Joe Sandbox - Report 88

General Information

Start time:	14:33:56
Start date:	16/08/2012
Overall analysis duration:	0h 3m 18s
Sample file name:	iPhone 5 Battery.doc
Cookbook file name:	officeall.jbs
Analysis system description:	XP SP3, Office 2003 SP3
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Errors:	Too many NtProtectVirtualMemory calls (excessive behavior) Too many NtAllocateVirtualMemory calls (excessive behavior) Too many NtUserMessageCall calls (excessive behavior) Too many NtSetInformationFile calls (excessive behavior) Too many NtWriteFile calls (excessive behavior)

Classification / Threat Score

Persistence, Installation, Boot Survival :
Hiding, Stealthiness, Detection and Removal Protection :
Security Solution / Mechanism bypass, termination and removal, Anti Debugging, VM Detection :
Spreading :
Exploiting :
Networking :
Data spying, Sniffing, Keylogging, Ebanking Fraud :

Matching Signatures

Binary contains paths to debug symbols
Creates files inside the user directory
Creates temporary files
Downloads files
Printf formatting strings found in memory and binary data
Reads ini files
Runs a DLL by calling functions
Spawns processes
Urls found in memory or binary data
Creates an autostart registry key
Creates mutexes	\BaseNamedObjects\Local\Mutex_MSOSharedMem \BaseNamedObjects\DirectSound DllMain mutex (0x00000488) \BaseNamedObjects\Local\Mso97SharedDg20321108172Mutex \BaseNamedObjects\oleacc-msaa-loaded \BaseNamedObjects\DDrawWindowListMutex \BaseNamedObjects\__DDrawExclMode__ \BaseNamedObjects\StiTraceMutexSti_Trace.log \BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-507921405-1960408961-839522115-500 \BaseNamedObjects\Local\Mso97SharedDg19521108172Mutex \BaseNamedObjects\Local\Mso97SharedDg19211108172Mutex \BaseNamedObjects\Global\WiaDebugFileMut \BaseNamedObjects\Local\Mso97SharedDg19531108172Mutex \BaseNamedObjects\OfficeAssistantStateMutex \BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-507921405-1960408961-839522115-500 \BaseNamedObjects\__DDrawCheckExclMode__
Downloads files from webservers via HTTP
Drops PE files
Found strings which match to known social media urls
May tried to detect the virtual machine to detect the environment (VM Detection)
Performs DNS lookups
Posts data to webserver
Allocates a big amount of memory (probably used for heap spraying)
Creates and opens a fake document (probably a fake document to hide exploiting)
Document exploit detected (droppes PE files)
Document exploit detected (performs DNS queries)
Document exploit detected (performs HTTP gets)
Document exploit detected (process start blacklist hit)
Infects executable files (exe, dll, sys, html)	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

Startup

system is office2003sp3 WINWORD.EXE (PID: 1160 MD5: 443747857245BF90847AE396C53470A6) ~WORDL.tmp (PID: 1112 MD5: 99C47CE55EF67DAEE72E82608E4F62DD) rundll32.exe (PID: 760 MD5: 037B1E7798960E0420003D05BB577EE6) cmd.exe (PID: 868 MD5: 6D778E0F95447E6546553EEEA709D03C) cmd.exe (PID: 1096 MD5: 6D778E0F95447E6546553EEEA709D03C) WINWORD.EXE (PID: 900 MD5: 443747857245BF90847AE396C53470A6) svchost.exe (PID: 1832 MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18) cleanup

system is office2003sp3

WINWORD.EXE (PID: 1160 MD5: 443747857245BF90847AE396C53470A6)

~WORDL.tmp (PID: 1112 MD5: 99C47CE55EF67DAEE72E82608E4F62DD)

rundll32.exe (PID: 760 MD5: 037B1E7798960E0420003D05BB577EE6)

cmd.exe (PID: 868 MD5: 6D778E0F95447E6546553EEEA709D03C)

cmd.exe (PID: 1096 MD5: 6D778E0F95447E6546553EEEA709D03C)

WINWORD.EXE (PID: 900 MD5: 443747857245BF90847AE396C53470A6)

svchost.exe (PID: 1832 MD5: 27C6D03BCDB8CFEB96B716F3D8BE3E18)

cleanup

Created / dropped Files

File Path	MD5
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	A4DE5E2A16D82D803735967C783CA368
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~WRD0002.doc	3B8EE5F6275A30671021B1594506A58D
C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc	13847C659F831C6AEA3C480597E424C8
C:\DOCUME~1\ADMINI~1\LOCALS~1\~$hone 5.doc	9B2BEAB1F4B66A3331B6C566C7E6DDFA
C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	99C47CE55EF67DAEE72E82608E4F62DD
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Local Settings.LNK	1C17F458C1BD5844CBC9E71F84AD77B9
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\iPhone 5.doc.LNK	34ECC7FCCE484F8B7042FA98735EC494
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat	B030A356C4F75056E6F7FAD09309FE2E
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC	FFE89BDDF49F24398D21523137827222
C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dot	A0F4BD67F4388E1BC61D5DBB85D5650F
C:\Documents and Settings\Administrator\Application Data\taskman.dll	FE7E03F7F62F2D65C5B8E233300A373C
C:\Documents and Settings\Administrator\Desktop\~$hone 5 Battery.doc	411239DF57C33F1405AF3453F7EC9A35
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	B26FB08CB1A991E87742C0C5DFD5CAE7
C:\WINDOWS\wiadebug.log	2C04268C23022887648C318054663351
C:\WINDOWS\wiaservc.log	5F8BD4D1DCDF5F8FC86B68BE433B6245
\ROUTER	6685DD0933ADE478A22AE7864388C7F7
\net\NtControlPipe11	67118A81A9461CA93D1DCBD673828CFE
\srvsvc	00010789CF97BAA5F49E8C7BF0605D58

Contacted Domains

No contacted domains info

Contacted IPs

No contacted IP infos

Static File Info

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 5.1, Code page: 1252, Title: , Author: Mark, Template: Normal, Last Saved By: Mark, Revision Number: 2, Name of Creating Application: Microsoft Office Word, Create Time/Date: Thu Aug 9 12:38:00 2012, Last Saved Time/Date: Thu Aug 9 12:38:00 2012, Number of Pages: 1, Number of Words: 7, Number of Characters: 41, Security: 0
File name:	iPhone 5 Battery.doc
File size:	298496
MD5:	7e3770351aed43fd6c5cab8e06dc0300
SHA1:	b4562ef0cd54234374ff9d24e0d1b01c1db5e873
SHA256:	742db588c3cfa416215619db34e168be58846058f7528adee8358bb8b8b68fe3
SHA512:	3c1c1189eb94725517024761d4a31ba351611ad432ea0dcce89e4961c28c7233363f6feb431602308ff704396781df62147907e382a14b1754d7b9e31ca2fac6

String Analysis

Debug symbol paths

String value	Source
gdi32.pdb	6C3CF.dmp.dr
user32.pdb	6C3CF.dmp.dr
setupapi.pdb	6C3CF.dmp.dr
vsplab1\otools\BBT_TEMP\WINWORDO.pdb	6C3CF.dmp.dr
ole32.pdb	6C3CF.dmp.dr
d3d8thk.pdb	6C3CF.dmp.dr
version.pdb	6C3CF.dmp.dr
msctfime.pdb	6C3CF.dmp.dr
schannel.pdb	6C3CF.dmp.dr
ws2_32.pdb	6C3CF.dmp.dr
comdlg32.pdb	6C3CF.dmp.dr
COMRes.pdb	6C3CF.dmp.dr
unidrvui.pdb	6C3CF.dmp.dr
ieframe.pdb	6C3CF.dmp.dr
fontsub.pdb	6C3CF.dmp.dr
apphelp.pdb	6C3CF.dmp.dr
urlmon.pdb	6C3CF.dmp.dr
mxdwdrv.pdb	6C3CF.dmp.dr
msi.pdb	6C3CF.dmp.dr
Flash.pdb	6C3CF.dmp.dr
msasn1.pdb	6C3CF.dmp.dr
userenv.pdb	6C3CF.dmp.dr
crypt32.pdb	6C3CF.dmp.dr
dciman32.pdb	6C3CF.dmp.dr
sxs.pdb	6C3CF.dmp.dr
msvcrt.pdb	6C3CF.dmp.dr
winspool.pdb	6C3CF.dmp.dr
netapi32.pdb	6C3CF.dmp.dr
rpcrt4.pdb	6C3CF.dmp.dr
MSO.pdb	6C3CF.dmp.dr
secur32.pdb	6C3CF.dmp.dr
kernel32.pdb	6C3CF.dmp.dr
msctf.pdb	6C3CF.dmp.dr
ws2help.pdb	6C3CF.dmp.dr
clbcatq.pdb	6C3CF.dmp.dr
c:\postbuild\opt\microsoftwindowsgdiplus-1100-gdiplus.pdb	6C3CF.dmp.dr
msimg32.pdb	6C3CF.dmp.dr
normaliz.pdb	6C3CF.dmp.dr
iertutil.pdb	6C3CF.dmp.dr
imm32.pdb	6C3CF.dmp.dr
winword.pdb	6C3CF.dmp.dr
riched20.pdb	6C3CF.dmp.dr
advapi32.pdb	6C3CF.dmp.dr
mscms.pdb	6C3CF.dmp.dr
winsta.pdb	6C3CF.dmp.dr
shell32.pdb	6C3CF.dmp.dr
prntvpt.pdb	6C3CF.dmp.dr
d3d9.pdb	6C3CF.dmp.dr
dsound.pdb	6C3CF.dmp.dr
v\private\11.0\devsplab1\setup\X86\ship\Files\PFiles\Common\MSShared\Office11\MSO.pdb	6C3CF.dmp.dr
splab1\otools\BBT_TEMP\RICHED20O.pdb	6C3CF.dmp.dr
ntdll.pdb	6C3CF.dmp.dr
shlwapi.pdb	6C3CF.dmp.dr
wininet.pdb	6C3CF.dmp.dr
wtsapi32.pdb	6C3CF.dmp.dr
oleaut32.pdb	6C3CF.dmp.dr
comctl32.pdb	6C3CF.dmp.dr
uxtheme.pdb	6C3CF.dmp.dr
winmm.pdb	6C3CF.dmp.dr
MicrosoftWindowsCommon-Controls-6.0.2600.6028-comctl32.pdb	6C3CF.dmp.dr

Formattings for printf style functions

String value	Source
3[)%gY	WINWORD.EXE
Identified by %s7%1!ls!	WINWORD.EXE
Netscape Navigator profile: %s	WINWORD.EXE
%OHB"s	WINWORD.EXE
\|%SystemRoot%\system32\rsvpsp.dll	rundll32.exe
%s hr	WINWORD.EXE
%SystemRoot%\Debug\UserMode\userenv.bak	cmd.exe
%s Document\|%s\|All Files\|.*\|\|	WINWORD.EXE
var L_ACR_ReturnTo_TEXT = "Try to return to %s";	WINWORD.EXE
Unknown-Lear&n more about search provider preferences%Lear&n more about InPrivate Filtering	WINWORD.EXE
https://office.bcentral.com/eServices/index?DPC=%ProductCode%&DCC=%AppComponentCode%&AppName=%ApplicationName%&CLCID=%UILang%&HelpLCID=%HelpLang%	WINWORD.EXE, 6C3CF.dmp.dr
Start Page.Would you like to set your Start Page to "%s"?	WINWORD.EXE
%SystemRoot%\Debug\UserMode\userenv.log	cmd.exe
%s Line: %ld Character: %ld	WINWORD.EXE
Accelerators: %s	WINWORD.EXE
'&7%x/	WINWORD.EXE
Netscape versions less than 4.0"Netscape Navigator 4.0 profile: %s	WINWORD.EXE
%sAuthor: %s	WINWORD.EXE
End downloading component %s	WINWORD.EXE
>%PP@lw	WINWORD.EXE
%s (expiring)	WINWORD.EXE
%s\%s\%s\%s\%s\%s	cmd.exe
Do you want to replace it?+Cannot find %s.	WINWORD.EXE
Default: %s	WINWORD.EXE
loginmid=%s&nickid=1&s=%s	WINWORD.EXE, rundll32.exe, taskman.dll.dr, ~WORDL.tmp.dr
%s min	WINWORD.EXE
re = /%s/g;	WINWORD.EXE
G%L%8%N%O%P%4%R%E%T%I%V%	WINWORD.EXE
%SystemRoot%\System32\mswsock.dll	rundll32.exe
%P?T%P?<rP?XJP?`JP?8rP? rP?	WINWORD.EXE
Pw%n[w	cmd.exe
Connecting to site %s	WINWORD.EXE
%C&&]N	WINWORD.EXE
%ls %ls	cmd.exe
6This is the full list of %s. No filters are available.	WINWORD.EXE
Export the favorites to %s	WINWORD.EXE
Export the cookies to %s	WINWORD.EXE
Go to '%s'	WINWORD.EXE
)V%Y%[%]%_%a%c%e%g%i%k%m%o%q%s%	WINWORD.EXE
%s (Upgrade)	WINWORD.EXE
%u minute ago	WINWORD.EXE
PackagerWould you like to allow pop-ups from '%s'?Would you like to block pop-ups from '%s'?	WINWORD.EXE
New Folder (%d)	WINWORD.EXE
Disclosed to others who might contact you for marketing of services and/or products. You will have an opportunity to ask the site not to do this.%Disclosed to others for any purposes.	WINWORD.EXE
%oft Shared\office11\	WINWORD.EXE
YB\|)9;!}ga em`o%Gwhu	WINWORD.EXE
%sWhat's New: %s	WINWORD.EXE
Installing component %s	WINWORD.EXE
Tab Group %d	WINWORD.EXE
"%s"pInternet Explorer does not support this type of search provider.	WINWORD.EXE
%s%s%s	WINWORD.EXE, rundll32.exe, taskman.dll.dr, ~WORDL.tmp.dr
%systemroot%\system32\com\dmp	WINWORD.EXE
Back to %s (Alt+Left)	WINWORD.EXE
%u hours ago	WINWORD.EXE
http://%s.com	WINWORD.EXE
1Are you sure you want to delete History Item: %s?7Are you sure you want to delete these %d History items?5Are you sure you want to delete the selected Cookies?	WINWORD.EXE
Do you want to format it now?)The disk in drive %c cannot be formatted.	WINWORD.EXE
URL:%s Protocol	WINWORD.EXE
IVO28%dtw8QxVeJ2QUcN}lT]jI{jf(=1&L[-81-]66x5zbkkf(7)dqFgkW_BptK&IY9)z@'Ya0g)+vX'HDI1hlABAv(Q&g3&VT!fh'!$t.%,A3.0lTwZD0wv$wmN+.f=.37iv!-jbM^P$OHQ55'Ah=J][6]2.`Q)@hUlM.?=m~NjECtw0pl%6?zSI?kbKH?q@[=1uvG8D)8DZ9=]3pfHL}{f97s]o?OVu@NuCskaR*]2b8'80pIMk?~~O9=KQ=l3	cmd.exe
Shows or hides the status bar.%Shows or hides formatting indicators.	WINWORD.EXE
%s Accelerator	WINWORD.EXE
%f7A{[	~WORDL.tmp, rundll32.exe
%s (new)	WINWORD.EXE
%s (Alt+Z)	WINWORD.EXE
Pages visited %s%Pages visited in week starting %1!ws!#Pages visited from %1!ws! to %2!ws!	WINWORD.EXE
%sSubject: %s	WINWORD.EXE
Expires at: %s	WINWORD.EXE
Updated %s	WINWORD.EXE
%s\|%s\|All Files\|.*\|\|	WINWORD.EXE
Feed %d	WINWORD.EXE
%s (Default)cPlease choose another default search provider for Internet Explorer before removing this selection.	WINWORD.EXE
%d.%03d %d.%03d scale	WINWORD.EXE, 6C3CF.dmp.dr
?%IF?P	WINWORD.EXE
>%uE=u	WINWORD.EXE
%F?n=>A_p\|@	WINWORD.EXE
Search for "%s"	WINWORD.EXE
P?d%P?hrP?\%P?drP?\rP?XrP?TrP?PrP?LrP?HrP?p*P?DrP?	WINWORD.EXE
EncodeUrl = EncodeUrl + '%u' + OutputEncoder_TwoByteHex(c);	WINWORD.EXE
BCD%FG<YZ[	WINWORD.EXE
yOpening %d tabs at once might take a long time and cause Internet Explorer to respond slowly.	WINWORD.EXE
%s sec	WINWORD.EXE
F!jkr%non)bc	WINWORD.EXE
Import the favorites from %s	WINWORD.EXE
%s\%s\%s\%s\%s	cmd.exe
%u matches	WINWORD.EXE
H$Bee%n:	WINWORD.EXE
!f'V%naH	WINWORD.EXE
%s - Security Warning$Al&ways ask before opening this file	WINWORD.EXE
A%emC{	rundll32.exe
You have imported %i feeds.	WINWORD.EXE
%s Suggestions	WINWORD.EXE
http://office.bcentral.com/eServices/error?DPC=%ProductCode%&DCC=%AppComponentCode%&AppName=%ApplicationName%&CLCID=%UILang%&HelpLCID=%HelpLang%	WINWORD.EXE, 6C3CF.dmp.dr
Assertion failed: %s, file %s, line %d	cmd.exe
%sLast Updated: %s	WINWORD.EXE
6%<%:%>%(%@%=%B%0%D% %F%,%H%C%	WINWORD.EXE
%s (unverified publisher)	WINWORD.EXE
of webpages that are designed for older browsers.aA problem displaying %s caused Internet Explorer to refresh the webpage using Compatibility View.	WINWORD.EXE
/ !.#j%I'J9W;]=R?	WINWORD.EXE
loginmid=%s&nickid=0&s=%s	WINWORD.EXE, rundll32.exe, taskman.dll.dr, ~WORDL.tmp.dr
Add Search Providers...Mhttp://auto.search.msn.com/response.asp?MT={searchTerms}&srch=%d&prov=%s&utf8NThe following search provider is already installed. Do you want to replace it?9The following search provider is already installed:	WINWORD.EXE
Sho&w: %s0Add-ons that have been used by Internet Explorer-Add-ons that run without requiring permission$Downloaded ActiveX Controls (32-bit)-Add-ons currently loaded in Internet Explorer	WINWORD.EXE
Expires in: %s	WINWORD.EXE
e}vgOe2BCxwc~jb>>%nedPQRSpjdl	WINWORD.EXE
%d %d %d %d	cmd.exe
(Not verified) %s	WINWORD.EXE
%Opens a new Internet Explorer window./Adds the current page to your Favorites folder.&Previews how this document will print.*Prints the document in the selected frame.	WINWORD.EXE
%s%s.exe	WINWORD.EXE, rundll32.exe, taskman.dll.dr, ~WORDL.tmp.dr
text/x-ms-odc; charset=%s	WINWORD.EXE, 6C3CF.dmp.dr
%sLast Visited: %s	WINWORD.EXE
Expired %s	WINWORD.EXE
%e;3Yd;9	6C3CF.dmp.dr
%ld sites	WINWORD.EXE
https://office.bcentral.com/eServices/service?Command=WebPost&DPC=%ProductCode%&DCC=%AppComponentCode%&AppName=%ApplicationName%&CLCID=%UILang%&HelpLCID=%HelpLang%	WINWORD.EXE, 6C3CF.dmp.dr
-M/A!R#E%E'Q9N;E=	WINWORD.EXE
>s%GAZ	WINWORD.EXE
%s Feed %d	WINWORD.EXE
Pages visited at %s	WINWORD.EXE
Redirecting to site: %s	WINWORD.EXE
..+&%P	WINWORD.EXE
Forward to %s (Alt+Right)	WINWORD.EXE
DragDrop%lx	cmd.exe
Import the cookies from %s	WINWORD.EXE
AThere is no disk in drive %c.	WINWORD.EXE
(Default for %s Accelerator)jThis Accelerator runs code. To remove this Accelerator, please try Remove Programs from the Control Panel.	WINWORD.EXE
%Opens the webpage for this Web Slice.	WINWORD.EXE
Open '%s' in a new tab	WINWORD.EXE
(%d new)	WINWORD.EXE
Start downloading from site: %s	WINWORD.EXE
ache%OLK*	WINWORD.EXE, ~WORDL.tmp, cmd.exe
IVO28%dtw8QxVeJ2QUcN}lT]jI{jf(=1&L[-81-]66x5zbkkf(7)dqFgkW_BptK&IY9)z@'Ya0g)+vX'HDI1hlABAv(Q&g3&VT!fh'!$t.%,A3.0lTwZD0w	WINWORD.EXE
Search %s	WINWORD.EXE
%%s has requested information from you	WINWORD.EXE
%s (expired)	WINWORD.EXE
Getting data from cache %s#Website found. Waiting for reply...	WINWORD.EXE
c123%I	WINWORD.EXE
%d Weeks Ago	WINWORD.EXE
S%Y%J%[%U%]%?%_%Q%a%M%c%d%e%b%g%Z%i%^%k%\%m%`%o%h%q%f%s%A%u%v%w%l%y%t%{%\|%}%n%	WINWORD.EXE
%d.%03d %d.%03d translate	WINWORD.EXE, 6C3CF.dmp.dr
Application: %s	WINWORD.EXE
%$%,%4%<%P%	WINWORD.EXE
%u hour ago	WINWORD.EXE
%s (Default)	WINWORD.EXE
%$%,%4%<%l%	WINWORD.EXE
"$%n&896;<=??01Z34597	WINWORD.EXE
%d.%03d %d.%03d translate %d.%03d rotate %d.%03d %d.%03d translate	WINWORD.EXE, 6C3CF.dmp.dr
E&dit with %s	WINWORD.EXE
%u minutes ago	WINWORD.EXE
M8$e1`%e1	WINWORD.EXE
B9%IB2	WINWORD.EXE
,Select which folder you want to export from.+Where do you want to export your favorites?7Select where you would like your favorites exported to..Where do you want to import your cookies from?8You can select where we should import your cookies from.)Where do you want to export your cookies?6You can select where we should export your cookies to.-%s already exists.	WINWORD.EXE
Keep &maximum items (%i)	WINWORD.EXE
()*+,-0/ !2#$%gCUPTROIL^D^@345(7	WINWORD.EXE
l%s has been removed from this computer. Do you want to clean up your personalized settings for this program?	WINWORD.EXE
%O*@hv#	WINWORD.EXE
Navigate to '%s'	WINWORD.EXE
rI]%ipF	WINWORD.EXE
Insert a disk, and then try again.EThe disk in drive %c is not formatted.	WINWORD.EXE
Search with %s	WINWORD.EXE
This item expired %s	WINWORD.EXE
%sComments: %s	WINWORD.EXE
rundll32.exe "%s",start	WINWORD.EXE, rundll32.exe, ~WORDL.tmp.dr
%SystemRoot%\system32\rsvpsp.dll	rundll32.exe
Downloading from site: %s	WINWORD.EXE
A%l[ABa	WINWORD.EXE
Importing: %s	WINWORD.EXE
)+%-%/%1%3%5%7%9%<%>%@%B%D%	WINWORD.EXE
8A webpage is not responding on the following website: %s	WINWORD.EXE
3~SR]AP\XP(}e+xek/l``fh%ii8mr~<	WINWORD.EXE
88qB%S	WINWORD.EXE
%s, %s	WINWORD.EXE
Looking up %s	WINWORD.EXE
erJ `%I"	rundll32.exe
Search provider: %s	WINWORD.EXE
var L_ACR_Title_TEXT = "We were unable to return you to %s.";	WINWORD.EXE
Compatibility View(%s is now running in Compatibility View.	WINWORD.EXE
Export the feeds to %s	WINWORD.EXE
%N0l%N0L%N00%N0	6C3CF.dmp.dr
%s%03d.tmp	WINWORD.EXE
%s bytes	WINWORD.EXE
?Are you sure you want to import '%ls' to your Favorites folder?8Are you sure you want to export your Favorites to '%ls'?aFavorites cannot be imported because modification of favorites on this machine has been disabled.HThe Import/Export Wizard has been disabled by your system administrator.@Select Folder to Import Bookmarks	WINWORD.EXE
%1!s!, %2!s!%Do you want to run or save this file?	WINWORD.EXE
%sTitle: %s	WINWORD.EXE
O28%dtw8QxVeJ2QUcN}lT]jI{jf(=1&L[-81-]66x5zbkkf(7)dqFgkW_BptK&IY9)z@'Ya0g)+vX'HDI1hlABAv(Q&g3&VT!fh'!$t.%,A3.0lTwZD0wv$wmN+.f=.37iv!-jbM^P$	WINWORD.EXE
%d%% complete.CThe webpage could not be saved because one of its files is missing.	WINWORD.EXE
Microsoft Windows cannot go on standby because %General_AppName% is busy sending an error report or recovering your documents. You must wait for the operation to complete and close any open dialogs.	6C3CF.dmp.dr
%SystemRoot%\System32\winrnr.dll	rundll32.exe
Open in new tab (Ctrl+Enter)%Open '%s' in a tab group (Ctrl+Enter)	WINWORD.EXE
%SystemRoot%\system32\mswsock.dll	rundll32.exe
%F?ZJZ?	WINWORD.EXE
This is the new setting suggested by %s	WINWORD.EXE
Start downloading component %s	WINWORD.EXE
http://www.%s.com Launch Internet Explorer Browser Launch Internet Explorer Browser	WINWORD.EXE
%systemroot%\Registration	WINWORD.EXE
#T%O'V9	WINWORD.EXE
%d.%03d 0 translate -1 1 scale	WINWORD.EXE, 6C3CF.dmp.dr
%s File	WINWORD.EXE
Drive %c cannot be accessed.	WINWORD.EXE
Open all items (%u new)	WINWORD.EXE
>\%P=i	WINWORD.EXE
+Go to "%s" (Alt+Enter to open in a new tab)	WINWORD.EXE
re = /%s/g;	WINWORD.EXE
Filter by %s:jAre you sure you want to delete this feed item?	WINWORD.EXE
Open '%s' in a background tab	WINWORD.EXE

