116","CreateFileMapping","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","SyncType: SyncTypeOther"
  240. 20:39:05.8856420","about1.exe","2116","CloseFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS",""
  241. 20:39:05.8856839","about1.exe","2116","ReadFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","Offset: 0, Length: 749, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  242. 20:39:05.9167563","about1.exe","2116","CreateFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  243. 20:39:05.9168412","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","CreationTime: 2012/10/07 18:40:07, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2012/10/07 18:40:08, ChangeTime: 1601/01/01 9:00:00, FileAttributes: RHA"
  244. 20:39:05.9169150","about1.exe","2116","CloseFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS",""
  245. 20:39:05.9170815","about1.exe","2116","CreateFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  246. 20:39:05.9171737","about1.exe","2116","CreateFileMapping","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  247. 20:39:05.9171913","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","AllocationSize: 16,384, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False"
  248. 20:39:05.9172214","about1.exe","2116","CreateFileMapping","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","SyncType: SyncTypeOther"
  249. 20:39:05.9173133","about1.exe","2116","CloseFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS",""
  250. 20:39:05.9175044","about1.exe","2116","CreateFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
  251. 20:39:05.9177718","about1.exe","2116","CreateFileMapping","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  252. 20:39:05.9177905","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","AllocationSize: 16,384, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False"
  253. 20:39:05.9178196","about1.exe","2116","CreateFileMapping","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","SyncType: SyncTypeOther"
  254. 20:39:05.9179268","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS","AllocationSize: 16,384, EndOfFile: 749, NumberOfLinks: 1, DeletePending: False, Directory: False"
  255. 20:39:05.9180520","about1.exe","2116","CreateFile","C:\WINDOWS\WindowsShell.Config","NAME NOT FOUND","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
  256. 20:39:06.0253586","about1.exe","2116","CloseFile","C:\WINDOWS\WindowsShell.Manifest","SUCCESS",""
  257. 20:39:06.0312641","about1.exe","2116","SetEndOfFileInformationFile","C:\WINDOWS\system32\config\software.LOG","SUCCESS","EndOfFile: 8,192"
  258. 20:39:06.0315340","about1.exe","2116","SetEndOfFileInformationFile","C:\WINDOWS\system32\config\software.LOG","SUCCESS","EndOfFile: 8,192"
  259. 20:39:06.0334465","about1.exe","2116","ReadFile","C:\WINDOWS\system32\oleacc.dll","SUCCESS","Offset: 130,560, Length: 3,584, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  260. 20:39:06.0558178","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予OLEACCRC.DLL","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  261. 20:39:06.0563277","about1.exe","2116","CreateFile","C:\WINDOWS\system32\oleaccrc.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  262. 20:39:06.0565822","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\oleaccrc.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2012/10/07 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  263. 20:39:06.0567758","about1.exe","2116","CloseFile","C:\WINDOWS\system32\oleaccrc.dll","SUCCESS",""
  264. 20:39:06.0570644","about1.exe","2116","CreateFile","C:\WINDOWS\system32\oleaccrc.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  265. 20:39:06.0572806","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\oleaccrc.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  266. 20:39:06.0573147","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\OLEACCRC.DLL","SUCCESS","AllocationSize: 32,768, EndOfFile: 16,896, NumberOfLinks: 1, DeletePending: False, Directory: False"
  267. 20:39:06.0575390","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\oleaccrc.dll","SUCCESS","SyncType: SyncTypeOther"
  268. 20:39:06.0577496","about1.exe","2116","CloseFile","C:\WINDOWS\system32\oleaccrc.dll","SUCCESS",""
  269. 20:39:06.0577952","about1.exe","2116","ReadFile","C:\WINDOWS\system32\OLEACCRC.DLL","SUCCESS","Offset: 0, Length: 16,896, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  270. 20:39:06.0601547","about1.exe","2116","CreateFile","C:\WINDOWS\system32\tapi32.dll","SUCCESS","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