URLs

String value	Source
http://%s.com	WINWORD.EXE
http://9to5mac.com/2012/08/09/phch.	WINWORD.EXE
http://9to5mac.com/2012/08/09/photos-of-purported-next-gen-iphones-higher-capacity-battery-3-8v-1440-mah/	iPhone 5.doc.dr
http://adobe.com/as3/2006/builtin	WINWORD.EXE, iPhone 5 Battery.doc
http://ads1.msads.net/library/dapmsn.js	rundll32.exe
http://ads1.msads.net/library/primedns.gif	rundll32.exe
http://ads2.msads.net/cis/6/000/000/000/033/124.swf?fd=www.msn.com	rundll32.exe
http://amazon.fr/	WINWORD.EXE
http://amch.questionmarket.com/adsc/d981545/4/982710/randm.js	rundll32.exe
http://api.bing.com/qsonhs.aspx?form=asapiw&q=	rundll32.exe
http://api.bing.com/qsonhs.aspx?form=msn005&q=	rundll32.exe
http://api.search.live.com/qsml.aspx?query=	WINWORD.EXE
http://ariadna.elmundo.es/	WINWORD.EXE
http://ariadna.elmundo.es/favicon.ico	WINWORD.EXE
http://arianna.libero.it/	WINWORD.EXE
http://arianna.libero.it/favicon.ico	WINWORD.EXE
http://asp.usatoday.com/	WINWORD.EXE
http://asp.usatoday.com/favicon.ico	WINWORD.EXE
http://auone.jp/favicon.ico	WINWORD.EXE
http://auto.search.msn.com/response.asp?mt=	WINWORD.EXE
http://blst.msn.com/as/wea3/i/en-us/law/32.gif	rundll32.exe
http://br.search.yahoo.com/	WINWORD.EXE
http://browse.guardian.co.uk/	WINWORD.EXE
http://browse.guardian.co.uk/favicon.ico	WINWORD.EXE
http://busca.buscape.com.br/	WINWORD.EXE
http://busca.buscape.com.br/favicon.ico	WINWORD.EXE
http://busca.estadao.com.br/favicon.ico	WINWORD.EXE
http://busca.igbusca.com.br/	WINWORD.EXE
http://busca.igbusca.com.br//app/static/images/favicon.ico	WINWORD.EXE
http://busca.orange.es/	WINWORD.EXE
http://busca.uol.com.br/	WINWORD.EXE
http://busca.uol.com.br/favicon.ico	WINWORD.EXE
http://buscador.lycos.es/	WINWORD.EXE
http://buscador.terra.com.br/	WINWORD.EXE
http://buscador.terra.com/	WINWORD.EXE
http://buscador.terra.com/favicon.ico	WINWORD.EXE
http://buscador.terra.es/	WINWORD.EXE
http://buscar.ozu.es/	WINWORD.EXE
http://buscar.ya.com/	WINWORD.EXE
http://busqueda.aol.com.mx/	WINWORD.EXE
http://cerca.lycos.it/	WINWORD.EXE
http://cgi.search.biglobe.ne.jp/	WINWORD.EXE
http://cgi.search.biglobe.ne.jp/favicon.ico	WINWORD.EXE
http://ch.questionmarket.com/w3c/audit2007/p3p_dynamiclogic.xml	rundll32.exe
http://clients5.google.com/complete/search?hl=	WINWORD.EXE
http://cnet.search.com/	WINWORD.EXE
http://cnweb.search.live.com/	WINWORD.EXE
http://cnweb.search.live.com/favicon.ico	WINWORD.EXE
http://col.stb00.s-msn.com/i/1e/3e92bbd62b7f2d1f41235eeddb35a6.jpg	rundll32.exe
http://col.stb00.s-msn.com/i/50/92b0db83806125262f3fbc6e76b660.jpg	rundll32.exe
http://col.stb00.s-msn.com/i/63/5eda2af65485ff69ad4520e57d0e1.jpg	rundll32.exe
http://col.stb00.s-msn.com/i/72/8afac6155f34b259a4f96f36982e4.jpg	rundll32.exe
http://col.stb00.s-msn.com/i/e2/37ba92e210d341bfdbf4126422a3d2.gif	rundll32.exe
http://col.stb00.s-msn.com/i/e6/9808f6ee12e2a4c24f938b5c9a8e.jpg	rundll32.exe
http://col.stb00.s-msn.com/i/eb/115c3eb4272fa8265b40e016a3709f.png	rundll32.exe
http://col.stb00.s-msn.com/i/fe/3538a96c51fe1534cdb66fd82dc40.jpg	rundll32.exe
http://col.stb01.s-msn.com/i/31/552b432109625bbda36a63534018.jpg	rundll32.exe
http://col.stb01.s-msn.com/i/65/cdab2f44a1591d2b308c20c6c15375.jpg	rundll32.exe
http://col.stb01.s-msn.com/i/67/1fa135fc2eb4d3cf2b682256c86c.jpg	rundll32.exe
http://col.stb01.s-msn.com/i/81/a4e157504e3aa679304ffd461899f.jpg	rundll32.exe
http://col.stb01.s-msn.com/i/8b/e25f5fdacdc9b49cbc70b9da4034ee.jpg	rundll32.exe
http://col.stb01.s-msn.com/i/8e/6af523cd25586c16454dad90a077.gif	rundll32.exe
http://col.stb01.s-msn.com/i/8f/a4352080832119cbd48417cd53821.jpg	rundll32.exe
http://col.stb01.s-msn.com/i/ab/1f71f580fd1a60cf28e32311e06146.jpg	rundll32.exe
http://col.stb01.s-msn.com/i/b7/eb75d45b8948f72ee451223e95a96.gif	rundll32.exe
http://col.stb01.s-msn.com/i/c8/746f93d7dcc9693561971cfb1fcc3.jpg	rundll32.exe
http://col.stb01.s-msn.com/i/d3/73518a60e4f99cefdf0e07ee9b66.jpg	rundll32.exe
http://col.stc.s-msn.co	rundll32.exe
http://col.stc.s-msn.com/br/sc/css/52/2488d24f533f797eebf2e5c5bdd0cd.css	rundll32.exe
http://col.stc.s-msn.com/br/sc/i/0c/c57bc2a7d38843d7c4aa8028fc9f82.gif	rundll32.exe
http://col.stc.s-msn.com/br/sc/i/2d/1db850e671ac9a39751a1482909ea6.jpg	rundll32.exe
http://col.stc.s-msn.com/br/sc/i/42/8af5a9e564e2aee465684b0c63c345.png	rundll32.exe
http://col.stc.s-msn.com/br/sc/i/44/8adae8665171049ce4960396c72c86.gif	rundll32.exe
http://col.stc.s-msn.com/br/sc/i/5f/5280118e68aedbc5821d17132a5340.gif	rundll32.exe
http://col.stc.s-msn.com/br/sc/i/76/6624502f65ce6b15f584f20925cd28.png	rundll32.exe
http://col.stc.s-msn.com/br/sc/i/c1/cc36ca69630adc1a2052edc7351a47.gif	rundll32.exe
http://col.stc.s-msn.com/br/sc/i/d7/2ce07deffbaa900124ec82a86c2c1f.gif	rundll32.exe
http://col.stc.s-msn.com/br/sc/i/f8/614595fba50d96389708a4135776e4.gif	rundll32.exe
http://col.stc.s-msn.com/br/sc/i/ff/290e7f0b12fa8a201581c74c1ae75a.gif	rundll32.exe
http://col.stc.s-msn.com/br/sc/i/ff/adchoices_gif2.gif	rundll32.exe
http://col.stc.s-msn.com/br/sc/i/icons/bing_websearch_2.jpg	rundll32.exe
http://col.stj.s-msn.com/br/sc/js/51/anatm.js	rundll32.exe
http://col.stj.s-msn.com/br/sc/js/99/ec02e7a208b0b89c5a221e9c76ca8979.js	rundll32.exe
http://col.stj.s-msn.com/br/sc/js/bc/d3a1be3129df1dc11a599ea57981b2.js	rundll32.exe
http://col.stj.s-msn.com/br/sc/js/jquery/jquery-1.4.2.min.js	rundll32.exe
http://col.stj.s-msn.com/primedns.gif?q=1	rundll32.exe
http://col.stj.s-msn.com/primedns.gif?q=2	rundll32.exe
http://corp.naukri.com/	WINWORD.EXE
http://corp.naukri.com/favicon.ico	WINWORD.EXE
http://crl.microsoft.com/pki/crl/products/codesignpca.crl	E6024EAC88E6B6165D49FE3C95ADD735.dr
http://cs.wikipedia.org/	WINWORD.EXE
http://cs.wikipedia.org/favicon.ico	WINWORD.EXE
http://cs.wikipedia.org/w/api.php?action=opensearch&format=xml&search=	WINWORD.EXE
http://de.search.yahoo.com/	WINWORD.EXE
http://de.wikipedia.org/	WINWORD.EXE
http://de.wikipedia.org/favicon.ico	WINWORD.EXE
http://de.wikipedia.org/w/api.php?action=opensearch&format=xml&search=	WINWORD.EXE
http://edmullen.net/bg.jpg	rundll32.exe
http://edmullen.net/bg6.jpg	rundll32.exe
http://edmullen.net/fclock.php	rundll32.exe
http://edmullen.net/fla	rundll32.exe
http://edmullen.net/menu_bg_s.jpg	rundll32.exe
http://edmullen.net/sig_bg_s.jpg	rundll32.exe
http://edmullen.net/sig_button.jpg	rundll32.exe
http://edmullen.net/styles/default.css	rundll32.exe
http://edmullen.net/styles/guitarwestern.ani	rundll32.exe
http://edmullen.net/styles/guitarwestern.gif	rundll32.exe
http://edmullen.net/styles/guitarwestern.png	rundll32.exe
http://edmullen.net/styles/menu.css	rundll32.exe
http://edmullen.net/styles/print.css	rundll32.exe
http://en.wikipedia.org/	WINWORD.EXE
http://en.wikipedia.org/favicon.ico	WINWORD.EXE
http://en.wikipedia.org/w/api.php?action=opensearch&format=xml&search=	WINWORD.EXE
http://es.ask.com/	WINWORD.EXE
http://es.search.yahoo.com/	WINWORD.EXE
http://es.wikipedia.org/	WINWORD.EXE
http://es.wikipedia.org/favicon.ico	WINWORD.EXE
http://es.wikipedia.org/w/api.php?action=opensearch&format=xml&search=	WINWORD.EXE
http://esearch.rakuten.co.jp/	WINWORD.EXE
http://espanol.search.yahoo.com/	WINWORD.EXE
http://espn.go.com/favicon.ico	WINWORD.EXE
http://find.joins.com/	WINWORD.EXE
http://fpdownload2.macromedia.com/get/flashplayer/update/current/xml/version_en_win_ax.xml	rundll32.exe
http://fr.search.yahoo.com/	WINWORD.EXE
http://fr.wikipedia.org/	WINWORD.EXE
http://fr.wikipedia.org/favicon.ico	WINWORD.EXE
http://fr.wikipedia.org/w/api.php?action=opensearch&format=xml&search=	WINWORD.EXE
http://go.microsoft.com/fwlink/?l	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=105563	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=120347-http://go.microsoft.com/fwlink/?linkid=1203463read	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=120476	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=121792	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=122812hthe	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=124983	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=12658	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=12939	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=134080)search	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=140502	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=50462	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=50893)lear&n	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=54537&clcid=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=54729&clcid=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=54758	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=54796&clcid=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=54896&clcid=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=55027&clcid=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=55028&clcid=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=55107&clcid=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=55242&clcid=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=55245&clcid=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=56297&clcid=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=57427&protocol=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=58472&clcid=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=58473&clcid=	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=66725	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=69157	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=74005finternet	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=76277	WINWORD.EXE
http://go.microsoft.com/fwlink/?linkid=99193	WINWORD.EXE
http://google.pchome.com.tw/	WINWORD.EXE
http://home.altervista.org/	WINWORD.EXE
http://home.altervista.org/favicon.ico	WINWORD.EXE
http://home.microsoft.com	rundll32.exe
http://ie.search.yahoo.com/os?command=	WINWORD.EXE
http://ie8.ebay.com/open-search/output-xml.php?q=	WINWORD.EXE
http://image.excite.co.jp/jp/favicon/lep.ico	WINWORD.EXE
http://images.joins.com/ui_c/fvc_joins.ico	WINWORD.EXE
http://images.monster.com/favicon.ico	WINWORD.EXE
http://img.atlas.cz/favicon.ico	WINWORD.EXE
http://img.shopzilla.com/shopzilla/shopzilla.ico	WINWORD.EXE
http://in.search.yahoo.com/	WINWORD.EXE
http://it.search.dada.net/	WINWORD.EXE
http://it.search.dada.net/favicon.ico	WINWORD.EXE
http://it.search.yahoo.com/	WINWORD.EXE
http://it.wikipedia.org/	WINWORD.EXE
http://it.wikipedia.org/favicon.ico	WINWORD.EXE
http://it.wikipedia.org/w/api.php?action=opensearch&format=xml&search=	WINWORD.EXE
http://ja.wikipedia.org/	WINWORD.EXE
http://ja.wikipedia.org/favicon.ico	WINWORD.EXE
http://ja.wikipedia.org/w/api.php?action=opensearch&format=xml&search=	WINWORD.EXE
http://jobsearch.monster.com/	WINWORD.EXE
http://kr.search.yahoo.com/	WINWORD.EXE
http://list.taobao.com/	WINWORD.EXE
http://list.taobao.com/browse/search_visual.htm?n=15&q=	WINWORD.EXE
http://livesearch.msn.co.kr/	WINWORD.EXE
http://mail.live.com/	WINWORD.EXE
http://mail.live.com/?rru=compose%3fsubject%3d	WINWORD.EXE
http://maps.live.com/	WINWORD.EXE
http://maps.live.com/default.aspx	WINWORD.EXE
http://maps.live.com/geotager.aspx	WINWORD.EXE
http://msdn.microsoft.com/	WINWORD.EXE
http://msdn.microsoft.com/workshop/security/privacy/overview/privacyimportxml.asp)	WINWORD.EXE
http://msdn.microsoft.com/workshop/security/szone/overview/templates.asp)	WINWORD.EXE
http://msk.afisha.ru/	WINWORD.EXE
http://nl.wikipedia.org/	WINWORD.EXE
http://nl.wikipedia.org/favicon.ico	WINWORD.EXE
http://nl.wikipedia.org/w/api.php?action=opensearch&format=xml&search=	WINWORD.EXE
http://ns.adobe.com/exif/1.0/	WINWORD.EXE
http://ns.adobe.com/ix/1.0/	WINWORD.EXE
http://ns.adobe.com/pdf/1.3/	WINWORD.EXE
http://ns.adobe.com/photoshop/1.0/	WINWORD.EXE
http://ns.adobe.com/tiff/1.0/	WINWORD.EXE
http://ns.adobe.com/xap/1.0/	WINWORD.EXE
http://ns.adobe.com/xap/1.0/mm/	WINWORD.EXE
http://ocnsearch.goo.ne.jp/	WINWORD.EXE
http://office.bcentral.com/eservices/error?dpc=%productcode%&dcc=%appcomponentcode%&appname=%applicationname%&clcid=%uilang%&helplcid=%helplang%	WINWORD.EXE, 6C3CF.dmp.dr
http://officeupdate.microsoft.com	WINWORD.EXE, 6C3CF.dmp.dr
http://openimage.interpark.com/interpark.ico	WINWORD.EXE
http://p.zhongsou.com/	WINWORD.EXE
http://p.zhongsou.com/favicon.ico	WINWORD.EXE
http://pl.wikipedia.org/	WINWORD.EXE
http://pl.wikipedia.org/favicon.ico	WINWORD.EXE
http://pl.wikipedia.org/w/api.php?action=opensearch&format=xml&search=	WINWORD.EXE
http://price.ru/	WINWORD.EXE
http://price.ru/favicon.ico	WINWORD.EXE
http://pt.wikipedia.org/	WINWORD.EXE
http://pt.wikipedia.org/w/api.php?action=opensearch&format=xml&search=	WINWORD.EXE
http://publicnews.mooo.com/logo.gif	rundll32.exe
http://publicnews.mooo.com/news.php?1221	rundll32.exe
http://purl.org/dc/elements/1.1	WINWORD.EXE, iPhone 5 Battery.doc
http://purl.org/dc/elements/1.1/	WINWORD.EXE
http://purl.org/rss/1.0/modules/content/	WINWORD.EXE
http://purl.org/rss/1.0/modules/slash/	WINWORD.EXE
http://rad.msn.com/msnperf/primedns.gif	rundll32.exe
http://recherche.linternaute.com/	WINWORD.EXE
http://recherche.tf1.fr/	WINWORD.EXE
http://recherche.tf1.fr/favicon.ico	WINWORD.EXE
http://rover.ebay.com	WINWORD.EXE
http://ru.search.yahoo.com	WINWORD.EXE
http://ru.wikipedia.org/	WINWORD.EXE
http://ru.wikipedia.org/favicon.ico	WINWORD.EXE
http://ru.wikipedia.org/w/api.php?action=opensearch&format=xml&search=	WINWORD.EXE
http://sads.myspace.com/	WINWORD.EXE
http://schemas.microsoft.com/office/2004/12/omml	WINWORD.EXE
http://schemas.microsoft.com/sharepoint/soap/directory/	6C3CF.dmp.dr
http://schemas.xmlsoap.org/soap/envelope/	6C3CF.dmp.dr
http://search-dyn.tiscali.it/	WINWORD.EXE
http://search.about.com/	WINWORD.EXE
http://search.alice.it/	WINWORD.EXE
http://search.alice.it/favicon.ico	WINWORD.EXE
http://search.aol.com/	WINWORD.EXE
http://search.aol.in/	WINWORD.EXE
http://search.atlas.cz/	WINWORD.EXE
http://search.auction.co.kr/	WINWORD.EXE
http://search.auone.jp/	WINWORD.EXE
http://search.books.com.tw/	WINWORD.EXE
http://search.books.com.tw/favicon.ico	WINWORD.EXE
http://search.centrum.cz/	WINWORD.EXE
http://search.centrum.cz/favicon.ico	WINWORD.EXE
http://search.chol.com/	WINWORD.EXE
http://search.chol.com/favicon.ico	WINWORD.EXE
http://search.cn.yahoo.com/	WINWORD.EXE
http://search.daum.net/	WINWORD.EXE
http://search.daum.net/favicon.ico	WINWORD.EXE
http://search.dreamwiz.com/	WINWORD.EXE
http://search.dreamwiz.com/favicon.ico	WINWORD.EXE
http://search.ebay.co.uk/	WINWORD.EXE
http://search.ebay.com/	WINWORD.EXE
http://search.ebay.com/favicon.ico	WINWORD.EXE
http://search.ebay.de/	WINWORD.EXE
http://search.ebay.es/	WINWORD.EXE
http://search.ebay.fr/	WINWORD.EXE
http://search.ebay.in/	WINWORD.EXE
http://search.ebay.it/	WINWORD.EXE
http://search.empas.com/	WINWORD.EXE
http://search.empas.com/favicon.ico	WINWORD.EXE
http://search.espn.go.com/	WINWORD.EXE
http://search.gamer.com.tw/	WINWORD.EXE
http://search.gamer.com.tw/favicon.ico	WINWORD.EXE
http://search.gismeteo.ru/	WINWORD.EXE
http://search.goo.ne.jp/	WINWORD.EXE
http://search.goo.ne.jp/favicon.ico	WINWORD.EXE
http://search.hanafos.com/	WINWORD.EXE
http://search.hanafos.com/favicon.ico	WINWORD.EXE
http://search.interpark.com/	WINWORD.EXE
http://search.ipop.co.kr/	WINWORD.EXE
http://search.ipop.co.kr/favicon.ico	WINWORD.EXE
http://search.live.com/results.aspx?form=iefm1&q=	WINWORD.EXE
http://search.live.com/results.aspx?form=so2tdf&q=	WINWORD.EXE
http://search.live.com/results.aspx?form=soltdf&q=	WINWORD.EXE
http://search.live.com/results.aspx?q=	WINWORD.EXE
http://search.live.com/results.aspx?q=search&form=hpdtdf	WINWORD.EXE
http://search.live.com/results.aspx?q=search&form=hpntdf	WINWORD.EXE
http://search.livedoor.com/	WINWORD.EXE
http://search.livedoor.com/favicon.ico	WINWORD.EXE
http://search.lycos.co.uk/	WINWORD.EXE
http://search.lycos.com/	WINWORD.EXE
http://search.lycos.com/favicon.ico	WINWORD.EXE
http://search.microsoft.com/	WINWORD.EXE
http://search.msn.co.jp/results.aspx?q=	WINWORD.EXE
http://search.msn.co.uk/results.aspx?q=	WINWORD.EXE
http://search.msn.com.cn/results.aspx?q=	WINWORD.EXE
http://search.msn.com/results.aspx?q=	WINWORD.EXE
http://search.nate.com/	WINWORD.EXE
http://search.naver.com/	WINWORD.EXE
http://search.naver.com/favicon.ico	WINWORD.EXE
http://search.nifty.com/	WINWORD.EXE
http://search.orange.co.uk/	WINWORD.EXE
http://search.orange.co.uk/favicon.ico	WINWORD.EXE
http://search.rediff.com/	WINWORD.EXE
http://search.rediff.com/favicon.ico	WINWORD.EXE
http://search.seznam.cz/	WINWORD.EXE
http://search.seznam.cz/favicon.ico	WINWORD.EXE
http://search.sify.com/	WINWORD.EXE
http://search.yahoo.co.jp	WINWORD.EXE
http://search.yahoo.co.jp/favicon.ico	WINWORD.EXE
http://search.yahoo.com/	WINWORD.EXE
http://search.yahoo.com/favicon.ico	WINWORD.EXE
http://search.yam.com/	WINWORD.EXE
http://search1.taobao.com/	WINWORD.EXE
http://search2.estadao.com.br/	WINWORD.EXE
http://searchresults.news.com.au/	WINWORD.EXE
http://service2.bfast.com/	WINWORD.EXE
http://si.wikipedia.org/	WINWORD.EXE
http://si.wikipedia.org/favicon.ico	WINWORD.EXE
http://si.wikipedia.org/w/api.php?action=opensearch&format=xml&search=	WINWORD.EXE
http://sitesearch.timesonline.co.uk/	WINWORD.EXE
http://so-net.search.goo.ne.jp/	WINWORD.EXE
http://spaces.live.com/	WINWORD.EXE
http://spaces.live.com/blogit.aspx	WINWORD.EXE
http://suche.aol.de/	WINWORD.EXE
http://suche.freenet.de/	WINWORD.EXE
http://suche.freenet.de/favicon.ico	WINWORD.EXE
http://suche.lycos.de/	WINWORD.EXE
http://suche.t-online.de/	WINWORD.EXE
http://suche.web.de/	WINWORD.EXE
http://suche.web.de/favicon.ico	WINWORD.EXE
http://support.microsoft.com	WINWORD.EXE
http://techcrunch.com/2012/06/06/size-matters-supply-chain-whispers-hint-at-4-08-169-display-on-iphone-5/	iPhone 5.doc.dr
http://techcrunch.com/2012/06/11/apple-announces-ios-6-wwdc/	iPhone 5.doc.dr
http://techcrunch.com/2012/06/20/confirmed-the-new-iphone-will-have-a-19-pin-mini-conne	WINWORD.EXE
http://techcrunch.com/2012/06/20/confirmed-the-new-iphone-will-have-a-19-pin-mini-connector/	iPhone 5.doc.dr
http://translator.live.com/?ref=ie8activity	WINWORD.EXE
http://translator.live.com/bv.aspx?ref=ie8activity&a=	WINWORD.EXE
http://translator.live.com/bvprev.aspx?ref=ie8activity	WINWORD.EXE
http://translator.live.com/default.aspx?ref=ie8activity	WINWORD.EXE
http://translator.live.com/defaultprev.aspx?ref=ie8activity	WINWORD.EXE
http://treyresearch.net	WINWORD.EXE
http://tw.search.yahoo.com/	WINWORD.EXE
http://udn.com/	WINWORD.EXE
http://udn.com/favicon.ico	WINWORD.EXE
http://uk.ask.com/	WINWORD.EXE
http://uk.ask.com/favicon.ico	WINWORD.EXE
http://uk.search.yahoo.com/	WINWORD.EXE
http://vachercher.lycos.fr/	WINWORD.EXE
http://video.globo.com/	WINWORD.EXE
http://video.globo.com/favicon.ico	WINWORD.EXE
http://web.ask.com/	WINWORD.EXE
http://wellformedweb.org/commentapi/	WINWORD.EXE
http://windowsupdate.microsoft.com	WINWORD.EXE
http://www.abril.com.br/	WINWORD.EXE
http://www.abril.com.br/favicon.ico	WINWORD.EXE
http://www.adobe.com/2006/flex/mx/internal	iPhone 5 Battery.doc
http://www.adobe.com/products/flex	WINWORD.EXE, iPhone 5 Battery.doc
http://www.afisha.ru/app_themes/default/images/favicon.ico	WINWORD.EXE
http://www.alarabiya.net/	WINWORD.EXE
http://www.alarabiya.net/favicon.ico	WINWORD.EXE
http://www.amazon.co.jp/	WINWORD.EXE
http://www.amazon.co.uk/	WINWORD.EXE
http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&keyword=	WINWORD.EXE
http://www.amazon.com/favicon.ico	WINWORD.EXE
http://www.amazon.com/gp/search?ie=utf8&tag=ie8search-20&index=blended&linkcode=qs&camp=1789&creative=9325&keywords=	WINWORD.EXE
http://www.amazon.de/	WINWORD.EXE
http://www.aol.com/favicon.ico	WINWORD.EXE
http://www.arrakis.com/	WINWORD.EXE
http://www.arrakis.com/favicon.ico	WINWORD.EXE
http://www.asharqalawsat.com/	WINWORD.EXE
http://www.asharqalawsat.com/favicon.ico	WINWORD.EXE
http://www.ask.com/	WINWORD.EXE
http://www.auction.co.kr/auction.ico	WINWORD.EXE
http://www.baidu.com/	WINWORD.EXE
http://www.baidu.com/favicon.ico	WINWORD.EXE
http://www.bing.com/az/hprichbg?p=rb%2fmelonskin_en-us1533494814-d.jpg	rundll32.exe
http://www.bing.com/fav	rundll32.exe
http://www.bing.com/favicon.ico	rundll32.exe
http://www.bing.com/fd/fb/r?v=8_07_0_1457099&sid=0	rundll32.exe
http://www.bing.com/fd/s/a/sw13.png	rundll32.exe
http://www.bing.com/msnhomepagehistory.aspx?sid=549dec4b28164f7b802ae451620e3592&_=1343168347250	rundll32.exe
http://www.bing.com/partner/primedns.gif	rundll32.exe
http://www.bing.com/s/as/1436447/en.js	rundll32.exe
http://www.bing.com/sa/8_01_0_1462371/bubble_black.js	rundll32.exe
http://www.bing.com/search?q=edmullen	rundll32.exe
http://www.cdiscount.com/	WINWORD.EXE
http://www.cdiscount.com/favicon.ico	WINWORD.EXE
http://www.ceneo.pl/	WINWORD.EXE
http://www.ceneo.pl/favicon.ico	WINWORD.EXE
http://www.chennaionline.com/ncommon/images/collogo.ico	WINWORD.EXE
http://www.cjmall.com/	WINWORD.EXE
http://www.cjmall.com/favicon.ico	WINWORD.EXE
http://www.clarin.com/favicon.ico	WINWORD.EXE
http://www.cnet.co.uk/	WINWORD.EXE
http://www.cnet.com/favicon.ico	WINWORD.EXE
http://www.dailymail.co.uk/	WINWORD.EXE
http://www.dailymail.co.uk/favicon.ico	WINWORD.EXE
http://www.etmall.com.tw/	WINWORD.EXE
http://www.etmall.com.tw/favicon.ico	WINWORD.EXE
http://www.excite.co.jp/	WINWORD.EXE
http://www.expedia.com/	WINWORD.EXE
http://www.expedia.com/favicon.ico	WINWORD.EXE
http://www.facebook.com/	WINWORD.EXE
http://www.facebook.com/favicon.ico	WINWORD.EXE
http://www.gismeteo.ru/favicon.ico	WINWORD.EXE
http://www.gmarket.co.kr/	WINWORD.EXE
http://www.gmarket.co.kr/favicon.ico	WINWORD.EXE
http://www.google.co.in/	WINWORD.EXE
http://www.google.co.jp/	WINWORD.EXE
http://www.google.co.uk/	WINWORD.EXE
http://www.google.com.br/	WINWORD.EXE
http://www.google.com.sa/	WINWORD.EXE
http://www.google.com.tw/	WINWORD.EXE
http://www.google.com/	WINWORD.EXE
http://www.google.com/favicon.ico	WINWORD.EXE
http://www.google.cz/	WINWORD.EXE
http://www.google.de/	WINWORD.EXE
http://www.google.es/	WINWORD.EXE
http://www.google.fr/	WINWORD.EXE
http://www.google.it/	WINWORD.EXE
http://www.google.pl/	WINWORD.EXE
http://www.google.ru/	WINWORD.EXE
http://www.google.si/	WINWORD.EXE
http://www.iask.com/	WINWORD.EXE
http://www.iask.com/favicon.ico	WINWORD.EXE
http://www.kkbox.com.tw/	WINWORD.EXE
http://www.kkbox.com.tw/favicon.ico	WINWORD.EXE
http://www.linternaute.com/favicon.ico	WINWORD.EXE
http://www.live.com/favicon.ico	WINWORD.EXE
http://www.macromedia.com	WINWORD.EXE
http://www.maktoob.com/favicon.ico	WINWORD.EXE
http://www.mercadolibre.com.mx/	WINWORD.EXE
http://www.mercadolibre.com.mx/favicon.ico	WINWORD.EXE
http://www.mercadolivre.com.br/	WINWORD.EXE
http://www.mercadolivre.com.br/favicon.ico	WINWORD.EXE
http://www.merlin.com.pl/	WINWORD.EXE
http://www.merlin.com.pl/favicon.ico	WINWORD.EXE
http://www.microsoft.com/favicon.ico	WINWORD.EXE
http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome	rundll32.exe
http://www.microsoft.com/schemas/rss/core/2005/internal	WINWORD.EXE
http://www.microsoft.com/windowsxp/expertzone/	WINWORD.EXE
http://www.msn.com	rundll32.exe
http://www.mtv.com/	WINWORD.EXE
http://www.mtv.com/favicon.ico	WINWORD.EXE
http://www.myspace.com/favicon.ico	WINWORD.EXE
http://www.najdi.si/	WINWORD.EXE
http://www.najdi.si/favicon.ico	WINWORD.EXE
http://www.nate.com/favicon.ico	WINWORD.EXE
http://www.neckermann.de/	WINWORD.EXE
http://www.neckermann.de/favicon.ico	WINWORD.EXE
http://www.news.com.au/favicon.ico	WINWORD.EXE
http://www.nifty.com/favicon.ico	WINWORD.EXE
http://www.ocn.ne.jp/favicon.ico	WINWORD.EXE
http://www.orange.fr/	WINWORD.EXE
http://www.otto.de/favicon.ico	WINWORD.EXE
http://www.ozon.ru/	WINWORD.EXE
http://www.ozon.ru/favicon.ico	WINWORD.EXE
http://www.ozu.es/favicon.ico	WINWORD.EXE
http://www.paginasamarillas.es/	WINWORD.EXE
http://www.paginasamarillas.es/favicon.ico	WINWORD.EXE
http://www.pchome.com.tw/favicon.ico	WINWORD.EXE
http://www.priceminister.com/	WINWORD.EXE
http://www.priceminister.com/favicon.ico	WINWORD.EXE
http://www.rakuten.co.jp/favicon.ico	WINWORD.EXE
http://www.rambler.ru/	WINWORD.EXE
http://www.rambler.ru/favicon.ico	WINWORD.EXE
http://www.recherche.aol.fr/	WINWORD.EXE
http://www.rtl.de/	WINWORD.EXE
http://www.rtl.de/favicon.ico	WINWORD.EXE
http://www.servicios.clarin.com/	WINWORD.EXE
http://www.shopzilla.com/	WINWORD.EXE
http://www.sify.com/favicon.ico	WINWORD.EXE
http://www.so-net.ne.jp/share/favicon.ico	WINWORD.EXE
http://www.sogou.com/	WINWORD.EXE
http://www.sogou.com/favicon.ico	WINWORD.EXE
http://www.soso.com/	WINWORD.EXE
http://www.soso.com/favicon.ico	WINWORD.EXE
http://www.t-online.de/favicon.ico	WINWORD.EXE
http://www.taobao.com/	WINWORD.EXE
http://www.taobao.com/favicon.ico	WINWORD.EXE
http://www.target.com/	WINWORD.EXE
http://www.target.com/favicon.ico	WINWORD.EXE
http://www.tchibo.de/	WINWORD.EXE
http://www.tchibo.de/favicon.ico	WINWORD.EXE
http://www.tesco.com/	WINWORD.EXE
http://www.tesco.com/favicon.ico	WINWORD.EXE
http://www.timesonline.co.uk/img/favicon.ico	WINWORD.EXE
http://www.tiscali.it/favicon.ico	WINWORD.EXE
http://www.typodermic.com	iPhone 5 Battery.doc
http://www.univision.com/	WINWORD.EXE
http://www.univision.com/favicon.ico	WINWORD.EXE
http://www.w3.org/1999/02/22-rdf-syntax-ns#	WINWORD.EXE, iPhone 5 Battery.doc
http://www.w3.org/1999/xhtml	WINWORD.EXE
http://www.w3.org/1999/xsl/transform	WINWORD.EXE
http://www.w3.org/2001/xmlschema	6C3CF.dmp.dr
http://www.w3.org/2001/xmlschema-instance	6C3CF.dmp.dr
http://www.w3.org/tr/html4/loose.dtd	WINWORD.EXE
http://www.w3.org/tr/html4/strict.dtd	WINWORD.EXE
http://www.w3.org/tr/html401/strict.dtd	WINWORD.EXE
http://www.w3.org/tr/rec-html40/strict.dtd	WINWORD.EXE
http://www.w3.org/tr/wd-xsl	WINWORD.EXE
http://www.w3.org/tr/xhtml1/dtd/xhtml1-transitional.dtd	WINWORD.EXE
http://www.walmart.com/	WINWORD.EXE
http://www.walmart.com/favicon.ico	WINWORD.EXE
http://www.weather.com/	WINWORD.EXE
http://www.weather.com/favicon.ico	WINWORD.EXE
http://www.ya.com/favicon.ico	WINWORD.EXE
http://www.yam.com/favicon.ico	WINWORD.EXE
http://www.yandex.ru/	WINWORD.EXE
http://www.yandex.ru/favicon.ico	WINWORD.EXE
http://www3.fnac.com/	WINWORD.EXE
http://www3.fnac.com/favicon.ico	WINWORD.EXE
http://xml-us.amznxslt.com/onca/xml?service=awsecommerceservice&version=2008-06-26&operation=itemsearch&awsaccesskeyid=15hrv3azsmpk0gxty102&associatetag=ie8suggestion-20&responsegroup=itemattributes	WINWORD.EXE
http://yellowpages.superpages.com/	WINWORD.EXE
http://z.about.com/m/a08.ico	WINWORD.EXE
https://example.com	WINWORD.EXE
https://ieonlinews.microsoft.com/	WINWORD.EXE
https://office.bcentral.com/eservices/index?dpc=%productcode%&dcc=%appcomponentcode%&appname=%applicationname%&clcid=%uilang%&helplcid=%helplang%	WINWORD.EXE, 6C3CF.dmp.dr
https://office.bcentral.com/eservices/service?command=webpost&dpc=%productcode%&dcc=%appcomponentcode%&appname=%applicationname%&clcid=%uilang%&helplcid=%helplang%	WINWORD.EXE, 6C3CF.dmp.dr