  271. 20:39:06.0603930","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\tapi32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  272. 20:39:06.0604106","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\TAPI32.dll","SUCCESS","AllocationSize: 196,608, EndOfFile: 181,760, NumberOfLinks: 1, DeletePending: False, Directory: False"
  273. 20:39:06.0604402","about1.exe","2116","CreateFileMapping","C:\WINDOWS\System32\TAPI32.dll","SUCCESS","SyncType: SyncTypeOther"
  274. 20:39:06.0606486","about1.exe","2116","CreateFile","C:\WINDOWS\system32\TAPI32.dll.124.Manifest","NAME NOT FOUND","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
  275. 20:39:06.0610213","about1.exe","2116","CreateFile","C:\WINDOWS\system32\TAPI32.dll.124.Config","NAME NOT FOUND","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
  276. 20:39:06.0855501","about1.exe","2116","CloseFile","C:\WINDOWS\system32\tapi32.dll","SUCCESS",""
  277. 20:39:06.0862178","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe.Local","NAME NOT FOUND","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  278. 20:39:06.0866055","about1.exe","2116","CreateFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  279. 20:39:06.0867494","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83","SUCCESS","CreationTime: 2012/10/07 18:19:17, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2012/10/07 18:19:18, ChangeTime: 1601/01/01 9:00:00, FileAttributes: D"
  280. 20:39:06.0926817","about1.exe","2116","CloseFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83","SUCCESS",""
  281. 20:39:06.0928991","about1.exe","2116","CreateFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  282. 20:39:06.0943990","about1.exe","2116","CreateFile","C:\WINDOWS","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  283. 20:39:06.0944797","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS","SUCCESS","CreationTime: 2012/10/07 18:03:56, LastAccessTime: 2012/10/07 0:00:00, LastWriteTime: 2012/10/07 18:03:58, ChangeTime: 1601/01/01 9:00:00, FileAttributes: D"
  284. 20:39:06.0945524","about1.exe","2116","CloseFile","C:\WINDOWS","SUCCESS",""
  285. 20:39:06.0950510","about1.exe","2116","ReadFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","Offset: 66,560, Length: 29,696, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  286. 20:39:06.1052981","about1.exe","2116","ReadFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","Offset: 1,024, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  287. 20:39:06.1288830","about1.exe","2116","ReadFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","Offset: 33,792, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  288. 20:39:06.6773594","about1.exe","2116","CreateFile","C:\","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  289. 20:39:06.6774094","about1.exe","2116","QueryNameInformationFile","C:\","SUCCESS","Name: \"
  290. 20:39:06.6774393","about1.exe","2116","QueryInformationVolume","C:\","SUCCESS","VolumeCreationTime: 1601/01/01 9:00:00, VolumeSerialNumber: 9455-E50D, SupportsObjects: False, VolumeLabel: "
  291. 20:39:06.6774664","about1.exe","2116","CloseFile","C:\","SUCCESS",""
  292. 20:39:06.6782229","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Application Data","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  293. 20:39:06.6782975","about1.exe","2116","QueryBasicInformationFile","C:\Documents and Settings\rik\Application Data","SUCCESS","CreationTime: 2012/10/07 18:49:52, LastAccessTime: 2012/10/07 0:00:00, LastWriteTime: 2012/10/07 18:19:58, ChangeTime: 1601/01/01 9:00:00, FileAttributes: RHD"
  294. 20:39:06.6783604","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\Application Data","SUCCESS",""
  295. 20:39:06.6785869","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","NAME NOT FOUND","Desired Access: Write Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a"
  296. 20:39:06.6787747","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Open Reparse Point, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
  297. 20:39:06.6789015","about1.exe","2116","QueryAttributeTagFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","INVALID PARAMETER",""
  298. 20:39:06.6790121","about1.exe","2116","QueryStandardInformationFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","AllocationSize: 98,304, EndOfFile: 98,304, NumberOfLinks: 1, DeletePending: False, Directory: False"
  299. 20:39:06.6791155","about1.exe","2116","QueryBasicInformationFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","CreationTime: 2013/01/26 20:31:08, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2013/01/26 18:42:16, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  300. 20:39:06.6792345","about1.exe","2116","QueryStreamInformationFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","INVALID PARAMETER",""