Social media names

String value	Source
<SuggestionsURL>http://ie.search.yahoo.com/os?command={SearchTerms}</SuggestionsURL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<FavoriteIcon>http://search.yahoo.co.jp/favicon.ico</FavoriteIcon> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<FavoriteIcon>http://search.yahoo.com/favicon.ico</FavoriteIcon> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)	WINWORD.EXE
<FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)	WINWORD.EXE
<FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)	WINWORD.EXE
<URL>http://br.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://de.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://es.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://espanol.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://fr.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://in.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://it.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://kr.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://ru.search.yahoo.com</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://sads.myspace.com/</URL> equals www.myspace.com (Myspace)	WINWORD.EXE
<URL>http://search.cn.yahoo.com/</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://search.yahoo.co.jp</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://tw.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://uk.search.yahoo.com/</URL> equals www.yahoo.com (Yahoo)	WINWORD.EXE
<URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)	WINWORD.EXE
<URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)	WINWORD.EXE
Free Hotmail.url equals www.hotmail.com (Hotmail)	WINWORD.EXE

VM Artifacts

String value	Source
ROOT\LEGACY_VBOXSF\0000	svchost.exe
SCSI\DISK&VEN_VMWARE_&PROD_VMWARE_VIRTUAL_S&REV_1	svchost.exe
ROOT\LEGACY_VMHGFS\0000	svchost.exe
ROOT\LEGACY_VMWAREAUTH\0000	svchost.exe
IDE\CDROMNECVMWAR_VMWARE_IDE_CDR10_______________1.00____\3031303030303030303030303030303030303130	svchost.exe
SCSI\DISK&VEN_VMWARE_&PROD_VMWARE_VIRTUAL_S&REV_1.0\4&5FCAAFC&1&000	svchost.exe

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 16, 2012 14:35:29.080504894 CEST	1099	80	192.168.0.11	108.171.240.86
Aug 16, 2012 14:35:29.080528021 CEST	80	1099	108.171.240.86	192.168.0.11
Aug 16, 2012 14:35:29.080727100 CEST	1099	80	192.168.0.11	108.171.240.86
Aug 16, 2012 14:35:29.087272882 CEST	1099	80	192.168.0.11	108.171.240.86
Aug 16, 2012 14:35:29.087289095 CEST	80	1099	108.171.240.86	192.168.0.11
Aug 16, 2012 14:35:47.000443935 CEST	80	1099	108.171.240.86	192.168.0.11
Aug 16, 2012 14:35:47.000756025 CEST	1099	80	192.168.0.11	108.171.240.86
Aug 16, 2012 14:35:47.001743078 CEST	1099	80	192.168.0.11	108.171.240.86
Aug 16, 2012 14:35:47.001756907 CEST	80	1099	108.171.240.86	192.168.0.11
Aug 16, 2012 14:35:47.008352995 CEST	1100	80	192.168.0.11	108.171.240.86
Aug 16, 2012 14:35:47.008384943 CEST	80	1100	108.171.240.86	192.168.0.11
Aug 16, 2012 14:35:47.008574963 CEST	1100	80	192.168.0.11	108.171.240.86
Aug 16, 2012 14:35:47.010173082 CEST	1100	80	192.168.0.11	108.171.240.86
Aug 16, 2012 14:35:47.010190964 CEST	80	1100	108.171.240.86	192.168.0.11
Aug 16, 2012 14:35:55.003201008 CEST	80	1100	108.171.240.86	192.168.0.11
Aug 16, 2012 14:35:55.003520966 CEST	1100	80	192.168.0.11	108.171.240.86
Aug 16, 2012 14:35:55.004192114 CEST	1100	80	192.168.0.11	108.171.240.86
Aug 16, 2012 14:35:55.004208088 CEST	80	1100	108.171.240.86	192.168.0.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 16, 2012 14:35:29.035233974 CEST	55604	53	192.168.0.11	195.186.1.121
Aug 16, 2012 14:35:29.035330057 CEST	53	55604	195.186.1.121	192.168.0.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 16, 2012 14:35:29.035233974 CEST	192.168.0.11	195.186.1.121	0x55cb	Standard query (0)	publicnews.mooo.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Replay Code	Name	CName	Address	Type	Class
Aug 16, 2012 14:35:29.035330057 CEST	195.186.1.121	192.168.0.11	0x55cb	No error (0)	publicnews.mooo.com		108.171.240.86	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

publicnews.mooo.com

HTTP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Header	Total Bytes Transfered (KB)
Aug 16, 2012 14:35:29.087272882 CEST	1099	80	192.168.0.11	108.171.240.86	POST /news.php?1221 HTTP/1.1 Accept: Accept: / Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32) Host: publicnews.mooo.com Content-Length: 89 Cache-Control: no-cache	0
Aug 16, 2012 14:35:47.010173082 CEST	1100	80	192.168.0.11	108.171.240.86	GET /logo.gif HTTP/1.1 Accept: / Accept-Language: en-us Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Win32) Host: publicnews.mooo.com Cache-Control: no-cache Cookie: mid=14D7C316078BFBFF00600F12	1

Code Manipulation Behavior

System Behavior

Analysis File: WINWORD.EXE PID: 1160 Parent PID: 1884

General

Start time:	15:20:04
Start date:	24/07/2012
Path:	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	unknown
Imagebase:	0x30000000
File size:	12310368 bytes
MD5 hash:	443747857245BF90847AE396C53470A6

File Activites

File Path	Access	Options	Content overwritten	Completion	Count	Source Address	Symbol
C:\Program Files\AutoIt3	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	2	7C90E457	KiUserApcDispatcher
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE.2.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE.2.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\IMM32.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	3	7C90E457	KiUserApcDispatcher
\Device\KsecDD	read data or list directory and synchronize	synchronous io alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30003071	LoadLibraryW
C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll.2.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	30003071	LoadLibraryW
C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll.2.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	30003071	LoadLibraryW
C:\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	227	8C2C95B	NlsAnsiCodePage
C:\Program Files\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	8C2C95B	NlsAnsiCodePage
C:\Program Files\Microsoft Office\OFFICE11\1033\wwintl.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	FF909090	unknown
C:\WINDOWS\system32\uxtheme.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	1	unknown
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	6	30029E78	LoadLibraryW
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\Comctl32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30029E78	LoadLibraryW
C:\WINDOWS\WindowsShell.Manifest	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30029E78	LoadLibraryW
C:\WINDOWS\WindowsShell.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	30029E78	LoadLibraryW
C:\WINDOWS\system32\MSCTF.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30029D25	CreateWindowExW
C:\WINDOWS\system32\msctfime.ime	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	4	30029D25	CreateWindowExW
C:\Program Files\Common Files\Microsoft Shared\office11\1033\msointl.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6F0073	unknown
C:\WINDOWS\system32\rpcss.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	3002D684	CoInitialize
C:\Program Files\Microsoft Office\OFFICE11\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	50	3002F203	FindFirstFileW
C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	3002F203	FindFirstFileW
C:\WINDOWS\system32\SHELL32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	3163DD74	unknown
C:\WINDOWS\system32\SHELL32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	3163DD74	unknown
C:\WINDOWS\system32\SHELL32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	3163DD74	unknown
C:\WINDOWS\system32\comctl32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	3163DD74	unknown
C:\WINDOWS\system32\comctl32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	3163DD74	unknown
C:\WINDOWS\system32\comctl32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	3163DD74	unknown
C:\Program Files\AutoIt3\:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word	read attributes and delete	non directory file and open for backup ident and open reparse point	false	object name invalid	1	3017FDA1	DeleteFileW
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word	write attributes and synchronize	synchronous io non alert and open for backup ident and open reparse point	false	success or wait	1	3017FDD4	SetFileAttributesW
C:\Program Files\Common Files\Microsoft Shared\office11\riched20.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30CFCD75	unknown
C:\WINDOWS\system32\Msimtf.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	5	3002A1BB	DefWindowProcW
C:\WINDOWS\system32\CLBCATQ.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	12E854	unknown
C:\WINDOWS\system32\COMRes.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	12E854	unknown
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Schemas\MS Word_restart.xml	read attributes and delete	non directory file and open for backup ident and open reparse point	false	object path not found	1	3163DD74	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Word\STARTUP\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	30068517	FindFirstFileW
C:\Program Files\Microsoft Office\OFFICE11\STARTUP\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	30068517	FindFirstFileW
C:\WINDOWS\system32\winlogon.exe	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	12F398	unknown
C:\WINDOWS\system32\xpsp2res.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	12F398	unknown
C:\WINDOWS\system32\sti.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	12F398	unknown
C:\WINDOWS\system32\CFGMGR32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	12F398	unknown
C:\WINDOWS\system32\setupapi.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	12F398	unknown
IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}	read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	2	FFFF	unknown
STORAGE#Volume#1&30a96598&0&SignatureF4ACF4ACOffset7E00Length3BFEFCE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}	read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	2	FFFF	unknown
C:\Documents and Settings\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	5	FFFF	unknown
C:\Documents and Settings\Administrator\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	4	FFFF	unknown
C:\Documents and Settings\Administrator\Desktop\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	3	30CFC0DA	unknown
C:\WINDOWS\system32\winspool.drv	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unidrvui.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C80B729	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	186	7C80B729	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unires.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	10	7C80B729	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdrv.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C80B729	unknown
C:\WINDOWS\system32\FontSub.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	4	7C80B729	unknown
C:\WINDOWS\system32\prntvpt.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	4	77006F	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\review.rcd	synchronize and generic read	synchronous io non alert and non directory file	false	object name not found	1	4D005C	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\adhoc.rcd	synchronize and generic read	synchronous io non alert and non directory file	false	object name not found	1	4D005C	unknown
C:\WINDOWS\system32\msi.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90F661	RtlNtStatusToDosError
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	4	10074	unknown
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\vbe6.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	42565C31	unknown
C:\WINDOWS\system32\SXS.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	301CBDD8	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\1033\VBE6INTL.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	565308EC	unknown
C:\WINDOWS\system32\MSIMG32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	30003601	LoadLibraryA
C:\Documents and Settings\Administrator\Application Data\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	124D20	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	124D20	unknown
C:\DOCUME~1\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	8	6511810E	unknown
C:\DOCUME~1\ADMINI~1\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	7	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	8	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	6	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx.2.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	6	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx.2.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	6	unknown
C:\WINDOWS\system32\WINMM.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6	unknown
C:\WINDOWS\system32\CRYPT32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6	unknown
C:\WINDOWS\system32\MSASN1.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6	unknown
C:\WINDOWS\system32\DSOUND.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6	unknown
C:\WINDOWS\system32\WS2_32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6	unknown
C:\WINDOWS\system32\WS2HELP.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6	unknown
C:\WINDOWS\system32\d3d9.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6	unknown
C:\WINDOWS\system32\d3d8thk.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6	unknown
C:\WINDOWS\system32\mscms.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6	unknown
C:\WINDOWS\system32\urlmon.dll.123.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	6	unknown
C:\WINDOWS\system32\urlmon.dll.123.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	6	unknown
C:\WINDOWS\system32\WININET.dll.123.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	6	unknown
C:\WINDOWS\system32\WININET.dll.123.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	6	unknown
C:\WINDOWS\system32\Macromed\Flash\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	3	14	unknown
C:\Documents and Settings\Administrator\Application Data\Adobe\Flash Player\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	101D708A	unknown
C:\Documents and Settings\Administrator\Application Data\Adobe\Flash Player\AssetCache\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	FFFF4020	unknown
C:\WINDOWS\system32\ieframe.dll.123.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	32BC080	unknown
C:\WINDOWS\system32\ieframe.dll.123.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	32BC080	unknown
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	800	1E	unknown
C:\WINDOWS\system32\Macromed\Flash\FlashPlayerTrust\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	object name not found	1	124E52	unknown
C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#Security\FlashPlayerTrust\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	object path not found	1	124E52	unknown
C:\WINDOWS\system32	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	1	101E8779	unknown
C:\WINDOWS\system32\msapsspc.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	3287218	unknown
C:\WINDOWS\system32\MSVCRT40.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	3287218	unknown
C:\WINDOWS\system32\schannel.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	3	3287218	unknown
C:\WINDOWS\system32\NETAPI32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	3287218	unknown
C:\WINDOWS\system32\digest.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	3287218	unknown
C:\WINDOWS\system32\msnsspc.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	3287218	unknown
C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	101D708A	unknown
C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	3290160	unknown
C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\WT8AYZWL\macromedia.com\support\flashplayer\sys\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	object path not found	1	140778	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	read attributes and delete	non directory file and open for backup ident and open reparse point	false	success or wait	1	63006F	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	24	3002F203	FindFirstFileW
C:\Program Files\Common Files\Microsoft Shared\PROOF\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	24	3002F203	FindFirstFileW
C:\Program Files\Microsoft Office\OFFICE11\GdiPlus.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30CCC134	unknown
C:\WINDOWS\system32\WTSAPI32.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	30CCC134	unknown
C:\WINDOWS\system32\WINSTA.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	30CCC134	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	read data or list directory and execute or traverse and read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	1	C0D0276	WinExec
C:\WINDOWS\system32\Apphelp.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	C0D0276	WinExec
C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	C0D0276	WinExec
C:\WINDOWS\system32\cmd.exe	read data or list directory and execute or traverse and read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	3	C0D035D	WinExec
C:\WINDOWS\system32\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	4	C0D035D	WinExec
C:\WINDOWS\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	3	C0D035D	WinExec
C:\WINDOWS\system32\cmd.exe.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	C0D035D	WinExec
C:\Program Files\Microsoft Office\OFFICE11\1033\wwintl.dll	read attributes and synchronize and generic read	synchronous io non alert and non directory file		success or wait	1	FF909090	unknown
C:\WINDOWS\WindowsShell.Manifest	read attributes and synchronize and generic read	synchronous io non alert and non directory file		success or wait	1	30029E78	LoadLibraryW
C:\WINDOWS\system32\msctfime.ime	read attributes and synchronize and generic read	synchronous io non alert and non directory file		success or wait	2	30029D25	CreateWindowExW
C:\Program Files\Common Files\Microsoft Shared\office11\1033\msointl.dll	read attributes and synchronize and generic read	synchronous io non alert and non directory file		success or wait	1	6F0073	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file and open no recall		success or wait	1	1	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dot	read attributes and synchronize and generic read and generic write	synchronous io non alert and non directory file		success or wait	1	1004A	unknown
C:\WINDOWS\Registration\R000000000007.clb	read attributes and synchronize and generic read	synchronous io non alert and non directory file		success or wait	1	12E854	unknown
\pipe\lsarpc	read attributes and synchronize and generic read and generic write	non directory file		success or wait	2	12F398	unknown
C:\WINDOWS\Sti_Trace.log	read attributes and synchronize and generic write	synchronous io non alert and non directory file		success or wait	1	12F398	unknown
MountPointManager	read attributes and synchronize	synchronous io non alert and non directory file	true	success or wait	6	FFFF	unknown
C:\Documents and Settings\Administrator\Desktop\iPhone 5 Battery.doc	read attributes and synchronize and generic read and generic write	synchronous io non alert and non directory file	true	success or wait	1	124A2C	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD	read attributes and synchronize and generic read	synchronous io non alert and non directory file and open no recall	true	success or wait	93	7C80B729	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd	read attributes and synchronize and generic read	synchronous io non alert and non directory file and open no recall	true	success or wait	93	7C80B729	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd	read attributes and synchronize and generic read	synchronous io non alert and non directory file and open no recall	true	success or wait	93	7C80B729	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini	read attributes and synchronize and generic read	synchronous io non alert and non directory file and open no recall	true	success or wait	93	7C80B729	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\review.rcd	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file and open no recall	true	object name not found	1	4D005C	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\adhoc.rcd	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file and open no recall	true	object name not found	1	4D005C	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	10074	unknown
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\vbe6.dll	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	42565C31	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	read attributes and synchronize and generic read	synchronous io non alert and non directory file and random access	true	success or wait	1	301EA8CD	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF0001.tmp	read data or list directory and read ea and read attributes and read control and synchronize	no options	true	object name not found	1	302892EA	StgCreateDocfile
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	read attributes and synchronize and generic read	synchronous io non alert and non directory file and random access	true	success or wait	2	460020	strchr
C:\WINDOWS\system32\stdole2.tlb	read attributes and synchronize and generic read	synchronous io non alert and non directory file and random access	true	success or wait	1	1FF640	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL\3	read attributes and synchronize and generic read	synchronous io non alert and non directory file and random access	true	object path not found	1	65050FA7	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	read attributes and synchronize and generic read	synchronous io non alert and non directory file and random access	true	success or wait	1	302952D2	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	read attributes and synchronize and generic read	synchronous io non alert and non directory file and random access	true	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	read attributes and synchronize and generic read	synchronous io non alert and non directory file and random access	true	object name not found	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	read attributes and synchronize and generic read	synchronous io non alert and non directory file and random access	true	success or wait	1	6511810E	unknown
WMIDataDevice	read attributes and synchronize and generic read and generic write	non directory file	true	success or wait	2	6	unknown
C:\WINDOWS\system32\Macromed\Flash\ss.sgn	read attributes and synchronize	synchronous io non alert and non directory file	true	object name not found	2	14	unknown
C:\WINDOWS\system32\Macromed\Flash\ss.cfg	read attributes and synchronize	synchronous io non alert and non directory file	true	object name not found	1	14	unknown
C:\WINDOWS\system32\Macromed\Flash\mms.cfg	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file	true	object name not found	2	101DB9B0	unknown
C:\WINDOWS\system32\mms.cfg	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file	true	object name not found	2	101DB9C0	unknown
C:\WINDOWS\system32\Macromed\Flash\oem.cfg	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file	true	object name not found	2	101DB9CC	unknown
C:\WINDOWS\system32\oem.cfg	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file	true	object name not found	2	101DB9DC	unknown
C:\Documents and Settings\Administrator\Application Data\Adobe\Flash Player\AssetCache	read attributes and synchronize	synchronous io non alert and non directory file	true	file is a directory	1	101D6FFD	unknown
C:\Program Files\Internet Explorer\IEXPLORE.EXE	read attributes and synchronize	synchronous io non alert and non directory file	true	success or wait	1	32BC080	unknown
C:\WINDOWS\system32\en-US\ieframe.dll.mui	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	32BC080	unknown
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	read attributes and synchronize	synchronous io non alert and non directory file	true	success or wait	200	101D6FFD	unknown
C:\WINDOWS\system32\Macromed\Flash\FlashAuthor.cfg	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file	true	object name not found	2	124E52	unknown
C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#Security\FlashAuthor.cfg	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file	true	object path not found	2	124E52	unknown
C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#SharedObjects	read attributes and synchronize	synchronous io non alert and non directory file	true	file is a directory	1	101D6FFD	unknown
C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\WT8AYZWL\macromedia.com\support\flashplayer\sys\settings.sol	read attributes and synchronize	synchronous io non alert and non directory file	true	object path not found	1	140778	unknown
C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol	read attributes and synchronize	synchronous io non alert and non directory file	true	success or wait	2	140778	unknown
C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file	true	success or wait	1	84	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	read attributes and synchronize and generic write	synchronous io non alert and non directory file	true	success or wait	1	30EBB9AF	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	30EBB9AF	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file and open no recall	true	success or wait	2	30EBC902	unknown
C:\WINDOWS\AppPatch\sysmain.sdb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	C0D0276	WinExec
C:\WINDOWS\AppPatch\systest.sdb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	object name not found	2	C0D0276	WinExec
\Device\NamedPipe\ShimViewer	write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize	no options	true	object name not found	2	C0D0276	WinExec
C:\WINDOWS\system32\cmd.exe	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	C0D035D	WinExec

File Created

File Path	Access	Attributes	Options	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF5F05.tmp	read attributes and delete and synchronize and generic read and generic write	temporary	synchronous io non alert and non directory file and delete on close	success or wait	1	1004A	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dot	read attributes and synchronize and generic write	hidden	synchronous io non alert and non directory file and open no recall	success or wait	1	303CE645	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word	read data or list directory and synchronize	normal	directory file and synchronous io non alert and open for backup ident	success or wait	1	3017FDAF	CreateDirectoryW
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRS0000.tmp	read attributes and synchronize and generic read and generic write	normal	synchronous io non alert and non directory file and open no recall	success or wait	1	30192330	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF7B61.tmp	read attributes and delete and synchronize and generic read and generic write	temporary	synchronous io non alert and non directory file and delete on close	success or wait	1	124A2C	unknown
C:\Documents and Settings\Administrator\Desktop\~$hone 5 Battery.doc	read attributes and synchronize and generic write	hidden	synchronous io non alert and non directory file and open no recall	success or wait	1	3018D96F	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF0001.tmp	read attributes and synchronize and generic read and generic write	normal	synchronous io non alert and non directory file	success or wait	1	302892EA	StgCreateDocfile
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VBE	read data or list directory and synchronize	normal	directory file and synchronous io non alert and open for backup ident	success or wait	1	40	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0	read data or list directory and synchronize	normal	directory file and synchronous io non alert and open for backup ident	success or wait	1	65214B0B	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	read attributes and synchronize and generic read and generic write	none	synchronous io non alert and non directory file	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~WRD0002.doc	read attributes and synchronize and generic read and generic write	normal	synchronous io non alert and non directory file and open no recall	success or wait	1	FF8B9090	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	read attributes and synchronize and generic write	temporary	sequential only and synchronous io non alert and non directory file and open no recall	success or wait	1	30EBB9AF	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof	read data or list directory and synchronize	normal	directory file and synchronous io non alert and open for backup ident	success or wait	1	30CC84C3	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	read attributes and synchronize and generic write	normal	synchronous io non alert and non directory file	success or wait	1	C0D0229	CreateFileA
C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc	read attributes and synchronize and generic write	normal	synchronous io non alert and non directory file	success or wait	1	C0D029F	CreateFileA

File Written

File Path	Offset	Length	Value	Completion	Count	Source Address	Symbol
C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dot	unknown	54	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	30041F40	WriteFile
C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dot	unknown	108	00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 48 00 00 00 00 00 3E 00 02 02 00 00 06 00 09 00 34 00 00 00 00 00 90 00 90 00 00 00 00 00 0F 00 00 00 FF FF FF 00 00 00 00 00 00 00 14 00 14 00 00 00 00 00 00 00 02 63 78 00 C8 00 00 00 00 00 14 00 00 00 00 00 90 00 90 00 80 00 16 00 00 00	success or wait	1	30041F40	WriteFile
\lsarpc	0	72	05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	2	12F398	unknown
C:\Documents and Settings\Administrator\Desktop\~$hone 5 Battery.doc	unknown	54	0D 48 61 6E 75 65 6C 65 20 42 61 73 65 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	30041F40	WriteFile
C:\Documents and Settings\Administrator\Desktop\~$hone 5 Battery.doc	unknown	108	0D 00 48 00 61 00 6E 00 75 00 65 00 6C 00 65 00 20 00 42 00 61 00 73 00 65 00 72 00 00 00 00 00 1E 00 00 00 0D 00 48 00 61 00 6E 00 75 00 65 00 6C 00 65 00 20 00 42 00 61 00 73 00 65 00 72 00 00 00 00 00 16 00 00 00 40 00 08 00 36 01 05 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1A 00 00 00	success or wait	1	30041F40	WriteFile
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	4D 53 46 54	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	02 00 01 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	00 00 00 00	success or wait	14	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	09 04 00 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	2	41 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	2	00 00	success or wait	4	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	2	01 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	04 00 00 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	0B 00 00 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	A4 00 00 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	0E 06 00 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	FF FF FF FF	success or wait	4	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	20 00 00 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	80 00 00 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	19 00 00 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	13 00 00 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	44	00 00 00 00 64 00 00 00 C8 00 00 00 2C 01 00 00 90 01 00 00 F4 01 00 00 58 02 00 00 BC 02 00 00 20 03 00 00 84 03 00 00 E8 03 00 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	16	FF FF FF FF C0 06 00 00 4C 04 00 00 0F 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	16	FF FF FF FF 40 01 00 00 E4 00 00 00 0F 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	16	FF FF FF FF 24 00 00 00 1C 00 00 00 0F 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	16	FF FF FF FF 60 00 00 00 40 00 00 00 0F 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	16	FF FF FF FF 80 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	16	FF FF FF FF 00 02 00 00 68 01 00 00 0F 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	16	FF FF FF FF 00 02 00 00 FF FF FF FF 0F 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	16	FF FF FF FF 00 16 00 00 B0 0E 00 00 0F 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	16	FF FF FF FF 80 09 00 00 10 06 00 00 0F 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	16	FF FF FF FF 00 02 00 00 70 01 00 00 0F 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	16	FF FF FF FF 00 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	10	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	1100	24 21 00 00 FF FF FF FF 00 20 00 00 B0 1F 00 00 0F 00 00 00 B0 DC 22 00 76 00 00 00 80 00 00 00 30 C7 22 00 38 C9 22 00 40 CB 22 00 18 00 00 00 00 50 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF 01 00 D8 01 04 00 00 00 FF FF FF FF 00 00 00 00 70 6C 22 00 FF FF FF FF	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	128	38 01 00 00 F0 00 00 00 50 01 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 90 00 00 00 D8 00 00 00 A8 00 00 00 FF FF FF FF 60 00 00 00 20 01 00 00 18 00 00 00 FF FF FF FF FF FF FF FF 08 01 00 00 FF FF FF FF FF FF FF FF	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	360	1D 12 42 48 9E 86 7A 47 B4 FC 30 7D 2E 2C 60 66 FE FF FF FF FF FF FF FF 6C DB 7C D2 6D AE CF 11 96 B8 44 45 53 54 00 00 00 00 00 00 FF FF FF FF 60 8E 59 C5 07 B3 D1 11 B2 7D 00 60 08 C3 FB FB 64 00 00 00 FF FF FF FF 6D DB 7C D2 6D AE CF 11 96 B8 44 45 53 54 00 00 C8 00 00 00 FF FF FF FF 6E DB 7C D2	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	64	00 00 00 00 01 00 00 00 FF FF FF FF 10 00 00 00 C8 00 00 00 03 00 00 00 FF FF FF FF FF FF FF FF F4 01 00 00 01 00 00 00 FF FF FF FF FF FF FF FF 84 03 00 00 01 00 00 00 FF FF FF FF FF FF FF FF	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	228	00 00 00 01 00 00 00 00 02 00 00 00 01 00 01 03 00 00 00 00 38 01 00 00 02 00 01 03 00 00 00 00 50 01 00 00 03 00 00 01 00 00 00 00 00 00 00 00 04 00 00 01 00 00 00 00 00 00 00 00 05 00 00 01 00 00 00 00 00 00 00 00 06 00 00 01 00 00 00 00 01 00 00 00 07 00 00 01 00 00 00 00 02 00 00 00 08 00 00 01	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	28	20 01 00 00 00 00 00 00 02 00 00 00 2D 00 73 74 64 6F 6C 65 32 2E 74 6C 62 57 57 57	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	512	FF FF FF FF DC 06 00 00 C8 0D 00 00 FF FF FF FF 4C 06 00 00 FF FF FF FF 00 08 00 00 D8 0B 00 00 FF FF FF FF FF FF FF FF FF FF FF FF E8 0B 00 00 90 0D 00 00 28 0A 00 00 34 04 00 00 FF FF FF FF E4 07 00 00 34 02 00 00 44 0C 00 00 FF FF FF FF FF FF FF FF FF FF FF FF 94 04 00 00 20 0B 00 00 D0 07 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	3760	FF FF FF FF FF FF FF FF 15 00 B9 EB 53 68 6F 63 6B 77 61 76 65 46 6C 61 73 68 4F 62 6A 65 63 74 73 57 57 57 00 00 00 00 FF FF FF FF 0F 38 D6 B5 49 53 68 6F 63 6B 77 61 76 65 46 6C 61 73 68 57 64 00 00 00 FF FF FF FF 13 38 01 03 49 43 61 6E 48 61 6E 64 6C 65 45 78 63 65 70 74 69 6F 6E 57 C8 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	1552	0F 00 53 68 6F 63 6B 77 61 76 65 20 46 6C 61 73 68 57 57 57 23 00 45 76 65 6E 74 20 69 6E 74 65 72 66 61 63 65 20 66 6F 72 20 53 68 6F 63 6B 77 61 76 65 20 46 6C 61 73 68 57 57 57 17 00 49 46 6C 61 73 68 46 61 63 74 6F 72 79 20 49 6E 74 65 72 66 61 63 65 57 57 57 1F 00 49 46 6C 61 73 68 4F 62 6A 65	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	368	1D 00 FF 7F 01 00 00 00 1A 00 FF 7F 00 00 00 00 1A 00 0C 40 0C 00 0C 80 1D 00 FF 7F 25 00 00 00 1A 00 FF 7F 18 00 00 00 1A 00 00 40 18 00 00 80 1A 00 FE 7F 28 00 00 00 1A 00 13 40 17 00 13 80 1D 00 FF 7F 31 00 00 00 1A 00 FF 7F 40 00 00 00 1A 00 10 40 10 00 10 80 1A 00 FE 7F 50 00 00 00 1A 00 03 40	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	4	60 12 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	2	20 00	success or wait	42	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	30	00 00 03 00 03 80 00 00 00 00 00 00 34 00 14 04 00 00 00 00 00 00 00 00 00 00 A8 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	30	01 00 03 00 03 80 00 00 00 00 04 00 34 00 14 04 01 00 00 00 00 00 00 00 00 00 C0 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	30	02 00 0B 00 0B 80 00 00 00 00 08 00 34 00 14 04 03 00 00 00 00 00 00 00 00 00 D8 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	2	2C 00	success or wait	38	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	30	03 00 18 00 00 80 00 00 00 00 0C 00 44 00 24 04 02 00 01 00 00 00 00 00 00 00 D8 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	12	0B 00 0B 80 FF FF FF FF 01 00 00 00	success or wait	7	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	30	04 00 16 00 03 80 00 00 00 00 10 00 34 00 14 04 05 00 00 00 00 00 00 00 00 00 EC 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	30	05 00 18 00 00 80 00 00 00 00 14 00 44 00 24 04 04 00 01 00 00 00 00 00 00 00 EC 00 00 00	success or wait	1	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	12	16 00 03 80 FF FF FF FF 01 00 00 00	success or wait	3	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	30	06 00 16 00 03 80 00 00 00 00 18 00 34 00 14 04 07 00 00 00 00 00 00 00 00 00 00 01 00 00	success or wait	1	6511810E	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	unknown	60	02 00 09 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 1E 00 05 00 00 00 0B 02 00 00 00 00 05 00 00 00 0C 02 C0 00 C0 00 05 00 00 00 07 01 04 00 00 00 22 D8 00 00 43 0F	success or wait	1	30EBB9AF	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	unknown	110654	20 00 CC 00 00 00 C0 00 C0 00 00 00 00 00 C0 00 C0 00 00 00 00 00 28 00 00 00 C0 00 00 00 40 FF FF FF 01 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	1	30EBB9AF	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	unknown	14	04 00 00 00 27 01 FF FF 03 00 00 00 00 00	success or wait	1	30EBB9AF	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	unknown	18	01 00 09 00 00 03 44 D8 00 00 00 00 22 D8 00 00 00 00	success or wait	1	30EBB9AF	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~WRD0002.doc	unknown	581	FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	1	3019476C	WriteFile
C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	unknown	90112	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65	success or wait	1	C0D0488	WriteFile
C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc	unknown	21504	D0 CF 11 E0 A1 B1 1A E1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3E 00 03 00 FE FF 09 00 06 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 25 00 00 00 00 00 00 00 00 10 00 00 27 00 00 00 01 00 00 00 FE FF FF FF 00 00 00 00 24 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	1	C0D0334	WriteFile

File Read

File Path	Offset	Length	Value	Completion	Count	Source Address	Symbol
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip	unknown	12	19 00 04 00 19 00 19 00 8C 06 00 00	success or wait	1	1	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip	unknown	1676	68 00 00 00 88 05 00 00 80 06 00 00 88 06 00 00 E7 69 CD 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	1	unknown
C:\WINDOWS\Registration\R000000000007.clb	unknown	22512	43 4F 4D 2B 01 00 00 00 01 00 12 00 24 00 00 00 00 01 01 00 63 00 00 00 00 00 00 01 01 00 00 00 00 01 10 00 00 00 00 00 C0 00 00 00 00 00 00 46 0E 00 00 00 30 01 00 00 A0 03 00 00 33 5F 30 00 D0 04 00 00 0C 00 00 00 33 5F 31 00 DC 04 00 00 88 02 00 00 33 5F 32 00 64 07 00 00 3C 00 00 00 33 5F 33 00	success or wait	1	12E854	unknown
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 21 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	12F398	unknown
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 24 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 48 00 41 00 4E 00 55 00 45 00 4C 00 45 00 2D 00 42 00 43 00 36 00 30 00 37 00 32 00 30 00 52 00	success or wait	1	12F398	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	unknown	64	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 00 00 00	success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	unknown	4	50 45 00 00	success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	unknown	20	4C 01 02 00 A1 95 00 46 00 00 00 00 00 00 00 00 E0 00 0E 21	success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	unknown	40	2E 72 73 72 63 00 00 00 98 06 0A 00 00 10 00 00 00 08 0A 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00	success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	unknown	8	A0 00 00 80 20 00 00 80	success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	unknown	2	07 00	success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	unknown	14	54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	2	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	unknown	8	01 00 00 00 50 00 00 80	success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	unknown	8	09 04 00 00 80 00 00 00	success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	unknown	16	B0 10 00 00 44 01 0A 00 00 00 00 00 00 00 00 00	success or wait	1	301EA8CD	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	64	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 00	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	4	50 45 00 00	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	20	4C 01 04 00 F1 05 41 46 00 00 00 00 00 00 00 00 E0 00 02 21	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	40	2E 74 65 78 74 00 00 00 CC FF 22 00 00 10 00 00 00 00 23 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	40	2E 64 61 74 61 00 00 00 A0 F0 00 00 00 10 23 00 00 D0 00 00 00 10 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	40	2E 72 73 72 63 00 00 00 A0 E7 01 00 00 10 24 00 00 F0 01 00 00 E0 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 00	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	8	40 18 00 80 60 00 00 80	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	2	07 00	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	14	54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	8	01 00 00 00 E0 04 00 80	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	8	09 04 00 00 80 10 00 00	success or wait	1	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	16	00 3E 25 00 40 B9 00 00 00 00 00 00 00 00 00 00	success or wait	1	460020	strchr
C:\WINDOWS\system32\stdole2.tlb	unknown	64	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00	success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	4	50 45 00 00	success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	20	4C 01 01 00 CE 29 02 48 00 00 00 00 00 00 00 00 E0 00 0F 21	success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	40	2E 72 73 72 63 00 00 00 60 3E 00 00 00 10 00 00 00 40 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00	success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	8	A0 00 00 80 20 00 00 80	success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	2	07 00	success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	14	54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	2	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	8	01 00 00 00 50 00 00 80	success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	8	09 04 00 00 80 00 00 00	success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	16	B0 10 00 00 40 3A 00 00 00 00 00 00 00 00 00 00	success or wait	1	1FF640	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	8	03 00 00 00 F8 04 00 80	success or wait	1	65050FA7	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	8	09 04 00 00 90 10 00 00	success or wait	1	65050FA7	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	unknown	16	60 FE 24 00 54 0F 00 00 00 00 00 00 00 00 00 00	success or wait	1	65050FA7	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	64	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 00	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	4	50 45 00 00	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	20	4C 01 05 00 00 1B 77 46 00 00 00 00 00 00 00 00 E0 00 0E 21	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	40	2E 74 65 78 74 00 00 00 59 7A 97 00 00 10 00 00 00 7C 97 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	40	2E 64 61 74 61 00 00 00 B4 43 05 00 00 90 97 00 00 AC 04 00 00 80 97 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	40	2E 63 64 61 74 61 00 00 04 00 00 00 00 E0 9C 00 00 02 00 00 00 2C 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	40	2E 72 73 72 63 00 00 00 E0 D6 10 00 00 F0 9C 00 00 D8 10 00 00 2E 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 03 00 0E 00	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	8	B6 6A 00 80 98 00 00 80	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	2	03 00	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	8	E0 6C 00 80 20 01 00 80	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	2	07 00	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	14	54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	2	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	8	01 00 00 00 90 14 00 80	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	8	09 04 00 00 98 48 00 00	success or wait	1	302952D2	unknown
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	unknown	16	20 19 AA 00 A4 AA 03 00 00 00 00 00 00 00 00 00	success or wait	1	302952D2	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	64	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	4	50 45 00 00	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	20	4C 01 07 00 A1 BD 39 4F 00 00 00 00 00 00 00 00 E0 00 02 21	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	40	2E 74 65 78 74 00 00 00 B9 0A 66 00 00 10 00 00 00 0C 66 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	40	2E 72 6F 64 61 74 61 00 E0 10 00 00 00 20 66 00 00 12 00 00 00 10 66 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	40	2E 72 64 61 74 61 00 00 32 1D 14 00 00 40 66 00 00 1E 14 00 00 22 66 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	40	2E 64 61 74 61 00 00 00 C4 7F 11 00 00 60 7A 00 00 E6 02 00 00 40 7A 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	40	2E 72 6F 64 61 74 61 00 A0 04 00 00 00 E0 8B 00 00 06 00 00 00 26 7D 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	40	2E 72 73 72 63 00 00 00 0C 0D 02 00 00 F0 8B 00 00 0E 02 00 00 2C 7D 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	16	00 00 00 00 00 00 00 00 04 00 00 00 02 00 0A 00	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	8	E0 11 00 80 70 00 00 80	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	2	08 00	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	8	F2 11 00 80 90 00 00 80	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	2	07 00	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	14	54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	16	00 00 00 00 00 00 00 00 04 00 00 00 00 00 02 00	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	8	01 00 00 00 48 02 00 80	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	16	00 00 00 00 00 00 00 00 04 00 00 00 00 00 01 00	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	8	1F 04 00 00 B0 08 00 00	success or wait	2	6511810E	unknown
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	unknown	16	34 24 8C 00 50 37 00 00 E4 04 00 00 00 00 00 00	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	0	unknown	success or wait	2	6511810E	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	unknown	64	4D 53 46 54 02 00 01 00 00 00 00 00 09 04 00 00 00 00 00 00 41 00 00 00 01 00 00 00 04 00 00 00 0B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 00 00 00 0E 06 00 00 00 00 00 00 FF FF FF FF	success or wait	1	6511810E	unknown
C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol	unknown	16384	00 BF 00 00 02 12 54 43 53 4F 00 04 00 00 00 00 00 08 73 65 74 74 69 6E 67 73 00 00 00 00 00 07 64 6F 6D 61 69 6E 73 03 00 09 61 64 6F 62 65 2E 63 6F 6D 01 01 00 0E 6D 61 63 72 6F 6D 65 64 69 61 2E 63 6F 6D 01 01 00 0D 77 77 77 2E 61 64 6F 62 65 2E 63 6F 6D 01 01 00 0E 61 64 73 32 2E 6D 73 61 64 73	success or wait	1	84	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	unknown	4096	01 00 09 00 00 03 44 D8 00 00 00 00 22 D8 00 00 00 00 03 00 00 00 1E 00 05 00 00 00 0B 02 00 00 00 00 05 00 00 00 0C 02 C0 00 C0 00 05 00 00 00 07 01 04 00 00 00 22 D8 00 00 43 0F 20 00 CC 00 00 00 C0 00 C0 00 00 00 00 00 C0 00 C0 00 00 00 00 00 28 00 00 00 C0 00 00 00 40 FF FF FF 01 00 18 00 00 00	success or wait	1	5	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	unknown	4096	FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	26	5	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	unknown	136	FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	1	5	unknown
C:\Documents and Settings\Administrator\Desktop\iPhone 5 Battery.doc	unknown	90112	C9 DF 16 87 9B 99 9A 9B 98 9D 9E 9F 6F 6E 92 93 2C 95 96 97 E8 E9 EA EB AC ED EE EF E0 E1 E2 E3 E4 E5 E6 E7 F8 F9 FA FB FC FD FE FF F0 F1 F2 F3 F4 F5 F6 F7 C8 C9 CA CB CC CD CE CF 38 C1 C2 C3 CA DA 7C C9 D8 6D D3 16 FD 65 DF 93 1D F0 86 BB BD A6 F6 A7 5A 46 4D 59 4D 40 0E 4C 41 4F 4C 4C 50 05 44 42	success or wait	1	C0D044D	ReadFile
C:\Documents and Settings\Administrator\Desktop\iPhone 5 Battery.doc	unknown	21504	32 2C F5 05 47 56 E2 18 FA FB FC FD FE FF F0 F1 F2 F3 F4 F5 F6 F7 C8 C9 F4 CB CF CD 30 30 C9 C1 C4 C3 C4 C5 C6 C7 D8 D9 DA DB DC DD DF DF D0 D1 F7 D3 D4 D5 D6 D7 28 29 2A 3B 2C 2D 09 2F 20 21 23 23 24 25 D8 D8 C7 C6 3A 3B 3C 3D 1A 3F 30 31 CD CC CB CA C9 C8 F7 F6 F5 F4 F3 F2 F1 F0 FF FE FD FC FB FA	success or wait	1	C0D02FB	ReadFile