  301. 20:39:06.6793594","about1.exe","2116","QueryBasicInformationFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","CreationTime: 2013/01/26 20:31:08, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2013/01/26 18:42:16, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  302. 20:39:06.6794689","about1.exe","2116","QueryEaInformationFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","EaSize: 0"
  303. 20:39:06.6795820","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","Desired Access: Generic Write, Read Attributes, Delete, Disposition: OverwriteIf, Options: Sequential Access, Synchronous IO Non-Alert, Non-Directory File, Attributes: A, ShareMode: None, AllocationSize: 0, OpenResult: Created"
  304. 20:39:06.6796843","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Application Data","SUCCESS","Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  305. 20:39:06.6797625","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\Application Data","SUCCESS",""
  306. 20:39:06.6799977","about1.exe","2116","QueryAttributeInformationVolume","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","FileSystemAttributes: Case Preserved, Unicode, MaximumComponentNameLength: 255, FileSystemName: FAT32"
  307. 20:39:06.6800690","about1.exe","2116","QueryBasicInformationFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","CreationTime: 2013/01/26 20:39:06, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2013/01/26 20:39:08, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  308. 20:39:06.6801757","about1.exe","2116","QueryAttributeInformationVolume","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","FileSystemAttributes: Case Preserved, Unicode, MaximumComponentNameLength: 255, FileSystemName: FAT32"
  309. 20:39:06.6802522","about1.exe","2116","SetEndOfFileInformationFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","EndOfFile: 98,304"
  310. 20:39:06.6804075","about1.exe","2116","CreateFileMapping","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  311. 20:39:06.6804223","about1.exe","2116","QueryStandardInformationFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","AllocationSize: 98,304, EndOfFile: 98,304, NumberOfLinks: 1, DeletePending: False, Directory: False"
  312. 20:39:06.6804469","about1.exe","2116","CreateFileMapping","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","SyncType: SyncTypeOther"
  313. 20:39:06.6805330","about1.exe","2116","WriteFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","Offset: 0, Length: 65,536"
  314. 20:39:06.6807059","about1.exe","2116","ReadFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS","Offset: 32,768, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  315. 20:39:06.7774699","about1.exe","2116","WriteFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","Offset: 65,536, Length: 32,768"
  316. 20:39:06.7776679","about1.exe","2116","SetBasicInformationFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","CreationTime: 1601/01/01 9:00:00, LastAccessTime: 1601/01/01 9:00:00, LastWriteTime: 2013/01/26 18:42:16, ChangeTime: 1601/01/01 9:00:00, FileAttributes: n/a"
  317. 20:39:06.7778074","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝予about1.exe","SUCCESS",""
  318. 20:39:06.7778998","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS",""
  319. 20:39:06.7782004","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Local Settings\Temp","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
  320. 20:39:06.7793134","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Local Settings\Temp","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  321. 20:39:06.7795294","about1.exe","2116","QueryBasicInformationFile","C:\Documents and Settings\rik\Local Settings\Temp","SUCCESS","CreationTime: 2012/10/07 18:49:52, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2012/10/07 18:19:58, ChangeTime: 1601/01/01 9:00:00, FileAttributes: D"
  322. 20:39:06.7797475","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\Local Settings\Temp","SUCCESS",""
  323. 20:39:06.7800076","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Local Settings\Temp\exp2.tmp","SUCCESS","Desired Access: Generic Read, Disposition: Create, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: None, AllocationSize: 0, OpenResult: Created"
  324. 20:39:06.7802607","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\Local Settings\Temp\exp2.tmp","SUCCESS",""
  325. 20:39:06.7805636","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Local Settings\Temp\exp2.tmp.bat","SUCCESS","Desired Access: Generic Write, Read Attributes, Disposition: OverwriteIf, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: H, ShareMode: Read, AllocationSize: 0, OpenResult: Created"