Other File Operations

File Path	Disposition	Data	Ascii Data	Completion	Count	Source Address	Symbol
C:\Program Files\AutoIt3	90028	NU LL		success or wait	1	7C90E457	KiUserApcDispatcher
\lsarpc	11C017	05 00 00 03 10 00 00 00 40 00 00 00 01 00 00 00 28 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 00 02 00 01 00 00 08 00 00	........@.......(.....,.........................................	pending	2	12F398	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 74 00 00 00 02 00 00 00 5C 00 00 00 00 00 39 00 00 00 00 00 FE 12 B1 D8 1A 94 BA 42 BC C3 24 B0 96 90 64 DA 01 00 00 00 00 00 02 00 01 00 00 00 04 00 02 00 05 00 00 00 01 05 00 00 00 00 00 05 15 00 00 00 FD 43 46 1E 81 77 D9 74 43 17 0A 32 F4 01 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00	........t.......\.....9............B..$...d..................................CF..w.tC..2............................	pending	1	12F398	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 FE 12 B1 D8 1A 94 BA 42 BC C3 24 B0 96 90 64 DA	........,..........................B..$...d.	pending	1	12F398	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 88 00 00 00 02 00 00 00 70 00 00 00 00 00 44 00 00 00 00 00 B6 CD F3 C8 02 1F 22 4D B5 C5 90 23 8D 0F 97 B0 01 00 00 00 01 00 00 00 26 00 28 00 00 00 02 00 14 00 00 00 00 00 00 00 13 00 00 00 4E 00 54 00 20 00 41 00 55 00 54 00 48 00 4F 00 52 00 49 00 54 00 59 00 5C 00 53 00 59 00 53 00 54 00 45 00 4D 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00	................p.....D..........."M...#............&.(.................N.T. .A.U.T.H.O.R.I.T.Y.\.S.Y.S.T.E.M...........................	pending	1	12F398	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 B6 CD F3 C8 02 1F 22 4D B5 C5 90 23 8D 0F 97 B0	........,........................."M...#....	pending	1	12F398	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 40 00 00 00 04 00 00 00 28 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 00 02 00 01 00 00 08 00 00	........@.......(.....,.........................................	pending	1	660066	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 88 00 00 00 05 00 00 00 70 00 00 00 00 00 44 00 00 00 00 00 94 E1 17 1D 75 8F 81 43 B2 FE 2D 66 FF 46 A1 FC 01 00 00 00 01 00 00 00 26 00 28 00 00 00 02 00 14 00 00 00 00 00 00 00 13 00 00 00 4E 00 54 00 20 00 41 00 55 00 54 00 48 00 4F 00 52 00 49 00 54 00 59 00 5C 00 53 00 59 00 53 00 54 00 45 00 4D 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 00 00 00 00 02 00 00 00	................p.....D.........u..C..-f.F..........&.(.................N.T. .A.U.T.H.O.R.I.T.Y.\.S.Y.S.T.E.M...........................	pending	1	660066	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 06 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 94 E1 17 1D 75 8F 81 43 B2 FE 2D 66 FF 46 A1 FC	........,.......................u..C..-f.F..	pending	1	660066	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 40 00 00 00 07 00 00 00 28 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 00 02 00 01 00 00 08 00 00	........@.......(.....,.........................................	pending	1	FFFF	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 6A 00 00 00 08 00 00 00 52 00 00 00 00 00 1F 00 00 00 00 00 E2 7B CB D6 E5 F8 7D 4B 99 3E 5C DC F3 D5 AC B0 2A 00 2C 00 00 00 02 00 16 00 00 00 00 00 00 00 15 00 00 00 53 00 65 00 4C 00 6F 00 61 00 64 00 44 00 72 00 69 00 76 00 65 00 72 00 50 00 72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 00	........j.......R............{....}K.>\.....*.,.................S.e.L.o.a.d.D.r.i.v.e.r.P.r.i.v.i.l.e.g.e.	pending	1	FFFF	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 09 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 E2 7B CB D6 E5 F8 7D 4B 99 3E 5C DC F3 D5 AC B0	........,....................{....}K.>\.....	pending	1	FFFF	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 40 00 00 00 0A 00 00 00 28 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 00 02 00 01 00 00 08 00 00	........@.......(.....,.........................................	pending	1	FFFF	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 62 00 00 00 0B 00 00 00 4A 00 00 00 00 00 1F 00 00 00 00 00 21 C6 86 3A 0F 22 66 4F BD C4 99 0F DD 16 09 A8 22 00 24 00 00 00 02 00 12 00 00 00 00 00 00 00 11 00 00 00 53 00 65 00 55 00 6E 00 64 00 6F 00 63 00 6B 00 50 00 72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 00	........b.......J...........!..:."fO........".$.................S.e.U.n.d.o.c.k.P.r.i.v.i.l.e.g.e.	pending	1	FFFF	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 0C 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 21 C6 86 3A 0F 22 66 4F BD C4 99 0F DD 16 09 A8	........,...................!..:."fO........	pending	1	FFFF	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF5F05.tmp	PositionInformation	Offset: 512		success or wait	1	1004A	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF5F05.tmp	EndOfFileInformation	unknown		success or wait	1	1004A	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF5F05.tmp	AllocationInformation	unknown		success or wait	1	1004A	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF5F05.tmp	PositionInformation	Offset: 0		success or wait	1	1004A	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and archive and temporary and sparse file		success or wait	1	3017FDD4	SetFileAttributesW
C:\WINDOWS\Registration\R000000000007.clb	PositionInformation	Offset: 22512		success or wait	1	12E854	unknown
C:\WINDOWS\Registration\R000000000007.clb	PositionInformation	Offset: 0		success or wait	1	12E854	unknown
\lsarpc	PipeInformation	unknown		success or wait	2	12F398	unknown
\lsarpc	CompletionInformation	unknown		success or wait	2	12F398	unknown
C:\WINDOWS\Sti_Trace.log	PositionInformation	Offset: 0		success or wait	1	12F398	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF7B61.tmp	PositionInformation	Offset: 512		success or wait	1	124A2C	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF7B61.tmp	EndOfFileInformation	unknown		success or wait	1	124A2C	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF7B61.tmp	AllocationInformation	unknown		success or wait	1	124A2C	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF7B61.tmp	PositionInformation	Offset: 0		success or wait	1	124A2C	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	PositionInformation	Offset: 0		success or wait	2	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	PositionInformation	Offset: 184		success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	PositionInformation	Offset: 432		success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	PositionInformation	Offset: 472		success or wait	6	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	PositionInformation	Offset: 512		success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	PositionInformation	Offset: 536		success or wait	2	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	PositionInformation	Offset: 672		success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	PositionInformation	Offset: 544		success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	PositionInformation	Offset: 560		success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	PositionInformation	Offset: 592		success or wait	1	301EA8CD	unknown
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	PositionInformation	Offset: 640		success or wait	1	301EA8CD	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF0001.tmp	PositionInformation	Offset: 512		success or wait	1	302892EA	StgCreateDocfile
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF0001.tmp	EndOfFileInformation	unknown		success or wait	1	302892EA	StgCreateDocfile
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF0001.tmp	AllocationInformation	unknown		success or wait	1	302892EA	StgCreateDocfile
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF0001.tmp	PositionInformation	Offset: 0		success or wait	1	302892EA	StgCreateDocfile
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	PositionInformation	Offset: 0		success or wait	4	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	PositionInformation	Offset: 248		success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	PositionInformation	Offset: 496		success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	PositionInformation	Offset: 616		success or wait	12	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	PositionInformation	Offset: 2351104		success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	PositionInformation	Offset: 2351128		success or wait	4	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	PositionInformation	Offset: 2357312		success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	PositionInformation	Offset: 2351200		success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	PositionInformation	Offset: 2351216		success or wait	2	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	PositionInformation	Offset: 2352352		success or wait	1	460020	strchr
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	PositionInformation	Offset: 2355328		success or wait	1	460020	strchr
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 0		success or wait	2	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 192		success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 440		success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 480		success or wait	6	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 512		success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 536		success or wait	2	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 672		success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 544		success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 560		success or wait	1	1FF640	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 592		success or wait	1	1FF640	unknown

Section Activites

Section loaded by Windows

File Path	Access	Type	Base	Size	Mapped to pid	Protection	Completion	Count
\KnownDlls\kernel32.dll	write and read and execute	unknown	7C800000	1007616	own pid	read write	success or wait	1
unknown	query and write and read and execute and extend size	reserve	7C800000	1007616	own pid	read write	success or wait	1
\NLS\NlsSectionUnicode	read	unknown	260000	90112	own pid	readonly	success or wait	1
\NLS\NlsSectionLocale	read	unknown	280000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey	query and read	unknown	2D0000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortTbls	read	unknown	320000	24576	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\KnownDlls\ADVAPI32.dll	write and read and execute	unknown	77DD0000	634880	own pid	read write	success or wait	1
\KnownDlls\RPCRT4.dll	write and read and execute	unknown	77E70000	602112	own pid	read write	success or wait	1
\KnownDlls\Secur32.dll	write and read and execute	unknown	77FE0000	69632	own pid	read write	success or wait	1
\KnownDlls\GDI32.dll	write and read and execute	unknown	77F10000	299008	own pid	read write	success or wait	1
\KnownDlls\USER32.dll	write and read and execute	unknown	7E410000	593920	own pid	read write	success or wait	1
\KnownDlls\ole32.dll	write and read and execute	unknown	774E0000	1302528	own pid	read write	success or wait	1
\KnownDlls\msvcrt.dll	write and read and execute	unknown	77C10000	360448	own pid	read write	success or wait	1
\KnownDlls\VERSION.dll	write and read and execute	unknown	77C00000	32768	own pid	read write	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	410000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	410000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	query and write and read and execute	image	76390000	118784	own pid	read write	success or wait	1
\NLS\NlsSectionCType	read	unknown	850000	12288	own pid	readonly	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\1033\WWINTL.DLL	write and read and execute	commit	8C0000	778240	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\1033\WWINTL.DLL	query and read	commit	8C0000	778240	own pid	readonly	success or wait	1
\BaseNamedObjects\Local\Mso97SharedDg19211108172	query and write and read and execute and extend size	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\Mso97SharedDg19211108172	query and write and read	reserve	A10000	126976	own pid	read write	success or wait	1
\KnownDlls\uxtheme.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\uxtheme.dll	query and write and read and execute	image	5AD70000	229376	own pid	read write	success or wait	1
C:\WINDOWS\system32\msctf.dll	write and read and execute	commit	A50000	299008	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctf.dll	query and write and read and execute	image	74720000	311296	own pid	read write	success or wait	1
\BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-507921405-1960408961-839522115-500	query and write and read	commit	unknown	unknown	unknown	unknown	object name exists	1
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500SFM.DefaultS-1-5-21-507921405-1960408961-839522115-500	query and write and read and execute and extend size	unknown	A50000	262144	own pid	read write	success or wait	1
C:\WINDOWS\system32\msctfime.ime	write and read and execute	commit	A90000	180224	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctfime.ime	query and read	commit	A90000	180224	own pid	readonly	success or wait	1
C:\WINDOWS\system32\msctfime.ime	write and read and execute	commit	A90000	180224	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctfime.ime	query and read	commit	A90000	180224	own pid	readonly	success or wait	1
C:\WINDOWS\system32\msctfime.ime	write and read and execute	commit	A90000	180224	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctfime.ime	query and write and read and execute	image	755C0000	188416	own pid	read write	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\1033\MSOINTL.DLL	write and read and execute	commit	AA0000	1757184	own pid	execute	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\1033\MSOINTL.DLL	query and read	commit	AA0000	1757184	own pid	readonly	success or wait	1
\BaseNamedObjects\Local\Mso97SharedDg20321108172	query and write and read and execute and extend size	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\Mso97SharedDg20321108172	query and write and read	reserve	C50000	126976	own pid	read write	success or wait	1
C:\WINDOWS\system32\rpcss.dll	write and read and execute	commit	CF0000	401408	own pid	execute	success or wait	1
\KnownDlls\SHELL32.dll	write and read and execute	unknown	7C9C0000	8482816	own pid	read write	success or wait	1
C:\WINDOWS\system32\shell32.dll	read	commit	CF0000	8462336	own pid	readonly	success or wait	1
\KnownDlls\comctl32.dll	write and read and execute	unknown	5D090000	630784	own pid	read write	success or wait	1
C:\WINDOWS\system32\comctl32.dll	read	commit	CF0000	618496	own pid	readonly	success or wait	1
\BaseNamedObjects\DfSharedHeap35EFC	query and write and read	reserve	DA0000	4194304	own pid	read write	success or wait	1
\BaseNamedObjects\DFMap0-220928	query and write and read	commit	D10000	524288	own pid	read write	success or wait	1
\BaseNamedObjects\DfRoot000035EFC	query and write and read	commit	11A0000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\DFMap0-220944	query and write and read	commit	11B0000	524288	own pid	read write	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\RICHED20.DLL	write and read and execute	commit	1240000	1105920	own pid	execute	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\RICHED20.DLL	query and write and read and execute	image	39700000	1097728	own pid	read write	success or wait	1
\KnownDlls\OLEAUT32.dll	write and read and execute	unknown	77120000	569344	own pid	read write	success or wait	1
C:\WINDOWS\system32\msimtf.dll	write and read and execute	commit	1300000	159744	own pid	execute	success or wait	1
C:\WINDOWS\system32\msimtf.dll	write and read and execute	commit	1300000	159744	own pid	execute	success or wait	1
C:\WINDOWS\system32\msimtf.dll	write and read and execute	commit	1300000	159744	own pid	execute	success or wait	1
C:\WINDOWS\system32\msimtf.dll	write and read and execute	commit	1300000	159744	own pid	execute	success or wait	1
\BaseNamedObjects\CTF.AsmListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500	query and write and read and execute and extend size	unknown	1300000	4096	own pid	read write	success or wait	1
\KnownDlls\CLBCATQ.DLL	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\clbcatq.dll	query and write and read and execute	image	76FD0000	520192	own pid	read write	success or wait	1
\KnownDlls\COMRes.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\comres.dll	query and write and read and execute	image	77050000	806912	own pid	read write	success or wait	1
C:\WINDOWS\system32\winlogon.exe	write and read and execute	commit	1330000	507904	own pid	execute	success or wait	1
\KnownDlls\xpsp2res.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\xpsp2res.dll	query and write and read and execute	image	1330000	2904064	own pid	read write	conflicting addresses	1
C:\WINDOWS\system32\sti.dll	write and read and execute	commit	1900000	69632	own pid	execute	success or wait	1
C:\WINDOWS\system32\sti.dll	query and write and read and execute	image	73BA0000	77824	own pid	read write	success or wait	1
\KnownDlls\CFGMGR32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\cfgmgr32.dll	query and write and read and execute	image	74AE0000	28672	own pid	read write	success or wait	1
\KnownDlls\setupapi.DLL	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\setupapi.dll	query and write and read and execute	image	77920000	995328	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG..LMIJC	query and write and read	commit	1900000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.Shared.SFM.MNH	query and write and read and execute and extend size	unknown	1910000	524288	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG.B.LNIJC	query and write and read	commit	1900000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG.C.LNIJC	query and write and read	commit	1990000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG.D.LNIJC	query and write and read	commit	19A0000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG.E.LNIJC	query and write and read	commit	1900000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\Local\Mso97SharedDg19521108172	query and write and read and execute and extend size	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\Mso97SharedDg19521108172	query and write and read	reserve	19B0000	126976	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG.F.KOIJC	query and write and read	commit	1900000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG.G.KOIJC	query and write and read	commit	1900000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MNH.CB.KPIJC	query and write and read and execute and extend size	unknown	1900000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MNH.DB.KPIJC	query and write and read and execute and extend size	unknown	1900000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MNH.EB.KPIJC	query and write and read and execute and extend size	unknown	1900000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\Local\Mso97SharedDg19521108172	query and write and read and execute and extend size	unknown	1990000	126976	own pid	read write	success or wait	1
\BaseNamedObjects\Local\Mso97SharedDg19531108172	query and write and read and execute and extend size	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\Mso97SharedDg19531108172	query and write and read	reserve	1990000	126976	own pid	read write	success or wait	1
\BaseNamedObjects\DfSharedHeap37B58	query and write and read	reserve	19D0000	4194304	own pid	read write	success or wait	1
\BaseNamedObjects\DFMap0-228188	query and write and read	commit	1DD0000	598016	own pid	read write	success or wait	1
\BaseNamedObjects\DfRoot000037B58	query and write and read	commit	1E70000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\DFMap0-228204	query and write and read	commit	1E80000	524288	own pid	read write	success or wait	1
\KnownDlls\winspool.drv	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\winspool.drv	query and write and read and execute	image	73000000	155648	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll	write and read and execute	commit	2020000	745472	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll	query and write and read and execute	image	7E5A0000	761856	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2020000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2030000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2030000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2020000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2030000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2030000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2020000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2030000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2030000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2020000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2030000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2030000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2020000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2030000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2030000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2020000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2030000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2030000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll	write and read and execute	commit	2040000	761856	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll	query and write and read and execute	image	2040000	765952	own pid	read write	conflicting addresses	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2020000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2030000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2030000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll	write and read and execute	commit	2040000	761856	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll	query and write and read and execute	image	2040000	765952	own pid	read write	conflicting addresses	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll	write and read and execute	commit	2020000	765952	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll	query and write and read and execute	image	3F500000	786432	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2030000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2040000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2040000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2030000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2040000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2040000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2430000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2440000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2440000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2430000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2440000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2440000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2430000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2440000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2440000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2430000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2440000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2440000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2430000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2440000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2440000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\fontsub.dll	write and read and execute	commit	2430000	81920	own pid	execute	success or wait	1
C:\WINDOWS\system32\fontsub.dll	query and write and read and execute	image	69310000	94208	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2430000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2440000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2440000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2430000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2440000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2440000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2430000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2440000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2440000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll	write and read and execute	commit	1F20000	761856	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll	query and write and read and execute	image	1F20000	765952	own pid	read write	conflicting addresses	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll	write and read and execute	commit	1F20000	761856	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll	query and write and read and execute	image	1F20000	765952	own pid	read write	conflicting addresses	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll	write and read and execute	commit	1F20000	761856	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll	query and write and read and execute	image	1F20000	765952	own pid	read write	conflicting addresses	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\fontsub.dll	write and read and execute	commit	1F00000	81920	own pid	execute	success or wait	1
C:\WINDOWS\system32\fontsub.dll	query and write and read and execute	image	69310000	94208	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\prntvpt.dll	write and read and execute	commit	1F00000	118784	own pid	execute	success or wait	1
C:\WINDOWS\system32\prntvpt.dll	query and write and read and execute	image	3FB50000	131072	own pid	read write	success or wait	1
\BaseNamedObjects\AtlDebugAllocator_FileMappingNameStatic3_488	query and write and read	reserve	2430000	4194304	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\prntvpt.dll	write and read and execute	commit	1F00000	118784	own pid	execute	success or wait	1
C:\WINDOWS\system32\prntvpt.dll	query and write and read and execute	image	3FB50000	131072	own pid	read write	success or wait	1
\BaseNamedObjects\AtlDebugAllocator_FileMappingNameStatic3_488	query and write and read	reserve	2430000	4194304	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	1F00000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	1F10000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	1F10000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
\KnownDlls\USERENV.dll	write and read and execute	unknown	769C0000	737280	own pid	read write	success or wait	1
\BaseNamedObjects\Local\MSO_Formal11108172_S-1-5-21-507921405-1960408961-839522115-500	query and write and read and execute and extend size	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\MSO_Formal11108172_S-1-5-21-507921405-1960408961-839522115-500	query and write and read	commit	1F10000	8192	own pid	read write	success or wait	1
\BaseNamedObjects\Local\MSO_AdHoc11108172_S-1-5-21-507921405-1960408961-839522115-500	query and write and read and execute and extend size	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\MSO_AdHoc11108172_S-1-5-21-507921405-1960408961-839522115-500	query and write and read	commit	1F20000	8192	own pid	read write	success or wait	1
C:\WINDOWS\system32\msimtf.dll	write and read and execute	commit	1F70000	159744	own pid	execute	success or wait	1
\BaseNamedObjects\Global\RotHintTable	read	unknown	1F70000	4096	own pid	readonly	success or wait	1
\KnownDlls\msi.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msi.dll	query and write and read and execute	image	7D1E0000	2867200	own pid	read write	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	write and read and execute	commit	2830000	2588672	own pid	execute	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	query and read	commit	2830000	2588672	own pid	readonly	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	write and read and execute	commit	2830000	2588672	own pid	execute	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	query and read	commit	2830000	2588672	own pid	readonly	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL	write and read and execute	commit	2830000	2588672	own pid	execute	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL	query and read	commit	2830000	2588672	own pid	readonly	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL	write and read and execute	commit	2830000	2588672	own pid	execute	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL	query and read	commit	2830000	2588672	own pid	readonly	success or wait	1
\KnownDlls\SXS.DLL	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\sxs.dll	query and write and read and execute	image	7E720000	720896	own pid	read write	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB	query and read	commit	2830000	659456	own pid	readonly	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\1033\VBE6INTL.DLL	write and read and execute	commit	1FA0000	163840	own pid	execute	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\1033\VBE6INTL.DLL	query and write and read and execute	image	65300000	155648	own pid	read write	success or wait	1
\BaseNamedObjects\DfSharedHeap38B25	query and write and read	reserve	2A30000	4194304	own pid	read write	success or wait	1
\BaseNamedObjects\DFMap0-232234	query and write and read	commit	2E30000	524288	own pid	read write	success or wait	1
\BaseNamedObjects\DfRoot000038B25	query and write and read	commit	1FE0000	4096	own pid	read write	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	query and read	commit	2F40000	53248	own pid	readonly	success or wait	1
C:\WINDOWS\system32\stdole2.tlb	query and read	commit	2F50000	16384	own pid	readonly	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	query and read	commit	2F60000	57344	own pid	readonly	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	query and read	commit	2FB0000	266240	own pid	readonly	success or wait	1
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	query and read	commit	3000000	40960	own pid	readonly	success or wait	1
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	query and read	commit	3010000	20480	own pid	readonly	success or wait	1
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	query and read	commit	3000000	40960	own pid	readonly	success or wait	1
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	write and read and execute	commit	3020000	8634368	own pid	execute	success or wait	1
C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx	query and write and read and execute	image	10000000	9596928	own pid	read write	success or wait	1
\KnownDlls\WINMM.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\winmm.dll	query and write and read and execute	image	76B40000	184320	own pid	read write	success or wait	1
\KnownDlls\WININET.dll	write and read and execute	unknown	3D930000	942080	own pid	read write	success or wait	1
\KnownDlls\Normaliz.dll	write and read and execute	unknown	3030000	36864	own pid	read write	conflicting addresses	1
\KnownDlls\urlmon.dll	write and read and execute	unknown	78130000	1257472	own pid	read write	success or wait	1
\KnownDlls\iertutil.dll	write and read and execute	unknown	3DFD0000	2002944	own pid	read write	success or wait	1
\KnownDlls\CRYPT32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\crypt32.dll	query and write and read and execute	image	77A80000	610304	own pid	read write	success or wait	1
\KnownDlls\MSASN1.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msasn1.dll	query and write and read and execute	image	77B20000	73728	own pid	read write	success or wait	1
\KnownDlls\DSOUND.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\dsound.dll	query and write and read and execute	image	73F10000	376832	own pid	read write	success or wait	1
\KnownDlls\COMDLG32.dll	write and read and execute	unknown	763B0000	299008	own pid	read write	success or wait	1
\KnownDlls\WS2_32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\ws2_32.dll	query and write and read and execute	image	71AB0000	94208	own pid	read write	success or wait	1
\KnownDlls\WS2HELP.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\ws2help.dll	query and write and read and execute	image	71AA0000	32768	own pid	read write	success or wait	1
\KnownDlls\d3d9.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\d3d9.dll	query and write and read and execute	image	4FDD0000	1728512	own pid	read write	success or wait	1
\KnownDlls\d3d8thk.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\d3d8thk.dll	query and write and read and execute	image	6D990000	24576	own pid	read write	success or wait	1
\KnownDlls\mscms.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\mscms.dll	query and write and read and execute	image	73B30000	86016	own pid	read write	success or wait	1
\KnownDlls\ieframe.dll	write and read and execute	unknown	3E1C0000	11096064	own pid	read write	success or wait	1
C:\WINDOWS\system32\en-us\ieframe.dll.mui	query and read	commit	35B0000	1241088	own pid	write copy	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	36E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	36E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	36E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	36E0000	12312576	own pid	execute	success or wait	1
\KnownDlls\msapsspc.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msapsspc.dll	query and write and read and execute	image	71E50000	86016	own pid	read write	success or wait	1
\KnownDlls\MSVCRT40.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msvcrt40.dll	query and write and read and execute	image	78080000	69632	own pid	read write	success or wait	1
\KnownDlls\schannel.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\schannel.dll	query and write and read and execute	image	767F0000	163840	own pid	read write	success or wait	1
\KnownDlls\NETAPI32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\netapi32.dll	query and write and read and execute	image	5B860000	348160	own pid	read write	success or wait	1
\KnownDlls\digest.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\digest.dll	query and write and read and execute	image	75B00000	86016	own pid	read write	success or wait	1
\KnownDlls\msnsspc.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msnsspc.dll	query and write and read and execute	image	747B0000	290816	own pid	read write	success or wait	1
\KnownDlls\MSVCRT40.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msvcrt40.dll	query and write and read and execute	image	78080000	69632	own pid	read write	success or wait	1
C:\WINDOWS\system32\schannel.dll	write and read and execute	commit	36E0000	151552	own pid	execute	success or wait	1
C:\WINDOWS\system32\schannel.dll	query and write and read and execute	image	767F0000	163840	own pid	read write	success or wait	1
\KnownDlls\NETAPI32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\netapi32.dll	query and write and read and execute	image	5B860000	348160	own pid	read write	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	write and read and execute	commit	39E0000	12312576	own pid	execute	success or wait	1
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf	query and read	commit	39F0000	114688	own pid	readonly	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\GDIPLUS.DLL	write and read and execute	commit	39F0000	1703936	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\GDIPLUS.DLL	query and write and read and execute	image	39F0000	1708032	own pid	read write	conflicting addresses	1
\KnownDlls\WTSAPI32.DLL	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\wtsapi32.dll	query and write and read and execute	image	76F50000	32768	own pid	read write	success or wait	1
\KnownDlls\WINSTA.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\winsta.dll	query and write and read and execute	image	76360000	65536	own pid	read write	success or wait	1
C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	query and write and read and execute and extend size	image	76360000	65536	own pid	read write	success or wait	1
C:\WINDOWS\system32\apphelp.dll	write and read and execute	commit	FF20000	126976	own pid	execute	success or wait	1
C:\WINDOWS\system32\apphelp.dll	query and write and read and execute	image	77B40000	139264	own pid	read write	success or wait	1
C:\WINDOWS\AppPatch\sysmain.sdb	read	commit	24C30000	1208320	own pid	readonly	success or wait	1
C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	query and read	commit	FF20000	90112	own pid	readonly	success or wait	1
C:\WINDOWS\system32\cmd.exe	query and write and read and execute and extend size	image	FF20000	90112	own pid	readonly	success or wait	1
C:\WINDOWS\AppPatch\sysmain.sdb	read	commit	24C30000	1208320	own pid	readonly	success or wait	1
C:\WINDOWS\system32\cmd.exe	write and read and execute	commit	FF30000	389120	own pid	execute	success or wait	1
C:\WINDOWS\system32\cmd.exe	query and read	commit	FF30000	389120	own pid	readonly	success or wait	1
C:\WINDOWS\system32\cmd.exe	write and read and execute	commit	FF30000	389120	own pid	execute	success or wait	1
C:\WINDOWS\system32\cmd.exe	query and read	commit	FF30000	389120	own pid	readonly	success or wait	1
C:\WINDOWS\system32\cmd.exe	query and read	commit	FF30000	389120	own pid	readonly	success or wait	1