  326. 20:39:06.7807032","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Local Settings\Temp","SUCCESS","Desired Access: Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: N, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  327. 20:39:06.7808186","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\Local Settings\Temp","SUCCESS",""
  328. 20:39:06.7809740","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\SHLWAPI.DLL","SUCCESS","Offset: 267,264, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  329. 20:39:06.8435646","about1.exe","2116","WriteFile","C:\Documents and Settings\rik\Local Settings\Temp\exp2.tmp.bat","SUCCESS","Offset: 0, Length: 217"
  330. 20:39:06.8438459","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\Local Settings\Temp\exp2.tmp.bat","SUCCESS",""
  331. 20:39:06.8444055","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  332. 20:39:06.8446379","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/21 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  333. 20:39:06.8448078","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  334. 20:39:06.8452503","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  335. 20:39:06.8454294","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/21 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  336. 20:39:06.8455986","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  337. 20:39:06.8458562","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  338. 20:39:06.8460406","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  339. 20:39:06.8460683","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","AllocationSize: 491,520, EndOfFile: 486,400, NumberOfLinks: 1, DeletePending: False, Directory: False"
  340. 20:39:06.8460931","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeOther"
  341. 20:39:06.8461169","about1.exe","2116","ReadFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Offset: 0, Length: 4,096, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  342. 20:39:06.8596974","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeOther"
  343. 20:39:06.8603217","about1.exe","2116","CreateFile","C:\WINDOWS\system32\apphelp.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  344. 20:39:06.8604975","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\apphelp.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  345. 20:39:06.8606629","about1.exe","2116","CloseFile","C:\WINDOWS\system32\apphelp.dll","SUCCESS",""
  346. 20:39:06.8609028","about1.exe","2116","CreateFile","C:\WINDOWS\system32\apphelp.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  347. 20:39:06.8610808","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\apphelp.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  348. 20:39:06.8610939","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\Apphelp.dll","SUCCESS","AllocationSize: 131,072, EndOfFile: 125,952, NumberOfLinks: 1, DeletePending: False, Directory: False"
  349. 20:39:06.8612710","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\apphelp.dll","SUCCESS","SyncType: SyncTypeOther"
  350. 20:39:06.8614501","about1.exe","2116","CloseFile","C:\WINDOWS\system32\apphelp.dll","SUCCESS",""
  351. 20:39:06.8614831","about1.exe","2116","ReadFile","C:\WINDOWS\system32\Apphelp.dll","SUCCESS","Offset: 0, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  352. 20:39:06.8682105","about1.exe","2116","CreateFile","C:\WINDOWS\system32\apphelp.dll","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  353. 20:39:06.8683837","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\apphelp.dll","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  354. 20:39:06.8685488","about1.exe","2116","CloseFile","C:\WINDOWS\system32\apphelp.dll","SUCCESS",""
  355. 20:39:06.8687860","about1.exe","2116","CreateFile","C:\WINDOWS\system32\apphelp.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  356. 20:39:06.8689625","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\apphelp.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  357. 20:39:06.8690153","about1.exe","2116","CreateFileMapping","C:\WINDOWS\SYSTEM32\APPHELP.DLL","SUCCESS","SyncType: SyncTypeOther"
  358. 20:39:06.8691963","about1.exe","2116","CloseFile","C:\WINDOWS\system32\apphelp.dll","SUCCESS",""
  359. 20:39:06.8695098","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\APPHELP.DLL","SUCCESS","Offset: 117,248, Length: 2,560, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  360. 20:39:06.8718928","about1.exe","2116","CreateFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
  361. 20:39:06.8720422","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","AllocationSize: 1,212,416, EndOfFile: 1,202,774, NumberOfLinks: 1, DeletePending: False, Directory: False"