Section loaded by Program

File Path	Access	Type	Base	Size	Mapped to pid	Protection	Completion	Count	Source Address
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	write and read and execute	commit	860000	12259328	own pid	execute	success or wait	1	30003071
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	query and write and read and execute	image	30C90000	12304384	own pid	read write	success or wait	1	30003071
\BaseNamedObjects\ShimSharedMemory	write	unknown	870000	57344	own pid	read write	success or wait	1	30003071
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	write and read and execute	commit	A30000	1056768	own pid	execute	success or wait	1	30029E78
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	query and write and read and execute	image	773D0000	1060864	own pid	read write	success or wait	1	30029E78
\KnownDlls\SHLWAPI.dll	write and read and execute	unknown	77F60000	483328	own pid	read write	success or wait	1	30029E78
C:\WINDOWS\WindowsShell.Manifest	write and read and execute	commit	A30000	4096	own pid	execute	success or wait	1	30029E78
C:\WINDOWS\WindowsShell.Manifest	query and read	commit	A30000	4096	own pid	readonly	success or wait	1	30029E78
C:\WINDOWS\WindowsShell.Manifest	read	commit	A30000	4096	own pid	readonly	success or wait	1	30029E78
\BaseNamedObjects\PrimaryWord11SharedMemoryArea	read	unknown	unknown	unknown	unknown	unknown	object name not found	1	3002AA90
\BaseNamedObjects\PrimaryWord11SharedMemoryArea	query and write and read	commit	A90000	4096	own pid	read write	success or wait	1	3002AAA7
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	write and read and execute	commit	28E0000	2588672	own pid	execute	success or wait	1	30294584
C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL	query and write and read and execute	image	65000000	2588672	own pid	read write	success or wait	1	30294584
\KnownDlls\MSIMG32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1	30003601
C:\WINDOWS\system32\msimg32.dll	query and write and read and execute	image	76380000	20480	own pid	read write	success or wait	1	30003601

Registry Activites

Key Path	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency	success or wait	3	74497075	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	success or wait	2	74497075	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Migration\Word	success or wait	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Wizards	success or wait	1	30C90000	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\UserInfo	success or wait	1	FF685D0	RtlAllocateHeap
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	success or wait	1	448	unknown
HKEY_USERS\Software\Microsoft\VBA	success or wait	1	6506064F	unknown
HKEY_USERS\Software\Microsoft\VBA\6.0	success or wait	1	6506064F	unknown
HKEY_USERS\Software\Microsoft\VBA\6.0\Common	success or wait	1	6506064F	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\FLAGS	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\0	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\0\win32	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\HELPDIR	success or wait	1	6511810E	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery	success or wait	1	3018E365	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery\2A9B4	success or wait	1	3018E365	unknown

Key Path	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	success or wait	2	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency	success or wait	2	1	unknown

Key Path	Key Value Name	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems		success or wait	1	307C3F7C	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	y	success or wait	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	9	success or wait	1	3018E1E0	unknown

Key Path	Name	Type	Data	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	y	binary	79 13 02 00 88 04 00 00 01 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	74497075	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	FontInfoCache	binary	60 00 00 00 60 00 00 00 F5 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 BC 02 00 00 00 00 00 00 00 40 00 22 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 12 00 20 E9 90 7C 10 00 00 00 00 F1 12 00 08 F1 12 00 00 00 00 00 E4 F0 12 00 D6 20 91 7C 54 F2 12 00 0E 00 00 00 F0 F0 12 00 24 F1 12 00 1C 00 00 00 54 F2 12 00 9C 00 00 00 00 00 00 00 00 00 00 00 30 F2 12 00 3A 2C 81 7C 08 F1 12 00 0E 00 00 00 00 00 00 00 D4 F2 12 00 4D 2C 81 7C 1C 00 1E 00 24 F1 12 00 0E 00 80 00 54 F2 12 00 1C 01 00 00 05 00 00 00 01 00 00 00 28 0A 00 00 02 00 00 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 33 00 00 00 12 00 5C F6 90 7C 61 F6 90 7C B4 F1 12 00 6E D9 90 7C 74 F2 12 00 4C F1 12 00 7A D9 90 7C 08 50 41 7E 32 F2 12 00 00 39 41 7E D0 00 00 00 C0 F1 12 00 3B 7D 91 7C 32 F2 12 00 DC 02 00 00 00 00 41 7E 98 44 41 7E 08 50 41 7E 00 00 00 00 01 00 00 00 30 F2 12 00 00 00 00 00 01 00 00 00 00 00 41 7E D8 00 41 7E 98 F1 12 00 01 00 00 00 D0 F1 12 00 85 03 91 7C 00 00 41 7E 00 00 00 00 8C F2 12 00 02 7C 91 7C 00 00 41 7E 32 F2 12 00 2C F2 12 00 2C F2 12 00 32 F2 12 00 A7 7C 91 7C 74 E1 97 7C 51 7C 91 7C 74 DD 00 30 40 AE 80 7C FF FF 00 00 00 F0 FD 7F 7A CF 90 7C 42 9B 80 7C FF FF FF FF 50 F2 12 00 00 00 00 00 54 F2 12 00 00 10 00 00 59 9B 80 7C 04 00 00 00 00 20 00 00 00 10 00 00 00 00 00 00 E8 22 24 00 18 F2 12 00 00 00 45 6E B0 FF 12 00 D8 9A 83 7C 60 9B 80 7C FF FF FF FF 59 9B 80 7C 09 9B 80 7C FF FF FF FF 00 10 9A 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 9A 00 D2 B9 CB 30 00 10 9A 00 00 10 00 00 F4 B9 CB 30 28 2F 62 31 40 02 00 00 00 00 9A 00 03 20 00 00 00 10 00 00 CE B8 CB 30 03 00 00 00 FD 3F 00 00 0D 00 00 00 0B 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 06 00 00 00 1A 00 00 00 BC 02 00 00 00 00 00 00 60 00 00 00 60 00 00 00 1E FF 1F 20 00 00 00 27 00 00 01 01 87 7A 00 61 00 00 00 80 08 00 00 00 00 00 00 00 01 00 00 00 00 00 28 20 07 00 00 00 F5 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 00 00 00 00 00 00 40 00 22 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 12 00 20 E9 90 7C 10 00 00 00 00 F1 12 00 08 F1 12 00 00 00 00 00 E4 F0 12 00 D6 20 91 7C 54 F2 12 00 0E 00 00 00 F0 F0 12 00 24 F1 12 00 1C 00 00 00 54 F2 12 00 9C 00 00 00 00 00 00 00 00 00 00 00 30 F2 12 00 3A 2C 81 7C 08 F1 12 00 0E 00 00 00 00 00 00 00 D4 F2 12 00 4D 2C 81 7C 1C 00 1E 00 24 F1 12 00 0E 00 80 00 54 F2 12 00 1C 01 00 00 05 00 00 00 01 00 00 00 28 0A 00 00 02 00 00 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 33 00 00 00 12 00 5C F6 90 7C 61 F6 90 7C B4 F1 12 00 6E D9 90 7C 74 F2 12 00 4C F1 12 00 7A D9 90 7C 08 50 41 7E 32 F2 12 00 00 39 41 7E D0 00 00 00 C0 F1 12 00 3B 7D 91 7C 32 F2 12 00 DC 02 00 00 00 00 41 7E 98 44 41 7E 08 50 41 7E 00 00 00 00 01 00 00 00 30 F2 12 00 00 00 00 00 01 00 00 00 00 00 41 7E D8 00 41 7E 98 F1 12 00 01 00 00 00 D0 F1 12 00 85 03 91 7C 00 00 41 7E 00 00 00 00 8C F2 12 00 02 7C 91 7C 00 00 41 7E 32 F2 12 00 2C F2 12 00 2C F2 12 00 32 F2 12 00 A7 7C 91 7C 74 E1 97 7C 51 7C 91 7C 74 DD 00 30 40 AE 80 7C FF FF 00 00 00 F0 FD 7F 7A CF 90 7C 42 9B 80 7C FF FF FF FF 50 F2 12 00 00 00 00 00 54 F2 12 00 00 10 00 00 59 9B 80 7C 04 00 00 00 00 20 00 00 00 10 00 00 00 00 00 00 E8 22 24 00 18 F2 12 00 00 00 45 6E B0 FF 12 00 D8 9A 83 7C 60 9B 80 7C FF FF FF FF 59 9B 80 7C 09 9B 80 7C FF FF FF FF 00 10 9A 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 9A 00 D2 B9 CB 30 00 10 9A 00 00 10 00 00 F4 B9 CB 30 28 2F 62 31 40 02 00 00 00 00 9A 00 03 20 00 00 00 10 00 00 CE B8 CB 30 03 00 00 00 FD 3F 00 00 0D 00 00 00 0B 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 05 00 00 00 15 00 00 00 90 01 00 00 00 00 00 00 60 00 00 00 60 00 00 00 1E FF 1F 20 00 00 00 27 00 00 01 01 87 7A 00 61 00 00 00 80 08 00 00 00 00 00 00 00 01 00 00 00 00 00 28 20 06 00 00 00 F7 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 00 00 00 00 00 00 40 00 22 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 12 00 20 E9 90 7C 10 00 00 00 00 F1 12 00 08 F1 12 00 00 00 00 00 E4 F0 12 00 D6 20 91 7C 54 F2 12 00 0E 00 00 00 F0 F0 12 00 24 F1 12 00 1C 00 00 00 54 F2 12 00 9C 00 00 00 00 00 00 00 00 00 00 00 30 F2 12 00 3A 2C 81 7C 08 F1 12 00 0E 00 00 00 00 00 00 00 D4 F2 12 00 4D 2C 81 7C 1C 00 1E 00 24 F1 12 00 0E 00 80 00 54 F2 12 00 1C 01 00 00 05 00 00 00 01 00 00 00 28 0A 00 00 02 00 00 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 33 00 00 00 12 00 5C F6 90 7C 61 F6 90 7C B4 F1 12 00 6E D9 90 7C 74 F2 12 00 4C F1 12 00 7A D9 90 7C 08 50 41 7E 32 F2 12 00 00 39 41 7E D0 00 00 00 C0 F1 12 00 3B 7D 91 7C 32 F2 12 00 DC 02 00 00 00 00 41 7E 98 44 41 7E 08 50 41 7E 00 00 00 00 01 00 00 00 30 F2 12 00 00 00 00 00 01 00 00 00 00 00 41 7E D8 00 41 7E 98 F1 12 00 01 00 00 00 D0 F1 12 00 85 03 91 7C 00 00 41 7E 00 00 00 00 8C F2 12 00 02 7C 91 7C 00 00 41 7E 32 F2 12 00 2C F2 12 00 2C F2 12 00 32 F2 12 00 A7 7C 91 7C 74 E1 97 7C 51 7C 91 7C 74 DD 00 30 40 AE 80 7C FF FF 00 00 00 F0 FD 7F 7A CF 90 7C 42 9B 80 7C FF FF FF FF 50 F2 12 00 00 00 00 00 54 F2 12 00 00 10 00 00 59 9B 80 7C 04 00 00 00 00 20 00 00 00 10 00 00 00 00 00 00 E8 22 24 00 18 F2 12 00 00 00 45 6E B0 FF 12 00 D8 9A 83 7C 60 9B 80 7C FF FF FF FF 59 9B 80 7C 09 9B 80 7C FF FF FF FF 00 10 9A 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 9A 00 D2 B9 CB 30 00 10 9A 00 00 10 00 00 F4 B9 CB 30 28 2F 62 31 40 02 00 00 00 00 9A 00 03 20 00 00 00 10 00 00 CE B8 CB 30 03 00 00 00 FD 3F 00 00 0B 00 00 00 09 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 04 00 00 00 11 00 00 00 90 01 00 00 00 00 00 00 60 00 00 00 60 00 00 00 1E FF 1F 20 00 00 00 27 00 00 01 01 87 7A 00 61 00 00 00 80 08 00 00 00 00 00 00 00 01 00 00 00 00 00 28 20 05 00 00 00 F5 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 BC 02 00 00 00 00 00 00 00 40 00 22 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 12 00 20 E9 90 7C 10 00 00 00 00 F1 12 00 08 F1 12 00 00 00 00 00 E4 F0 12 00 D6 20 91 7C 54 F2 12 00 0E 00 00 00 F0 F0 12 00 24 F1 12 00 1C 00 00 00 54 F2 12 00 9C 00 00 00 00 00 00 00 00 00 00 00 30 F2 12 00 3A 2C 81 7C 08 F1 12 00 0E 00 00 00 00 00 00 00 D4 F2 12 00 4D 2C 81 7C 1C 00 1E 00 24 F1 12 00 0E 00 80 00 54 F2 12 00 1C 01 00 00 05 00 00 00 01 00 00 00 28 0A 00 00 02 00 00 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 33 00 00 00 12 00 5C F6 90 7C 61 F6 90 7C B4 F1 12 00 6E D9 90 7C 74 F2 12 00 4C F1 12 00 7A D9 90 7C 08 50 41 7E 32 F2 12 00 00 39 41 7E D0 00 00 00 C0 F1 12 00 3B 7D 91 7C 32 F2 12 00 DC 02 00 00 00 00 41 7E 98 44 41 7E 08 50 41 7E 00 00 00 00 01 00 00 00 30 F2 12 00 00 00 00 00 01 00 00 00 00 00 41 7E D8 00 41 7E 98 F1 12 00 01 00 00 00 D0 F1 12 00 85 03 91 7C 00 00 41 7E 00 00 00 00 8C F2 12 00 02 7C 91 7C 00 00 41 7E 32 F2 12 00 2C F2 12 00 2C F2 12 00 32 F2 12 00 A7 7C 91 7C 74 E1 97 7C 51 7C 91 7C 74 DD 00 30 40 AE 80 7C FF FF 00 00 00 F0 FD 7F 7A CF 90 7C 42 9B 80 7C FF FF FF FF 50 F2 12 00 00 00 00 00 54 F2 12 00 00 10 00 00 59 9B 80 7C 04 00 00 00 00 20 00 00 00 10 00 00 00 00 00 00 E8 22 24 00 18 F2 12 00 00 00 45 6E B0 FF 12 00 D8 9A 83 7C 60 9B 80 7C FF FF FF FF 59 9B 80 7C 09 9B 80 7C FF FF FF FF 00 10 9A 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 9A 00 D2 B9 CB 30 00 10 9A 00 00 10 00 00 F4 B9 CB 30 28 2F 62 31 40 02 00 00 00 00 9A 00 03 20 00 00 00 10 00 00 CE B8 CB 30 03 00 00 00 FD 3F 00 00 0D 00 00 00 0B 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 06 00 00 00 1A 00 00 00 BC 02 00 00 00 00 00 00 60 00 00 00 60 00 00 00 1E FF 1F 20 00 00 00 27 00 00 01 01 87 7A 00 61 00 00 00 80 08 00 00 00 00 00 00 00 01 00 00 00 00 00 28 20 07 00 00 00	success or wait	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Wizards	PageSize	unicode	Letter	success or wait	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	MTTT	binary	88 04 00 00 8C 88 76 79 EA 69 CD 01 00 00 00 00	success or wait	1	4C2FF	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\UserInfo	UserInfo	binary	09 04 68 06 FF 80 40 60 50 38 24 16 0D 06 5F C1 E0 0F 98 33 E9 FE FD 81 BF A0 8C 78 03 7D 7E FC 1F AE 59 87 C3 9A 61 F2 CB 80 3D DF C3 F8 0C 25 FE 3A 7F 44 20 51 28 1A EE 02 BD 7D B7 C6 CB 75 FA B4 DE 79 67 C0 1E CF D6 FC 02 55 27 87 BB E5 70 43 F8 C5 74 98 46 3D 8D EB 69 A4 D8 F4 AB 15 18 C6 07 B7 CA 85 9A 4C 59 87 DF CD A7 A3 10 C8 7A 4C 33 47 63 88 21 F9 AC D6 2B 2D 5E AE F5 C3 38 FE 6D 36 3E 95 4E 55 73 59 F6 F6 4B 2D 1E B3 6A DB C9 6A AD 7C 9A D6 96 7B 2D 9D AD 6A 77 AF 96 EA 67 69 BC F6 6A 76 AD AE CF 65 B2 D5 8B 36 7E 02 9E CB 55 73 EC 1A 85 6B 05 A0 8B AC 32 D6 95 8A 5E E3 71 EE DD 23 F5 AD 95 BF 9B 5F AE AC DA BC F6 7E 5E B5 9E D3 D8 13 1C 62 EE 6C 2D A6 21 98 D8 CD 30 FB 75 8B 8C 63 73 F0 E5 62 CD 63 2C F6 5B 46 2A D0 F6 88 62 BB C3 1B C8 13 DD DF 12 8C 42 A4 30 57 BF 8A 42 DF 86 79 BC 70 49 CF AB DD EF F8 7C 7E 5F 3F A7 D7 ED F7 FC 7E 7F 5F BF E7 F7 FD FF 80 20 18 0A 03 81 20 58 1A 07 82 20 98 2A 0B 83 20 D8 3A 0F 84 21 18 49 EE	success or wait	1	30CBCE18	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems		binary	05 14 02 00 88 04 00 00 04 00 00 00 00 00 00 00 BE 00 00 00 01 00 00 00 B6 00 00 00 57 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 41 00 70 00 70 00 6C 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20 00 44 00 61 00 74 00 61 00 5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 5C 00 54 00 65 00 6D 00 70 00 6C 00 61 00 74 00 65 00 73 00 5C 00 4E 00 6F 00 72 00 6D 00 61 00 6C 00 2E 00 64 00 6F 00 74 00 00 00 00 00 00 00	success or wait	1	303CE628	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FirstRun	dword	0	success or wait	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Assistant	CurrAsstState	dword	38	success or wait	1	12F67C	RtlImageDirectoryEntryToData
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	9	binary	39 19 02 00 88 04 00 00 06 00 00 00 01 00 00 00 9A 00 00 00 02 00 00 00 8A 00 00 00 04 00 00 00 63 00 3A 00 5C 00 64 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 73 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 61 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 64 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 69 00 70 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 62 00 61 00 74 00 74 00 65 00 72 00 79 00 2E 00 64 00 6F 00 63 00 00 00 00 00 00 00	success or wait	1	3018D7E2	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Times New Roman	binary	02 02 06 03 05 04 05 02 03 04	success or wait	1	6E	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Arial	binary	02 0B 06 04 02 02 02 02 02 04	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Courier New	binary	02 07 03 09 02 02 05 02 04 04	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Symbol	binary	05 05 01 02 01 07 06 02 05 07	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Wingdings	binary	05 00 00 00 00 00 00 00 00 00	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Sylfaen	binary	01 0A 05 02 05 03 06 03 03 03	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Vrinda	binary	01 01 06 00 01 01 01 01 01 01	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Kartika	binary	02 02 05 03 03 04 04 06 02 03	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Tahoma	binary	02 0B 06 04 03 05 04 04 02 04	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Marlett	binary	00 00 00 00 00 00 00 00 00 00	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Lucida Console	binary	02 0B 06 09 04 05 04 02 02 04	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Lucida Sans Unicode	binary	02 0B 06 02 03 05 04 02 02 04	success or wait	1	630069	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Verdana	binary	02 0B 06 04 03 05 04 04 02 04	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Arial Black	binary	02 0B 0A 04 02 01 02 02 02 04	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Comic Sans MS	binary	03 0F 07 02 03 03 02 02 02 04	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Impact	binary	02 0B 08 06 03 09 02 05 02 04	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Georgia	binary	02 04 05 02 05 04 05 02 03 03	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Franklin Gothic Medium	binary	02 0B 06 03 02 01 02 02 02 04	success or wait	1	200063	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Palatino Linotype	binary	02 04 05 02 05 05 05 03 03 04	success or wait	1	700079	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Trebuchet MS	binary	02 0B 06 03 02 02 02 02 02 04	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Webdings	binary	05 03 01 02 01 05 09 06 07 03	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Microsoft Sans Serif	binary	02 0B 06 04 02 02 02 02 02 04	success or wait	1	530020	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Book Antiqua	binary	02 04 06 02 05 03 05 03 03 04	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Bookman Old Style	binary	02 05 06 04 05 05 05 02 02 04	success or wait	1	6C0079	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Century Gothic	binary	02 0B 05 02 02 02 02 02 02 04	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Garamond	binary	02 02 04 04 03 03 01 01 08 03	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Monotype Corsiva	binary	03 01 01 01 01 02 01 01 01 01	success or wait	1	610076	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Wingdings 2	binary	05 02 01 02 01 05 07 07 07 07	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Wingdings 3	binary	05 04 01 02 01 08 07 07 07 07	success or wait	1	300A2F48	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Bookshelf Symbol 7	binary	05 01 01 01 01 01 01 01 01 01	success or wait	1	6C006F	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	MS Reference Sans Serif	binary	02 0B 06 04 03 05 04 04 02 04	success or wait	1	6E0061	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	MS Reference Specialty	binary	05 00 05 00 00 00 00 00 00 00	success or wait	1	650070	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Arial Narrow	binary	02 0B 06 06 02 02 02 03 02 04	success or wait	1	300A2F48	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	VBAFiles	dword	1089994753	success or wait	1	7C9141DF	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery\2A9B4	2A9B4	binary	04 00 00 00 88 04 00 00 44 00 00 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 2E 00 64 00 6F 00 63 00 10 00 00 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 00 00 00 00 01 00 00 00 00 00 00 00 C5 C4 CB 7C AB 7B CD 01 B4 A9 02 00 B4 A9 02 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	3018E365	unknown

Key Path	Name	Type	Old Data	New Data	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	2055	unicode	Off	On	success or wait	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	2055	unicode	On	Off	success or wait	1	FF909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	WORDFiles	dword	1089994753	1089994754	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	ProductFiles	dword	1089994754	1089994755	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	WORDFiles	dword	1089994754	1089994755	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	WORDFiles	dword	1089994755	1089994756	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	WORDFiles	dword	1089994757	1089994758	success or wait	1	301CBB03	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0	NULL	unicode		Shockwave Flash	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\FLAGS	NULL	unicode		4	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\0\win32	NULL	unicode		C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\HELPDIR	NULL	unicode		C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0	success or wait	1	6511810E	unknown
HKEY_USERS\Software\Microsoft\Direct3D\MostRecentApplication	Name	unicode	iexplore.exe	WINWORD.EXE	success or wait	1	6	unknown