  362. 20:39:06.8725364","about1.exe","2116","CreateFileMapping","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  363. 20:39:06.8725501","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","AllocationSize: 1,212,416, EndOfFile: 1,202,774, NumberOfLinks: 1, DeletePending: False, Directory: False"
  364. 20:39:06.8725736","about1.exe","2116","CreateFileMapping","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","SyncType: SyncTypeOther"
  365. 20:39:06.8727278","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","AllocationSize: 1,212,416, EndOfFile: 1,202,774, NumberOfLinks: 1, DeletePending: False, Directory: False"
  366. 20:39:06.8729507","about1.exe","2116","CreateFile","C:\WINDOWS\AppPatch\systest.sdb","NAME NOT FOUND","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a"
  367. 20:39:06.8731999","about1.exe","2116","CreateFile","C:\WINDOWS\system32","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  368. 20:39:06.8733066","about1.exe","2116","QueryDirectory","C:\WINDOWS\system32\cmd.exe","SUCCESS","Filter: cmd.exe, 1: cmd.exe"
  369. 20:39:06.8734611","about1.exe","2116","CloseFile","C:\WINDOWS\system32","SUCCESS",""
  370. 20:39:06.8739092","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  371. 20:39:06.8740869","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/21 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  372. 20:39:06.8742582","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  373. 20:39:06.8766705","about1.exe","2116","CreateFile","C:\","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  374. 20:39:06.8766979","about1.exe","2116","QueryDirectory","C:\WINDOWS","SUCCESS","Filter: WINDOWS, 1: WINDOWS"
  375. 20:39:06.8767361","about1.exe","2116","CloseFile","C:\","SUCCESS",""
  376. 20:39:06.8776868","about1.exe","2116","CreateFile","C:\WINDOWS","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  377. 20:39:06.8777547","about1.exe","2116","QueryDirectory","C:\WINDOWS\system32","SUCCESS","Filter: system32, 1: system32"
  378. 20:39:06.8778326","about1.exe","2116","CloseFile","C:\WINDOWS","SUCCESS",""
  379. 20:39:06.8786026","about1.exe","2116","CreateFile","C:\WINDOWS\system32","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  380. 20:39:06.8787065","about1.exe","2116","QueryDirectory","C:\WINDOWS\system32\cmd.exe","SUCCESS","Filter: cmd.exe, 1: cmd.exe"
  381. 20:39:06.8799066","about1.exe","2116","CloseFile","C:\WINDOWS\system32","SUCCESS",""
  382. 20:39:06.8801394","about1.exe","2116","ReadFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","Offset: 143,360, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  383. 20:39:06.8972385","about1.exe","2116","ReadFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","Offset: 589,824, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  384. 20:39:06.9082686","about1.exe","2116","ReadFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","Offset: 815,104, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  385. 20:39:06.9154964","about1.exe","2116","ReadFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","Offset: 745,472, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  386. 20:39:06.9164384","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  387. 20:39:06.9166194","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/21 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  388. 20:39:06.9167904","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  389. 20:39:06.9171913","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\VERSION.DLL","SUCCESS","Offset: 15,872, Length: 512, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  390. 20:39:06.9293188","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  391. 20:39:06.9294965","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/21 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  392. 20:39:06.9296666","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  393. 20:39:06.9299085","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  394. 20:39:06.9300932","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  395. 20:39:06.9301074","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","AllocationSize: 491,520, EndOfFile: 486,400, NumberOfLinks: 1, DeletePending: False, Directory: False"
  396. 20:39:06.9302899","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeOther"
  397. 20:39:06.9304737","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  398. 20:39:06.9305332","about1.exe","2116","ReadFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Offset: 0, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  399. 20:39:06.9314654","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  400. 20:39:06.9316414","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  401. 20:39:06.9318107","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  402. 20:39:06.9320529","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  403. 20:39:06.9322351","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  404. 20:39:06.9322482","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","AllocationSize: 491,520, EndOfFile: 486,400, NumberOfLinks: 1, DeletePending: False, Directory: False"
  405. 20:39:06.9322711","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeOther"
  406. 20:39:06.9324547","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  407. 20:39:06.9325460","about1.exe","2116","ReadFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Offset: 245,760, Length: 32,768, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  408. 20:39:06.9432306","about1.exe","2116","ReadFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Offset: 454,656, Length: 31,744, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  409. 20:39:06.9541001","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  410. 20:39:06.9542773","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  411. 20:39:06.9544471","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  412. 20:39:06.9546896","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  413. 20:39:06.9548712","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  414. 20:39:06.9548849","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","AllocationSize: 491,520, EndOfFile: 486,400, NumberOfLinks: 1, DeletePending: False, Directory: False"
  415. 20:39:06.9549086","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeOther"
  416. 20:39:06.9550919","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  417. 20:39:06.9555596","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  418. 20:39:06.9557367","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  419. 20:39:06.9559060","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  420. 20:39:06.9561476","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  421. 20:39:06.9563292","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  422. 20:39:06.9563423","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","AllocationSize: 491,520, EndOfFile: 486,400, NumberOfLinks: 1, DeletePending: False, Directory: False"
  423. 20:39:06.9563652","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeOther"
  424. 20:39:06.9565482","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  425. 20:39:06.9574553","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  426. 20:39:06.9576322","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  427. 20:39:06.9578020","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  428. 20:39:06.9578551","about1.exe","2116","CreateFile","C:\","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  429. 20:39:06.9578830","about1.exe","2116","QueryDirectory","C:\WINDOWS","SUCCESS","Filter: WINDOWS, 1: WINDOWS"
  430. 20:39:06.9579227","about1.exe","2116","CloseFile","C:\","SUCCESS",""
  431. 20:39:06.9580481","about1.exe","2116","CreateFile","C:\WINDOWS","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  432. 20:39:06.9581160","about1.exe","2116","QueryDirectory","C:\WINDOWS\system32","SUCCESS","Filter: system32, 1: system32"
  433. 20:39:06.9581934","about1.exe","2116","CloseFile","C:\WINDOWS","SUCCESS",""
  434. 20:39:06.9583566","about1.exe","2116","CreateFile","C:\WINDOWS\system32","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  435. 20:39:06.9584610","about1.exe","2116","QueryDirectory","C:\WINDOWS\system32\cmd.exe","SUCCESS","Filter: cmd.exe, 1: cmd.exe"
  436. 20:39:06.9586136","about1.exe","2116","CloseFile","C:\WINDOWS\system32","SUCCESS",""
  437. 20:39:06.9588332","about1.exe","2116","CloseFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS",""
  438. 20:39:06.9609384","about1.exe","2116","QueryNameInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Name: \WINDOWS\System32\cmd.exe"
  439. 20:39:06.9613723","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  440. 20:39:06.9615505","about1.exe","2116","QueryBasicInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","CreationTime: 2008/08/20 12:00:00, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2008/08/20 12:00:00, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  441. 20:39:06.9617209","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  442. 20:39:06.9617740","about1.exe","2116","CreateFile","C:\","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  443. 20:39:06.9618022","about1.exe","2116","QueryDirectory","C:\WINDOWS","SUCCESS","Filter: WINDOWS, 1: WINDOWS"
  444. 20:39:06.9618394","about1.exe","2116","CloseFile","C:\","SUCCESS",""