Key Value Queried

Key Path	Name	Completion	Count	Source Address	Symbol
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CWDIllegalInDLLSearch	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server	TSAppCompat	success or wait	3	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server	TSUserEnabled	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	LeakTrack	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	SafeDllSearchMode	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize	DisableMetaFiles	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows	AppInit_DLLs	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CriticalSectionTimeout	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	RWLockResourceTimeOut	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAllForOle32	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableTypeLib	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAllForOle32	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	CommonFilesDir	success or wait	1	3000303D	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mso.dll	CheckAppHelp	success or wait	1	30003071	LoadLibraryW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility	DisableAppCompat	object name not found	1	30003071	LoadLibraryW
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	y	object name not found	1	74497075	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\General	InstalledOnWin2k	success or wait	1	220065	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	UserData	success or wait	1	220065	unknown
HKEY_USERS\Software\Microsoft\Office\Common	QMStrMax	object name not found	1	30CBAD8F	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	QMStudyID	object name not found	1	30CBB599	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	UserData	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\LanguageResources	SKULanguage	success or wait	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	InstallLanguage	success or wait	1	30CB0CC3	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	UILanguage	success or wait	1	30CB0CC3	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	HelpLanguage	success or wait	1	30CB0CC3	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	ExeMode	object name not found	1	30CB0CC3	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	WinXPLanguagePatch	success or wait	1	30CB0CC3	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	PreviousInstallLanguage	success or wait	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	WebLocale	success or wait	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	LangTuneUp	success or wait	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Shared	OfficeUILanguage	success or wait	2	30CBC948	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	InstallFonts	object name not found	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	UILanguage	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	00000401	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	0000040D	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	0000041E	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	0000042A	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	00000439	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	00000420	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	00000429	success or wait	1	220065	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ASKFORPRINTERPICTURE	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	CACHESIZE	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	UserTemplates	object name not found	1	3000BBC8	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	AppData	success or wait	1	30CBDDB1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	Templates	success or wait	1	3000BBC8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc	MaxRpcSize	object name not found	1	130000	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\ThemeManager	Compositing	object name not found	1	1	unknown
HKEY_USERS\Control Panel\Desktop	LameButtonText	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Internet Explorer\Settings	Anchor Color	success or wait	1	30CC700B	unknown
HKEY_USERS\Software\Microsoft\Internet Explorer\Settings	Anchor Color Visited	success or wait	1	30CC700B	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoClearTypeNW	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	FontInfoCache	object name not found	1	240	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	UseOfficeUIFont	object name not found	1	240	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	FontInfoCache	object name not found	1	1	unknown
HKEY_USERS\Control Panel\International	iCountry	success or wait	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseNTWordDefPgSzBehavior	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseAlternateTOCDelimiter	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UpdateAllNumpages	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AlternateReplaceAllMethodBehaviour	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	WordPartialProtectDocTableResize	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FieldCalcSecurityLevel	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Control Panel\International	iMeasure	success or wait	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Control Panel\International	iTimePrefix	success or wait	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DOC-EXTENSION	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DOT-EXTENSION	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BAK-EXTENSION	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BitmapMemory	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	MessageBeeps	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	EnableSubDocPutSaved	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FavorWord97ListIndents	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DoNotConfirmConverterSecurity	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	WordRTFOutPathPref	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	CalcDataFieldOnOpen	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	SlowShading	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	HideFileNotSavedDlg	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NumberingGapUL	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AlternateRevisionStepThrough	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BlockDocCloseDuringCmdExec	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	EnsurePrintLongVertCell	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AlternativeLongTablesLayout	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BulletProofOnCorruption	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UpdateHeaderFooter	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	EnsureFlagsOfProtectedDocForVbaSel	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	RestoreXmlEvents	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseLocalBiDiStyle	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AlternateBreakThroughTab	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UpdateWwdVBAUponToggleXML	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	SpecialFieldsProtHandling	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	WriteUrlWithSubitemAsBinary	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ForceGrayscalePrint	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoSmartTagRecognition	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoSmartTagActions	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DefaultFormat	object name not found	1	300271B0	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BackgroundSave	object name not found	1	300271C0	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BackgroundOpen	object name not found	1	300271E2	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BackgroundPrint	object name not found	1	300271F2	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	PlainTextAutoFormat	object name not found	1	30027202	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Outlook\Options\Calendar	Text Direction	success or wait	1	30027211	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Outlook\Options\Calendar	Text Direction	success or wait	1	30027211	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	NoTrack	object name not found	1	30027219	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	Bidi Spelling	object name not found	1	30027229	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AutoSpell	object name not found	1	30027238	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AutoGrammar	object name not found	1	30027253	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoLiveScrolling	object name not found	1	30027281	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoFontMRUList	object name not found	1	30CBDDB1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	InsertFloating	object name not found	1	3002731A	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoRecentDocsHistory	object name not found	1	300273E7	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	DisableScalingUpForHighDPI	object name not found	1	30029111	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	WordName	success or wait	1	12FFB0	unknown
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	30029E78	LoadLibraryW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	EnableBalloonTips	object name not found	1	30029E78	LoadLibraryW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared	CUAS	success or wait	1	30029D25	CreateWindowExW
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	30029D25	CreateWindowExW
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	30029D25	CreateWindowExW
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	30029D25	CreateWindowExW
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	30029D25	CreateWindowExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF	EnableAnchorContext	object name not found	1	30029D25	CreateWindowExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM	Ime File	success or wait	1	30029D25	CreateWindowExW
HKEY_USERS\Software\Microsoft\CTF	Disable Thread Input Manager	object name not found	1	30029D25	CreateWindowExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared	CUAS	success or wait	1	30029D25	CreateWindowExW
HKEY_USERS\Software\Microsoft\Office\11.0\Common	ScreenReaderPresent	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	UseAlternateShowUIMethodForFtpSession	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	MaxCachedStreamSize	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	ShowOtherTablesInDataSrc	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	HypAlternateResolveToRel	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	RepairSmartTags	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	AddressBookNameMax4096	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	ShowDispNameInToolTip	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	AllowConsecutiveSlashesInUrlPathComponent	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	UseCaseInsensitivePathForHyperlink	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	LastUILang	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	LastUILang	object name not found	1	565308EC	unknown
HKEY_USERS\Software\Microsoft\Shared	OfficeUILanguage	success or wait	2	565308EC	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	AcbControl	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	AcbOn	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	CurrentProvider	success or wait	1	7C90F668	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	MaxWords	object name not found	1	7C90F668	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	MaxWordsJapan	object name not found	1	7C90F668	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	UseOnline	object name not found	1	7C90F668	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	PreferOffline	object name not found	1	7C90F668	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	PreferOffline	object name not found	1	90909090	RegOpenKeyExW
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	UseMT	object name not found	1	7C90F668	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	RestrictRun	object name not found	1	30CCCBEE	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	Sound	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	MTTT	object name not found	2	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	MTTT	object name not found	1	4C2FF	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	30CDC2A5	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC2A5	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	ProInfo	success or wait	1	30CDDE95	unknown
HKEY_USERS\Control Panel\International	NumShape	success or wait	1	1	unknown
HKEY_USERS\Control Panel\International	NumShape	success or wait	1	670069	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	DisableFontLinking	object name not found	1	670069	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows	Device	success or wait	1	3002B963	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices	Microsoft XPS Document Writer	success or wait	1	3002B963	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	ScreenReaderPresent	object name not found	1	1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Messaging Subsystem	MAPIX	object name not found	2	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoRereg	object name not found	1	3002D9A9	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32	NULL	success or wait	1	30CBDDB1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document\CurVer	NULL	success or wait	1	30CBDDB1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	GlobalDotName	object name not found	1	3163DD74	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	3163DD74	unknown
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ScriptAnchorVis	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools	FormatConsistencyWavyUnderlineColor	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	GlobalDotName	object name not found	1	30CBDDB1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems		object name not found	1	303CE628	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Cache	success or wait	1	D800D8	unknown
HKEY_USERS\Software\Microsoft\CTF	Disable Thread Input Manager	object name not found	1	7C90F661	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000409\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}	Enable	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000807\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}	Enable	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}	Enable	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	00000409	success or wait	1	16FCC8	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups	1	success or wait	1	16FCC8	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC19F	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	30CDC2A5	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC2A5	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	ProInfo	success or wait	1	30CDDE95	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail	NULL	success or wait	1	30CBDDB1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Outlook Express\Envelope\CLSID	NULL	success or wait	1	30D048F1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC19F	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	30CDC2A5	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC2A5	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	ProInfo	success or wait	1	30CDDE95	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseAlternateForegroundWindowDetectionMethod	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseSpaceAsTextDelimiter	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AlternateTableHeightLayout	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AdjustSdtCaSmart	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	MMDataSrcHeuristic	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DontJumpForegroundInDDEExec	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DisableODSOUIInDataSrc	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseTempCopyForNonLocDoc	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	KeepUISpecModeAtVbaEnd	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseAlternatePageNumberFormat	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DontUpdateSmartDocAtInsert	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ShowFileNameOnlyInIconCaption	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AlternateStyleCopyPasteNoOverwrite	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DontShowDocActionsPaneAtOpen	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FastTableRenderOnIMETS	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	MntrSynchronize1stTabCell	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoLinkBltinCharStyles	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoDocChangeEventOnStoryRange	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	TreatLocationReferenceAsLocal	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ForceSetCopyCount	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ListDefaultDictForAllLanFirst	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	MailMergeFastSetPrintOrient	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	SuppressPrinterIconEnum	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoActivateOleLinkObjAtOpen	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	CheckDupAddin4ShellLoad	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	CleanupOldHyphBeforeHyphenate	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	KeepDocActPaneWhileInReviewPane	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FireSelChangeEventInTableCell	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UpdateHdrFtrOnVBAFldUpdate	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ForceUpdateToolbarAtInit	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	AddIns	success or wait	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\Word\Addins\WebPage.Connect	LoadBehavior	success or wait	1	30CE4063	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	Com+Enabled	success or wait	1	12E854	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	MinimumFreeMemPercentageToCreateProcess	object name not found	1	12E854	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	MinimumFreeMemPercentageToCreateObject	object name not found	1	12E854	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	Com+Enabled	success or wait	1	12E854	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	12E854	unknown
HKEY_USERS\Software\Microsoft\Office\Word\Addins\WebPage.Connect	FileName	object name not found	1	630069	unknown
HKEY_USERS\Software\Microsoft\Office\Word\Addins\WordEEFonts.Connect	LoadBehavior	success or wait	1	30CE4063	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	12E854	unknown
HKEY_USERS\Software\Microsoft\Office\Word\Addins\WordEEFonts.Connect	FileName	object name not found	1	630069	unknown
HKEY_USERS\Software\Microsoft\CTF	Disable Thread Input Manager	object name not found	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}	Enable	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000409\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}	Enable	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000807\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}	Enable	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}	Enable	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	QuickPreview	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Local AppData	success or wait	1	178D08	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	STARTUP-PATH	object name not found	1	12DF58	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	Startup	success or wait	1	440020	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	VolumePref	object name not found	1	3163DD74	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FirstRun	object name not found	1	220065	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	FirstRun	success or wait	1	30F54080	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FirstRun	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\UserInfo	UserName	success or wait	1	30AA1BC4	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\UserInfo	UserInitials	success or wait	1	30AA1BC4	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\UserInfo	Company	success or wait	1	30AA1BC4	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Wizards	Assistant Time Stamp	object name not found	1	12F67C	RtlImageDirectoryEntryToData
HKEY_USERS\Software\Microsoft\Office\Common\Assistant	AsstState	object name not found	1	12F67C	RtlImageDirectoryEntryToData
HKEY_USERS\Software\Microsoft\Office\11.0\Common	ScreenReaderPresent	object name not found	1	12F67C	RtlImageDirectoryEntryToData
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1F4E726-8CF1-11D1-BF92-0060081ED811}\LocalServer32	LocalServer32	object name not found	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1F4E726-8CF1-11D1-BF92-0060081ED811}\LocalServer32	NULL	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	MaximumAllowedAllocationSize	object name not found	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	DefaultAccessPermission	object name not found	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5EB2502A-8CF1-11D1-BF92-0060081ED811}\ProxyStubClsid32	NULL	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32	InprocServer32	object name not found	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32	NULL	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}	AppID	object name not found	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32	InprocServer32	object name not found	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32	NULL	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}	AppID	object name not found	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32	ThreadingModel	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\WPA\PnP	seed	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	OsLoaderPath	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	OsLoaderPath	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemPartition	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemPartition	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	SourcePath	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	SourcePath	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackSourcePath	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackSourcePath	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackCachePath	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackCachePath	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	DriverCachePath	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	DriverCachePath	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	DevicePath	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogLevel	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogLevel	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogPath	object name not found	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Hostname	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Domain	success or wait	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	MaxSize	object name not found	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	Level	object name not found	1	12F398	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	Mode	object name not found	1	12F398	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1F4E726-8CF1-11D1-BF92-0060081ED811}	InsecureQI	object name not found	1	12F398	unknown
HKEY_USERS\Software\Microsoft\Office\Common	QMEnable	success or wait	1	220065	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	300CE56E	unknown
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	3006A390	DispatchMessageA
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	3006A390	DispatchMessageA
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	3006A390	DispatchMessageA
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	3006A390	DispatchMessageA
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC19F	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	30CDC2A5	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	2	30CDC2A5	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	ProInfo	success or wait	1	30CDDE95	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	NoTrack	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoNetHood	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoNetHood	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoPropertiesMyComputer	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoPropertiesMyComputer	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoInternetIcon	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoInternetIcon	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoCommonGroups	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoCommonGroups	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Desktop	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoControlPanel	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoControlPanel	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoSetFolders	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoSetFolders	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32	NULL	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f}	Data	buffer overflow	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f}	Data	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f}	Generation	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Data	buffer overflow	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Data	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	DontShowSuperHidden	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	DontShowSuperHidden	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer	ShellState	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer	ShellState	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	ForceActiveDesktopOn	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	ForceActiveDesktopOn	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoActiveDesktop	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoActiveDesktop	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoWebView	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoWebView	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	ClassicShell	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	ClassicShell	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	SeparateProcess	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	SeparateProcess	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoNetCrawling	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoNetCrawling	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoSimpleStartMenu	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoSimpleStartMenu	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	Hidden	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	ShowCompColor	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	DontPrettyPath	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	ShowInfoTip	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideIcons	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	MapNetDrvBtn	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	WebView	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	Filter	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	ShowSuperHidden	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	SeparateProcess	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	NoNetCrawling	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	DocObject	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	BrowseInPlace	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	IsShortcut	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	AlwaysShowExt	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	NeverShowExt	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	30CFC0DA	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	30CFC0DA	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	AllowFileCLSIDJunctions	object name not found	1	30CFC0DA	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	AllowFileCLSIDJunctions	object name not found	1	30CFC0DA	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	30CFC0DA	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	30CFC0DA	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	9	object name not found	1	3018D7E2	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	300CE56E	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows	Device	success or wait	1	3002B963	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices	Microsoft XPS Document Writer	success or wait	1	3002B963	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows	Device	success or wait	1	6F0070	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices	Microsoft XPS Document Writer	success or wait	1	6F0070	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	PrinterHangTimeOut	object name not found	1	1313000	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoWideTextPrinting	object name not found	2	A00010	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoWideTextPrinting	object name not found	2	7C91005D	RtlFreeHeap
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoWideTextPrinting	object name not found	2	124BBC	RtlImageDirectoryEntryToData
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows	Device	success or wait	1	30073346	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices	Microsoft XPS Document Writer	success or wait	1	30073346	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows	Device	success or wait	1	30073346	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices	Microsoft XPS Document Writer	success or wait	1	30073346	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoWideTextPrinting	object name not found	2	212B30	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Font Mapping	SimSun	object name not found	1	64	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoWideTextPrinting	object name not found	2	2433F0	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Font Mapping	??	object name not found	1	301E4FD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	SimSun	object name not found	1	124B00	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Times New Roman	object name not found	1	6E	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Arial	object name not found	1	6E	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Courier New	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Symbol	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Wingdings	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Mangal	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Latha	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Sylfaen	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Vrinda	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Raavi	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Shruti	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Gautami	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Tunga	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Estrangelo Edessa	object name not found	1	730073	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Kartika	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Tahoma	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Marlett	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Lucida Console	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Lucida Sans Unicode	object name not found	1	630069	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Verdana	object name not found	1	630069	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Arial Black	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Comic Sans MS	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Impact	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Georgia	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Franklin Gothic Medium	object name not found	1	200063	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Palatino Linotype	object name not found	1	700079	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Trebuchet MS	object name not found	1	700079	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Webdings	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	MV Boli	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Microsoft Sans Serif	object name not found	1	530020	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Book Antiqua	object name not found	1	530020	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Bookman Old Style	object name not found	1	6C0079	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Century Gothic	object name not found	1	6C0000	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Garamond	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Monotype Corsiva	object name not found	1	610076	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Wingdings 2	object name not found	1	610076	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Wingdings 3	object name not found	1	300A2DD6	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Bookshelf Symbol 7	object name not found	1	6C006F	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	MS Reference Sans Serif	object name not found	1	6E0061	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	MS Reference Specialty	object name not found	1	650070	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Panose	Arial Narrow	object name not found	1	650070	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools	SpellingWavyUnderlineColor	object name not found	1	3018DB1A	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools	GrammarWavyUnderlineColor	object name not found	1	3018DB1A	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	NoTrack	object name not found	1	3018DB1A	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	MaxPropsStreamSize	object name not found	1	3018DB1A	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Recent	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	ChkAccDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions	ProductType	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Personal	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Local Settings	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	RsopDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	RsopLogging	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	UserEnvDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	RsopLogging	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	UserEnvDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	ProfileImagePath	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dot	Progid	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dot	Application	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dot	NULL	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dot	PerceivedType	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8	DocObject	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot	DocObject	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8	BrowseInPlace	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot	BrowseInPlace	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8\CLSID	NULL	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8	IsShortcut	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot	IsShortcut	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8	AlwaysShowExt	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot	AlwaysShowExt	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8	NeverShowExt	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot	NeverShowExt	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_USERS\Software\Microsoft\Office\11.0\Common\ReviewCycle	ReviewToken	success or wait	1	6F0068	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	DoNotDismissFileNewTaskPane	object name not found	1	30D2DF29	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet	PixelsPerInch	object name not found	1	5012C	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet	PixelsPerInch	object name not found	1	5012C	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	300CE56E	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	300CE56E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common	VbaOff	object name not found	1	6	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	VbaOff	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer	DisableUserInstalls	object name not found	1	1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer	Debug	object name not found	1	1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\InstallProperties	WindowsInstaller	success or wait	1	1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9}	DigitalProductID	buffer overflow	1	30CBD6F1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9}	DigitalProductID	success or wait	1	30CBD6F1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\InstallProperties	WindowsInstaller	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	WORDFiles	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	WORDFiles	buffer overflow	8	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	WORDFiles	success or wait	4	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C	9040110900063D11C8EF10054038389C	success or wait	4	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A453DD12EE71CEF49A4EB2A8684FB83A	9040110900063D11C8EF10054038389C	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5861C19D5F3D8C8439408F306F31034A	9040110900063D11C8EF10054038389C	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\311714883E93F274A838DDB012991F9D	9040110900063D11C8EF10054038389C	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72E940125B15C02498F17C8F91EADC14	9040110900063D11C8EF10054038389C	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16EFE5D0815A2D11A92E0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41AE703BF87339947BDCC4715F97EFED	9040110900063D11C8EF10054038389C	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProductFiles	buffer overflow	14	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProductFiles	success or wait	7	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687	9040110900063D11C8EF10054038389C	success or wait	7	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10	9040110900063D11C8EF10054038389C	buffer overflow	7	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10	9040110900063D11C8EF10054038389C	success or wait	7	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662	9040110900063D11C8EF10054038389C	success or wait	4	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357	9040110900063D11C8EF10054038389C	success or wait	4	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA	9040110900063D11C8EF10054038389C	buffer overflow	7	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA	9040110900063D11C8EF10054038389C	success or wait	7	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382	9040110900063D11C8EF10054038389C	success or wait	4	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C	9040110900063D11C8EF10054038389C	success or wait	4	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2	9040110900063D11C8EF10054038389C	success or wait	4	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213	9040110900063D11C8EF10054038389C	success or wait	4	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	WORDFiles	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687	9040110900063D11C8EF10054038389C	success or wait	1	30CBCEFC	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	ProductFiles	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	VBAFiles	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	VBAFiles	buffer overflow	4	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	VBAFiles	success or wait	2	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0020F700D33C1D112897000CF42C6133	9040110900063D11C8EF10054038389C	buffer overflow	2	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0020F700D33C1D112897000CF42C6133	9040110900063D11C8EF10054038389C	success or wait	2	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\359E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	2	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C1B74D56F7A1D11A9CC0006794C4E25	9040110900063D11C8EF10054038389C	buffer overflow	2	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C1B74D56F7A1D11A9CC0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	2	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4EEF86DD963C1D111A37000A9CA05BF0	9040110900063D11C8EF10054038389C	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2EEF86DD963C1D111A37000A9CA05BF0	9040110900063D11C8EF10054038389C	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A457B2D1A9DC1D112897000CF42C6133	9040110900063D11C8EF10054038389C	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1178400169C22D11A9790006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	SHAREDFiles	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	SHAREDFiles	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	SHAREDFiles	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA	Vbe6DllPath	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\029E403DA86A1D115B5B0006799C897E	vbe.dll_6.0	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	VBAFiles	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4EEF86DD963C1D111A37000A9CA05BF0	9040110900063D11C8EF10054038389C	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2EEF86DD963C1D111A37000A9CA05BF0	9040110900063D11C8EF10054038389C	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A457B2D1A9DC1D112897000CF42C6133	9040110900063D11C8EF10054038389C	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1178400169C22D11A9790006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	SHAREDFiles	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	SHAREDFiles	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	SHAREDFiles	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\359E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	VBAFiles	object name not found	1	7C9141DF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	4	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32	LocalServer32	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt	{90110409-6000-11D3-8CFE-0150048383C9}	object name not found	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	WORDFiles	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A453DD12EE71CEF49A4EB2A8684FB83A	9040110900063D11C8EF10054038389C	success or wait	3	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5861C19D5F3D8C8439408F306F31034A	9040110900063D11C8EF10054038389C	success or wait	3	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\311714883E93F274A838DDB012991F9D	9040110900063D11C8EF10054038389C	success or wait	3	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72E940125B15C02498F17C8F91EADC14	9040110900063D11C8EF10054038389C	success or wait	3	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16EFE5D0815A2D11A92E0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	3	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41AE703BF87339947BDCC4715F97EFED	9040110900063D11C8EF10054038389C	success or wait	3	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	2	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	2	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	2	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662	9040110900063D11C8EF10054038389C	success or wait	3	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357	9040110900063D11C8EF10054038389C	success or wait	3	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382	9040110900063D11C8EF10054038389C	success or wait	3	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	2	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C	9040110900063D11C8EF10054038389C	success or wait	3	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2	9040110900063D11C8EF10054038389C	success or wait	2	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213	9040110900063D11C8EF10054038389C	success or wait	3	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C	9040110900063D11C8EF10054038389C	success or wait	2	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	WORDFiles	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\InprocHandler32	NULL	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32	LocalServer32	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt	{90110409-6000-11D3-8CFE-0150048383C9}	object name not found	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	WORDFiles	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2	9040110900063D11C8EF10054038389C	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C	9040110900063D11C8EF10054038389C	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	WORDFiles	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\InprocHandler32	NULL	success or wait	1	301CBAA7	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	3	301CBACF	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\LocalServer32	LocalServer32	object name not found	1	301CBACF	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\LocalServer32	NULL	success or wait	1	301CBACF	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\LocalServer32	LocalServer32	object name not found	1	301CBAE3	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\LocalServer32	NULL	success or wait	1	301CBAE3	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020907-0000-0000-C000-000000000046}\LocalServer32	LocalServer32	success or wait	1	301CBB03	CoRegisterClassObject
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt	{90110409-6000-11D3-8CFE-0150048383C9}	object name not found	1	301CBB03	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	WORDFiles	success or wait	1	301CBB03	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	1	301CBB03	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	WORDFiles	success or wait	1	301CBB03	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020907-0000-0000-C000-000000000046}\InprocHandler32	NULL	success or wait	1	301CBB03	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.3\0\win32	NULL	success or wait	1	30CCC6B3	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	301CBC37	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	4	301CBC37	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	301CBC37	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	301CBC37	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	3	301CBC37	CoRegisterClassObject
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020905-0000-0000-C000-000000000046}\8.3\0\win32	NULL	success or wait	1	301EA8CD	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA	Vbe6DllPath	success or wait	1	3029455F	RegQueryValueExA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA	Vbe6DllPath	success or wait	1	3029455F	RegDeleteValueW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbe6.dll	CheckAppHelp	success or wait	1	30294584	LoadLibraryExA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage	932	success or wait	1	824448B	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage	949	success or wait	1	824448B	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage	950	success or wait	1	824448B	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage	936	success or wait	1	824448B	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	DoNotDismissFileNewTaskPane	object name not found	1	30D2DF29	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet	PixelsPerInch	object name not found	1	400F2	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet	PixelsPerInch	object name not found	1	400F2	unknown
HKEY_USERS\Software\Microsoft\VBA\6.0\Common	RequireDeclaration	object name not found	1	10	unknown
HKEY_USERS\Software\Microsoft\VBA\6.0\Common	CompileOnDemand	object name not found	1	10	unknown
HKEY_USERS\Software\Microsoft\VBA\6.0\Common	NotifyUserBeforeStateLoss	object name not found	1	10	unknown
HKEY_USERS\Software\Microsoft\VBA\6.0\Common	BackGroundCompile	object name not found	1	10	unknown
HKEY_USERS\Software\Microsoft\VBA\6.0\Common	BreakOnAllErrors	object name not found	1	10	unknown
HKEY_USERS\Software\Microsoft\VBA\6.0\Common	BreakOnServerErrors	object name not found	1	10	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020905-0000-0000-C000-000000000046}\8.3\0\win32	NULL	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.0\9\win32	NULL	success or wait	1	460020	strchr
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32	NULL	success or wait	1	1FF640	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32	NULL	success or wait	1	65086E12	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020905-0000-0000-C000-000000000046}\8.3\0\win32	NULL	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.3\0\win32	NULL	success or wait	1	302952D2	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.0\9\win32	NULL	success or wait	2	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020905-0000-0000-C000-000000000046}\8.3\0\win32	NULL	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32	NULL	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.3\0\win32	NULL	success or wait	1	302952D2	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib		success or wait	1	65118028	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib		success or wait	1	65118028	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version		success or wait	1	6511809A	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version		success or wait	1	6511809A	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32	NULL	success or wait	1	651180DD	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	SafeProcessSearchMode	object name not found	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0	NULL	object name not found	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\FLAGS	NULL	object name not found	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\0\win32	NULL	object name not found	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\HELPDIR	NULL	object name not found	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\FLAGS	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib	Version	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib	Version	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\ProxyStubClsid	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\ProxyStubClsid32	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib	NULL	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib	Version	success or wait	1	6511810E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32	NULL	success or wait	1	11CFAE6D	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020905-0000-0000-C000-000000000046}\8.3\0\win32	NULL	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32	NULL	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.3\0\win32	NULL	success or wait	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}	Compatibility Flags	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	2	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	InprocServer32	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	NULL	success or wait	2	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}	AppID	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	InprocServer32	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	NULL	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}	AppID	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	ThreadingModel	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave1	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave1	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave2	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave3	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave4	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave5	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave6	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave7	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave8	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave9	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi1	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi1	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi2	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi3	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi4	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi5	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi6	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi7	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi8	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi9	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux1	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux1	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux2	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux3	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux4	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux5	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux6	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux7	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux8	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux9	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaProperties\PrivateProperties\Joystick\Winmm	wheel	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer1	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer1	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer2	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer3	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer4	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer5	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer6	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer7	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer8	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer9	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	DisableImprovedZoneCheck	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN	WINWORD.EXE	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN	*	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectX	GlitchInstrumentation	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D	GeometryDriver	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	InprocServer32	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}	AppID	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	~MHz	success or wait	1	32801B0	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	AppData	success or wait	1	32AEE25	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE		success or wait	1	32BC080	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup	IExploreLastModifiedLow	success or wait	1	32BC080	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup	IExploreLastModifiedHigh	success or wait	1	32BC080	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAB22AC1-30C1-11CF-A7EB-0000C05BAE0B}\TypeLib	NULL	success or wait	1	32BC080	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup	InstallStarted	object name not found	1	32BC080	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B722BCCB-4E68-101B-A2BC-00AA00404770}\ProxyStubClsid32	NULL	success or wait	1	32BC080	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79EAC9C4-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32	NULL	success or wait	1	32BC080	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{000214E6-0000-0000-C000-000000000046}\ProxyStubClsid32	NULL	success or wait	1	32BC080	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{93F2F68C-1D1B-11D3-A30E-00C04F79ABD1}\ProxyStubClsid32	NULL	success or wait	1	32BC080	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000}	Compatibility Flags	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0002E005-0000-0000-C000-000000000046}	InsecureQI	object name not found	1	6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus\1	NULL	success or wait	1	6	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders	SecurityProviders	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders	SecurityProviders	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	2	71E560A3	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Name	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Name	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Comment	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Comment	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Capabilities	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	RpcId	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Version	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Type	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	TokenSize	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Name	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Name	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Comment	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Comment	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Capabilities	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	RpcId	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Version	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Type	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	TokenSize	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Name	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Name	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Comment	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Comment	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Capabilities	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	RpcId	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Version	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Type	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	TokenSize	success or wait	1	3287218	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32	NULL	success or wait	1	124E28	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	FFFFFF90	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	FFFFFF90	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	FFFFFF90	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	FFFFFF90	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	ForceNpxEmulation	object name not found	1	40000	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	3021A582	ProgIDFromCLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	3021A582	ProgIDFromCLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	InprocServer32	object name not found	1	3021A582	ProgIDFromCLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32	NULL	success or wait	1	3021A582	ProgIDFromCLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}	AppID	object name not found	1	3021A582	ProgIDFromCLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID	NULL	success or wait	1	3021A582	ProgIDFromCLSID
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32	NULL	success or wait	1	651DC57C	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	300CE56E	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Outlook\Security	OutlookSecureTempFolder	object name not found	1	3018E3D7	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag	DisableDocumentAssemblies	object name not found	1	740061	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	1CD7BAB	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	30CDC2A5	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC2A5	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	ProInfo	success or wait	1	30CDDE95	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	NoTTP	object name not found	1	740061	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet	UseOnlineContent	success or wait	1	740061	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	TOOLS-PATH	object name not found	1	3000BBC8	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	Proof	success or wait	1	30CC84C3	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools Location	proof	object name not found	1	30CBDDB1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	CommonFilesDir	success or wait	1	30CBDDB1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	1	12BE70	unknown
HKEY_USERS\Software\Microsoft\CTF	Disable Thread Input Manager	object name not found	1	3B31940	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared	CUAS	success or wait	1	3B31940	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	12E954	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	30CDC2A5	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	ProInfo	success or wait	1	30CDDE95	unknown
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter	Installed	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	AuthenticodeEnabled	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	Levels	object name not found	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}	ItemData	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}	SaferFlags	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}	ItemData	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}	HashAlg	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}	ItemSize	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}	SaferFlags	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}	ItemData	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}	HashAlg	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}	ItemSize	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}	SaferFlags	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}	ItemData	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}	HashAlg	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}	ItemSize	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}	SaferFlags	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}	ItemData	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}	HashAlg	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}	ItemSize	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}	SaferFlags	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}	ItemData	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}	HashAlg	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}	ItemSize	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}	SaferFlags	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	DefaultLevel	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	PolicyScope	success or wait	1	C0D0276	WinExec
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	Cache	buffer overflow	1	C0D0276	WinExec
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	Cache	success or wait	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	LogFileName	object name not found	1	C0D0276	WinExec
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter	Installed	success or wait	1	C0D035D	WinExec
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	LogFileName	object name not found	1	C0D035D	WinExec