  445. 20:39:06.9619657","about1.exe","2116","CreateFile","C:\WINDOWS","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  446. 20:39:06.9620338","about1.exe","2116","QueryDirectory","C:\WINDOWS\System32","SUCCESS","Filter: System32, 1: system32"
  447. 20:39:06.9621121","about1.exe","2116","CloseFile","C:\WINDOWS","SUCCESS",""
  448. 20:39:06.9622800","about1.exe","2116","CreateFile","C:\WINDOWS\system32","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  449. 20:39:06.9623853","about1.exe","2116","QueryDirectory","C:\WINDOWS\system32\cmd.exe","SUCCESS","Filter: cmd.exe, 1: cmd.exe"
  450. 20:39:06.9625387","about1.exe","2116","CloseFile","C:\WINDOWS\system32","SUCCESS",""
  451. 20:39:06.9654938","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","AllocationSize: 491,520, EndOfFile: 486,400, NumberOfLinks: 1, DeletePending: False, Directory: False"
  452. 20:39:06.9656664","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  453. 20:39:06.9656798","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","AllocationSize: 491,520, EndOfFile: 486,400, NumberOfLinks: 1, DeletePending: False, Directory: False"
  454. 20:39:06.9657036","about1.exe","2116","CreateFileMapping","C:\WINDOWS\system32\cmd.exe","SUCCESS","SyncType: SyncTypeOther"
  455. 20:39:06.9667029","about1.exe","2116","ReadFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Offset: 99,328, Length: 30,720, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  456. 20:39:06.9794243","about1.exe","2116","CreateFile","C:\WINDOWS\system32\cmd.exe.Manifest","NAME NOT FOUND","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
  457. 20:39:06.9796090","about1.exe","2116","ReadFile","C:\WINDOWS\system32\cmd.exe","SUCCESS","Offset: 247,296, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  458. 20:39:06.9803202","about1.exe","2116","CloseFile","C:\WINDOWS\system32\cmd.exe","SUCCESS",""
  459. 20:39:06.9804641","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","Desired Access: Read Data/List Directory, Execute/Traverse, Read Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
  460. 20:39:06.9846945","about1.exe","2116","CreateFileMapping","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
  461. 20:39:06.9847082","about1.exe","2116","QueryStandardInformationFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","AllocationSize: 98,304, EndOfFile: 98,304, NumberOfLinks: 1, DeletePending: False, Directory: False"
  462. 20:39:06.9847214","about1.exe","2116","CreateFileMapping","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","SyncType: SyncTypeOther"
  463. 20:39:06.9848454","about1.exe","2116","CreateFileMapping","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","SyncType: SyncTypeOther"
  464. 20:39:06.9857648","about1.exe","2116","CreateFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
  465. 20:39:06.9859115","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","AllocationSize: 1,212,416, EndOfFile: 1,202,774, NumberOfLinks: 1, DeletePending: False, Directory: False"
  466. 20:39:06.9860472","about1.exe","2116","CreateFileMapping","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  467. 20:39:06.9860604","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","AllocationSize: 1,212,416, EndOfFile: 1,202,774, NumberOfLinks: 1, DeletePending: False, Directory: False"
  468. 20:39:06.9860835","about1.exe","2116","CreateFileMapping","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","SyncType: SyncTypeOther"
  469. 20:39:06.9862350","about1.exe","2116","QueryStandardInformationFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS","AllocationSize: 1,212,416, EndOfFile: 1,202,774, NumberOfLinks: 1, DeletePending: False, Directory: False"
  470. 20:39:06.9870191","about1.exe","2116","CreateFile","C:\WINDOWS\AppPatch\systest.sdb","NAME NOT FOUND","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: N, ShareMode: Read, AllocationSize: n/a"
  471. 20:39:06.9872264","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Application Data","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  472. 20:39:06.9873005","about1.exe","2116","QueryDirectory","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","Filter: KB00777165.exe, 1: KB00777165.exe"
  473. 20:39:06.9883942","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\Application Data","SUCCESS",""
  474. 20:39:06.9886277","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  475. 20:39:06.9892904","about1.exe","2116","QueryBasicInformationFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","CreationTime: 2013/01/26 20:39:06, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2013/01/26 18:42:16, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  476. 20:39:06.9893518","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS",""
  477. 20:39:06.9894426","about1.exe","2116","CreateFile","C:\Documents and Settings","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  478. 20:39:06.9901732","about1.exe","2116","QueryDirectory","C:\Documents and Settings\rik","SUCCESS","Filter: rik, 1: rik"
  479. 20:39:06.9902137","about1.exe","2116","CloseFile","C:\Documents and Settings","SUCCESS",""
  480. 20:39:06.9913666","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  481. 20:39:06.9914370","about1.exe","2116","QueryBasicInformationFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","CreationTime: 2013/01/26 20:39:06, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2013/01/26 18:42:16, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  482. 20:39:06.9914988","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS",""
  483. 20:39:06.9923771","about1.exe","2116","CreateFile","C:\Documents and Settings","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  484. 20:39:06.9924084","about1.exe","2116","QueryDirectory","C:\Documents and Settings\rik","SUCCESS","Filter: rik, 1: rik"
  485. 20:39:06.9924483","about1.exe","2116","CloseFile","C:\Documents and Settings","SUCCESS",""
  486. 20:39:06.9933076","about1.exe","2116","QueryBasicInformationFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","CreationTime: 2013/01/26 20:39:06, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2013/01/26 18:42:16, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  487. 20:39:06.9933697","about1.exe","2116","QueryStandardInformationFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","AllocationSize: 98,304, EndOfFile: 98,304, NumberOfLinks: 1, DeletePending: False, Directory: False"
  488. 20:39:06.9935353","about1.exe","2116","CloseFile","C:\WINDOWS\AppPatch\sysmain.sdb","SUCCESS",""
  489. 20:39:06.9944597","about1.exe","2116","QueryNameInformationFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","Name: \Documents and Settings\RIK\Application Data\KB00777165.exe"
  490. 20:39:06.9954828","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","Desired Access: Read Attributes, Disposition: Open, Options: Open Reparse Point, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
  491. 20:39:06.9955532","about1.exe","2116","QueryBasicInformationFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","CreationTime: 2013/01/26 20:39:06, LastAccessTime: 2013/01/26 0:00:00, LastWriteTime: 2013/01/26 18:42:16, ChangeTime: 1601/01/01 9:00:00, FileAttributes: A"
  492. 20:39:06.9956149","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS",""
  493. 20:39:06.9963530","about1.exe","2116","CreateFile","C:\Documents and Settings","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
  494. 20:39:06.9963837","about1.exe","2116","QueryDirectory","C:\Documents and Settings\RIK","SUCCESS","Filter: RIK, 1: rik"
  495. 20:39:06.9964245","about1.exe","2116","CloseFile","C:\Documents and Settings","SUCCESS",""
  496. 20:39:06.9978929","about1.exe","2116","QueryStandardInformationFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","AllocationSize: 98,304, EndOfFile: 98,304, NumberOfLinks: 1, DeletePending: False, Directory: False"
  497. 20:39:06.9979571","about1.exe","2116","CreateFileMapping","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
  498. 20:39:06.9979702","about1.exe","2116","QueryStandardInformationFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","AllocationSize: 98,304, EndOfFile: 98,304, NumberOfLinks: 1, DeletePending: False, Directory: False"
  499. 20:39:06.9979934","about1.exe","2116","CreateFileMapping","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","SyncType: SyncTypeOther"
  500. 20:39:06.9983681","about1.exe","2116","CreateFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe.Manifest","NAME NOT FOUND","Desired Access: Generic Read/Execute, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a"
  501. 20:39:06.9984572","about1.exe","2116","ReadFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS","Offset: 96,256, Length: 2,048, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  502. 20:39:07.0196998","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\Application Data\KB00777165.exe","SUCCESS",""
  503. 20:39:07.0210631","about1.exe","2116","CloseFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83","SUCCESS",""
  504. 20:39:07.0221610","about1.exe","2116","ReadFile","C:\WINDOWS\SYSTEM32\MSVCP60.DLL","SUCCESS","Offset: 344,064, Length: 16,384, I/O Flags: Non-cached, Paging I/O, Synchronous Paging I/O"
  505. 20:39:07.1199880","about1.exe","2116","CloseFile","C:\Documents and Settings\rik\繝・せ繧ッ繝医ャ繝・,"SUCCESS",""
  506. 20:39:07.1201414","about1.exe","2116","CloseFile","C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83","SUCCESS",""
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
Top