Mutex Activites

Name	Completion	Count	Source Address	Symbol
\BaseNamedObjects\Local\Mutex_MSOSharedMem	success or wait	1	3163BFAC	unknown
\BaseNamedObjects\Local\Mso97SharedDg19211108172Mutex	success or wait	1	12F2F4	unknown
\BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	30029D25	CreateWindowExW
\BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	30029D25	CreateWindowExW
\BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	30029D25	CreateWindowExW
\BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	30029D25	CreateWindowExW
\BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	30029D25	CreateWindowExW
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500MUTEX.DefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	30029D25	CreateWindowExW
\BaseNamedObjects\Local\Mso97SharedDg20321108172Mutex	success or wait	1	30CC1FFC	unknown
\BaseNamedObjects\OfficeAssistantStateMutex	success or wait	1	12F67C	RtlImageDirectoryEntryToData
unknown	success or wait	7	12F398	unknown
\BaseNamedObjects\StiTraceMutexSti_Trace.log	access denied	1	12F398	unknown
\BaseNamedObjects\MSCTF.Shared.MUTEX.MNH	object name exists	1	3006A390	DispatchMessageA
\BaseNamedObjects\Local\Mso97SharedDg19521108172Mutex	success or wait	1	12EFE0	unknown
\BaseNamedObjects\Local\Mso97SharedDg19531108172Mutex	success or wait	1	308B9	unknown
\BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-507921405-1960408961-839522115-500	success or wait	1	650074	unknown
\BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-507921405-1960408961-839522115-500	success or wait	1	4D005C	unknown
\BaseNamedObjects\DirectSound DllMain mutex (0x00000488)	success or wait	1	6	unknown
\BaseNamedObjects\DDrawWindowListMutex	success or wait	1	6	unknown
\BaseNamedObjects\__DDrawExclMode__	success or wait	1	6	unknown
\BaseNamedObjects\__DDrawCheckExclMode__	success or wait	1	6	unknown
\BaseNamedObjects\{1B655094-FE2A-433c-A877-FF9793445069}	success or wait	1	1019B760	unknown

Process Activites

Process Created

PID	Filepath	Cmdline	Flags	Completion	Count	Source Address	Symbol
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	none	success or wait	1	C0D0276	WinExec
1096	C:\WINDOWS\system32\cmd.exe	cmd.exe /c iPhone 5.doc	none	success or wait	1	C0D035D	WinExec

Process Queried

PID	Process info class	Completion	Count	Source Address	Symbol
1160	Cookie	success or wait	3884	7C90E457	KiUserApcDispatcher
1160	ImageInformation	success or wait	1	7C90E457	KiUserApcDispatcher
1160	DefaultHardErrorMode	success or wait	1060	8C2C95B	NlsAnsiCodePage
1160	Times	success or wait	5	30CBAD74	unknown
1160	QuotaLimits	success or wait	9	30007F87	GlobalMemoryStatusEx
1160	VmCounters	success or wait	9	30007F87	GlobalMemoryStatusEx
1160	DeviceMap	success or wait	30	3000C508	GetDriveTypeW
1160	Wow64Information	success or wait	381	30029D25	CreateWindowExW
1160	SessionInformation	success or wait	4	3163DD74	unknown
1112	BasicInformation	success or wait	2	C0D0276	WinExec
1112	BasicInformation	success or wait	1	C0D0276	WinExec
1096	BasicInformation	success or wait	2	C0D035D	WinExec
1096	BasicInformation	success or wait	1	C0D035D	WinExec

Thread Activites

TID	PID	EIP	EAX (Usermode EIP)	Filepath	Completion	Count	Source Address	Symbol
1824	1160	7C8106F9	77E76C7D	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	12F398	unknown
1876	1160	7C8106F9	774FE4DF	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	12F398	unknown
1788	1160	7C8106F9	77E76C7D	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	7C80B729	unknown
1980	1160	7C8106F9	30D5382C	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	1313000	unknown
1904	1160	7C8106F9	77DF848A	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	6	unknown
292	1160	7C8106F9	101DFB97	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	124E52	unknown
1624	1160	7C8106F9	3B3191B	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	30CCC134	unknown
496	1160	7C8106F9	101DFB97	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	10120C54	unknown
1116	1112	7C810705	4032AC	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	success or wait	1	C0D0276	WinExec
424	1096	7C810705	4AD05046	C:\WINDOWS\system32\cmd.exe	success or wait	1	C0D035D	WinExec

TID	PID	Path	Completion	Count	Source Address	Symbol
1824	1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	12F398	unknown
1876	1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	12F398	unknown
1788	1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	7C80B729	unknown
1980	1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	1313000	unknown
1904	1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	6	unknown
292	1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	124E52	unknown
1624	1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	30CCC134	unknown
496	1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	10120C54	unknown
1116	1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	success or wait	1	C0D0276	WinExec
424	1096	C:\WINDOWS\system32\cmd.exe	success or wait	1	C0D035D	WinExec

TID	Delay	Completion	Count	Source Address	Symbol
1876	-60s	user apc	1	7C80B729	unknown

TID	PID	Completion	Count	Source Address	Symbol
1980	1160	unknown	1	7C80B72F	unknown

Memory Activites

PID	Filepath	Base	Length	Value	Completion	Count	Source Address	Symbol
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	7FFDB008	4	00 00 40 00	success or wait	1	C0D0276	WinExec
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	400000	4096	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 11 F8 01 BB 55 99 6F E8 55 99 6F E8 55 99 6F E8 2E 85 63 E8 54 99 6F E8 3A 86 65 E8 5E 99 6F E8 D6 85 61 E8 54 99 6F E8 3A 86 6B E8 57 99 6F E8 AF BA 76 E8 51 99 6F E8 46 91 32 E8 57 99 6F E8 D6 91 32 E8 50 99 6F E8 55 99 6E E8 04 99 6F E8 92 9F 69 E8 54 99 6F E8 BD 86 64 E8 57 99 6F E8 52 69 63 68 55 99 6F E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4C 01 04	success or wait	1	C0D0276	WinExec
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	406000	256	00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 58 00 00 80 18 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 65 00 00 00 30 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 04 08 00 00 48 00 00 00 60 60 00 00 00 F0 00 00 00 00 00 00 00 00 00 00 03 00 44 00 4C 00 4C 00 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 D1 D9 B8 42 95 B8 D6 11 95 B8 D6 11 95 B8 D6 11 6F 9B CF 11 97 B8 D6 11 B2 7E AD 11 97 B8 D6	success or wait	1	C0D0276	WinExec
1096	C:\WINDOWS\system32\cmd.exe	7FFD9008	4	00 00 D0 4A	success or wait	1	C0D035D	WinExec
1096	C:\WINDOWS\system32\cmd.exe	4AD00000	4096	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 1D ED D5 EA 59 8C BB B9 59 8C BB B9 59 8C BB B9 9A 83 B4 B9 5F 8C BB B9 59 8C BA B9 80 8C BB B9 9A 83 E6 B9 5E 8C BB B9 E6 83 DB B9 5B 8C BB B9 9A 83 E5 B9 58 8C BB B9 9A 83 E4 B9 6D 8C BB B9 9A 83 E1 B9 58 8C BB B9 52 69 63 68 59 8C BB B9 00 00 00 00 00 00 00 00 50 45 00 00 4C 01 03 00 AF 5B 02 48 00 00 00 00 00 00 00 00 E0 00 0F 01 0B 01 07 0A 00 F8 01 00 00 F6 03 00 00 00 00	success or wait	1	C0D035D	WinExec
1096	C:\WINDOWS\system32\cmd.exe	4AD3E000	256	00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 03 00 00 00 30 00 00 80 0B 00 00 00 80 00 00 80 0E 00 00 00 98 00 00 80 10 00 00 00 B0 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 01 00 00 00 C8 00 00 80 02 00 00 00 E0 00 00 80 03 00 00 00 F8 00 00 80 04 00 00 00 10 01 00 80 05 00 00 00 28 01 00 80 06 00 00 00 40 01 00 80 07 00 00 00 58 01 00 80 08 00 00 00 70 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 88 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 80 02 00 80 A0 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 B8 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 00 00 D0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 00 00 E0 01 00 00 00 00 00 00 00 00 00	success or wait	1	C0D035D	WinExec
1096	C:\WINDOWS\system32\cmd.exe	7FFD9010	4	00 00 02 00	success or wait	1	C0D035D	WinExec

PID	Filepath	Base	Length	Value	Completion	Count	Source Address	Symbol
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	10000	2116	3D 00 3A 00 3A 00 3D 00 3A 00 3A 00 5C 00 00 00 3D 00 5A 00 3A 00 3D 00 5A 00 3A 00 5C 00 00 00 41 00 4C 00 4C 00 55 00 53 00 45 00 52 00 53 00 50 00 52 00 4F 00 46 00 49 00 4C 00 45 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 6C 00 6C 00 20 00 55 00 73 00 65 00 72 00 73 00 00 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 41 00 70 00 70 00 6C 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20	success or wait	1	C0D0276	WinExec
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	20000	1828	00 10 00 00 24 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 00 08 02 90 02 00 00 00 00 00 00 68 01 6A 01 98 04 00 00 50 00 52 00 04 06 00 00 50 00 52 00 58 06 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 50 00 52 00 AC 06 00 00 1E 00 20 00 00 07 00 00 00 00 02 00 20 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	C0D0276	WinExec
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	7FFDB010	4	00 00 02 00	success or wait	1	C0D0276	WinExec
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	7FFDB1E8	4	00 00 00 00	success or wait	1	C0D0276	WinExec
1096	C:\WINDOWS\system32\cmd.exe	10000	2116	3D 00 3A 00 3A 00 3D 00 3A 00 3A 00 5C 00 00 00 3D 00 5A 00 3A 00 3D 00 5A 00 3A 00 5C 00 00 00 41 00 4C 00 4C 00 55 00 53 00 45 00 52 00 53 00 50 00 52 00 4F 00 46 00 49 00 4C 00 45 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 6C 00 6C 00 20 00 55 00 73 00 65 00 72 00 73 00 00 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 41 00 70 00 70 00 6C 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20	success or wait	1	C0D035D	WinExec
1096	C:\WINDOWS\system32\cmd.exe	20000	1720	00 10 00 00 B8 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 00 08 02 90 02 00 00 00 00 00 00 54 01 56 01 98 04 00 00 36 00 38 00 F0 05 00 00 32 00 34 00 28 06 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 36 00 38 00 5C 06 00 00 1E 00 20 00 94 06 00 00 00 00 02 00 B4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	C0D035D	WinExec
1096	C:\WINDOWS\system32\cmd.exe	7FFD9010	4	00 00 02 00	success or wait	1	C0D035D	WinExec
1096	C:\WINDOWS\system32\cmd.exe	30000	388	53 00 68 00 69 00 6D 00 45 00 6E 00 67 00 2E 00 64 00 6C 00 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 01 00 00 AB ED 0D AC AA 3F 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	C0D035D	WinExec
1096	C:\WINDOWS\system32\cmd.exe	7FFD91E8	4	00 00 03 00	success or wait	1	C0D035D	WinExec

PID	Filepath	Base	Length	Protection	Completion	Count	Source Address	Symbol
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	140000	12FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	140000	12FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	141000	12F7F4	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	240000	12FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	240000	12FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	250000	12F340	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	143000	12F21C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	251000	12F168	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	144000	12F894	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	840000	12F91C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	840000	12F920	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	841000	12F5FC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	843000	12F6B8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	166000	12F5BC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	167000	12ED44	page read and write	success or wait	1	30003071	LoadLibraryW
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	880000	12F8B8	page no access	success or wait	1	1475FFEC	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	880000	12F8B8	page read and write	success or wait	1	1475FFEC	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	890000	12F8CC	page no access	success or wait	1	30CB0865	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	890000	12F8CC	page read and write	success or wait	1	30CB088C	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	891000	12F85C	page read and write	success or wait	1	3FFF1000	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8A0000	12F888	page no access	success or wait	1	30CBBA65	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8A0000	12F888	page read and write	success or wait	1	30CBBA7A	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8B0000	12F810	page no access	success or wait	1	30CB0865	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8B0000	12F810	page read and write	success or wait	1	30CB088C	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	168000	12F074	page read and write	success or wait	1	220065	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	980000	12F45C	page read and write	success or wait	1	30007B07	AddAtomA
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	980000	12F458	page read and write	success or wait	1	30007B07	AddAtomA
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9A0000	12F164	page no access	success or wait	1	30CB0865	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9A0000	12F164	page read and write	success or wait	1	30CB088C	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8B1000	12F114	page read and write	success or wait	1	3FFE1000	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8B2000	12F0DC	page read and write	success or wait	1	3FFE2000	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8B3000	12F084	page read and write	success or wait	1	3FFE3000	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8B4000	12F0C4	page read and write	success or wait	1	3FFE4000	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9B0000	12F110	page no access	success or wait	1	30CBBA65	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9B0000	12F110	page read and write	success or wait	1	30CBBA7A	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9C0000	12F114	page no access	success or wait	1	30CB0865	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9C0000	12F114	page read and write	success or wait	1	30CB088C	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9D0000	12F258	page no access	success or wait	1	30CBBA65	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9D0000	12F258	page read and write	success or wait	1	30CBBA7A	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9C1000	12F0F8	page read and write	success or wait	1	3FFC1000	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9F0000	12F258	page no access	success or wait	1	30CBBA65	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9F0000	12F258	page read and write	success or wait	1	30CBBA7A	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9C2000	12F208	page read and write	success or wait	1	3FFC2000	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9C3000	12EC38	page read and write	success or wait	1	3FFC3000	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8B5000	12EC98	page read and write	success or wait	1	3FFE5000	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	A00000	12B1A0	page no access	success or wait	1	30CB0865	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	A00000	12B1A0	page read and write	success or wait	1	30CB088C	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8B6000	127988	page read and write	success or wait	1	3FFE6000	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	881000	12C8D8	page read and write	success or wait	1	1475FFEC	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	A00000	12C870	page no access	success or wait	1	30CB0865	unknown
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	10000	12DFE4	page read and write	success or wait	1	C0D0276	WinExec
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	20000	12DFE4	page read and write	success or wait	1	C0D0276	WinExec
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	30000	12E250	page read and write	success or wait	1	C0D0276	WinExec
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	12E000	12E24C	page read and write	success or wait	1	C0D0276	WinExec
1096	C:\WINDOWS\system32\cmd.exe	10000	12DFE4	page read and write	success or wait	1	C0D035D	WinExec
1096	C:\WINDOWS\system32\cmd.exe	20000	12DFE4	page read and write	success or wait	1	C0D035D	WinExec
1096	C:\WINDOWS\system32\cmd.exe	30000	12DFE4	page read and write	success or wait	1	C0D035D	WinExec
1096	C:\WINDOWS\system32\cmd.exe	40000	12E250	page read and write	success or wait	1	C0D035D	WinExec
1096	C:\WINDOWS\system32\cmd.exe	40000	12E24C	page read and write	success or wait	1	C0D035D	WinExec

Memory Protection Changed

PID	Filepath	Base	Length	New Protection	Old Protection	Completion	Count	Source Address	Symbol
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7C801000	1000	page read and write	page execute read	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7C801000	1000	page execute read	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77DD1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77DD1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77E71000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77E71000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77FE1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77FE1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30001000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30001000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77F11000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77F11000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7E411000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7E411000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	774E1000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	774E1000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77C11000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77C11000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77C01000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77C01000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	76391000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	76391000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30B81000	1000	page readonly	page read and write	success or wait	1	30001C81	VirtualProtect
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30C91000	1000	page read and write	page execute read	success or wait	7	30003071	LoadLibraryW
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30C91000	1000	page execute read	page read and write	success or wait	7	30003071	LoadLibraryW
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	3165E000	1000	page readonly	page read and write	success or wait	1	30003071	LoadLibraryW
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	5AD71000	1000	page read and write	page execute read	success or wait	5	1	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	5AD71000	1000	page execute read	page read and write	success or wait	5	1	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	773D1000	1000	page read and write	page execute read	success or wait	7	30029E78	LoadLibraryW
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	773D1000	1000	page execute read	page read and write	success or wait	7	30029E78	LoadLibraryW
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77F61000	1000	page read and write	page execute read	success or wait	5	30029E78	LoadLibraryW
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77F61000	1000	page execute read	page read and write	success or wait	5	30029E78	LoadLibraryW
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	74721000	1000	page read and write	page execute read	success or wait	5	30029D25	CreateWindowExW
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	74721000	1000	page execute read	page read and write	success or wait	5	30029D25	CreateWindowExW
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	755C1000	1000	page read and write	page execute read	success or wait	6	30029D25	CreateWindowExW
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	755C1000	1000	page execute read	page read and write	success or wait	6	30029D25	CreateWindowExW
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7C9C1000	2000	page read and write	page execute read	success or wait	8	3163DD74	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7C9C1000	2000	page execute read	page read and write	success or wait	8	3163DD74	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	5D091000	1000	page read and write	page execute read	success or wait	5	3163DD74	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	5D091000	1000	page execute read	page read and write	success or wait	5	3163DD74	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	397EE000	1000	page read and write	page readonly	success or wait	4	30CFCD75	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	397EE000	1000	page readonly	page read and write	success or wait	4	30CFCD75	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77121000	1000	page read and write	page execute read	success or wait	6	30CFCD75	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77121000	1000	page execute read	page read and write	success or wait	6	30CFCD75	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	76FD1000	1000	page read and write	page execute read	success or wait	6	12E854	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	76FD1000	1000	page execute read	page read and write	success or wait	6	12E854	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77051000	1000	page read and write	page execute read	success or wait	1	12E854	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77051000	1000	page execute read	page read and write	success or wait	1	12E854	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	16FE000	1000	page read and write and page guard	page read and write	success or wait	1	12F398	unknown
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	17FE000	1000	page read and write and page guard	page read and write	success or wait	1	12F398	unknown
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	12E000	1000	page read and write and page guard	page read and write	success or wait	1	C0D0276	WinExec

Memory Usage Statistics

Time	Private Usage (mb)	Workingset (mb)	Page File Usage (mb)
15:20:05	2	7	2
15:20:06	3	9	3
15:20:07	3	9	3
15:20:08	5	13	5
15:20:09	19	27	19
15:20:10	21	29	21
15:20:11	138	79	138
15:20:13	147	68	147
15:20:14	208	84	208
15:20:15	217	71	217
15:20:16	295	79	295
15:20:17	407	85	407
15:20:18	443	86	443
15:20:19	498	77	498
15:20:20	537	76	537

System Activites

System info class	Completion	Count	Source Address	Symbol
BasicInformation	success or wait	205	7C90E457	KiUserApcDispatcher
RangeStartInformation	success or wait	1	7C90E457	KiUserApcDispatcher
ProcessorInformation	success or wait	90	7C90E457	KiUserApcDispatcher
PerformanceInformation	success or wait	9	30007F87	GlobalMemoryStatusEx
WatchdogTimerHandler	success or wait	2	C0D0276	WinExec

Timing Activites

Time	Completion	Count	Source Address	Symbol
129876420050625000	success or wait	1	130000	unknown

Windows UI Activites

Window Created

Window name	Class name	HWND	Completion	Count	Source Address	Symbol
OpusApp	OpusApp	5012E	success	1	30029D25	CreateWindowExW
IPTR	IPTR	30154	success	1	1	unknown
IPTR	IPTR	40136	success	1	1	unknown
IPTR	IPTR	4014A	success	1	3002D684	CoInitialize
_WwC	_WwC	40134	success	1	30054A32	CreateWindowExA
IPTR	IPTR	40138	success	1	3163DD74	unknown
IPTR	IPTR	3011C	success	1	3163DD74	unknown
IPTR	IPTR	800F4	success	1	3163DD74	unknown
IPTR	IPTR	5010A	success	1	3163DD74	unknown
IPTR	IPTR	50108	success	1	340046	unknown
IPTR	IPTR	400E0	success	1	30CE9DFD	unknown
IPTR	IPTR	400E8	success	1	30CE9DFD	unknown
_WwF	_WwF	90058	success	1	30054A32	CreateWindowExA
MSCTFIME UI	MSCTFIME UI	400FA	success	1	3002A1BB	DefWindowProcW
CicMarshalWndClass	CicMarshalWndClass	A0118	success	1	3163DD74	unknown
_WwB	_WwB	80040	success	1	30029D25	CreateWindowExW
_WwB	_WwB	5012C	success	1	30029D25	CreateWindowExW
_WwG	_WwG	50106	success	1	30029D25	CreateWindowExW
6.0.2600.6028!ScrollBar	SCROLLBAR	400EC	success	1	30054A32	CreateWindowExA
_WwC	_WwC	40120	success	1	30054A32	CreateWindowExA
IPTR	IPTR	40128	success	1	5012C	unknown
6.0.2600.6028!ScrollBar	SCROLLBAR	400E4	success	1	30054A32	CreateWindowExA
IPTR	IPTR	400DE	success	1	5012C	unknown
_WwC	_WwC	400DA	success	1	30054A32	CreateWindowExA
_WwC	_WwC	500DC	success	1	30054A32	CreateWindowExA
_WwC	_WwC	400D6	success	1	30054A32	CreateWindowExA
IPTR	IPTR	4011A	success	1	30D2379E	unknown
CLIPBRDWNDCLASS	CLIPBRDWNDCLASS	7010C	success	1	30D4090D	unknown
ThunderMain	ThunderMain	400EE	success	1	824448B	unknown
OpusApp	OpusApp	9014E	success	1	30029D25	CreateWindowExW
_WwC	_WwC	400D8	success	1	30054A32	CreateWindowExA
_WwF	_WwF	7013C	success	1	30054A32	CreateWindowExA
_WwB	_WwB	400F2	success	1	30029D25	CreateWindowExW
_WwG	_WwG	50124	success	1	30029D25	CreateWindowExW
6.0.2600.6028!ScrollBar	SCROLLBAR	900FE	success	1	30054A32	CreateWindowExA
_WwC	_WwC	400EA	success	1	30054A32	CreateWindowExA
IPTR	IPTR	500F8	success	1	400F2	unknown
6.0.2600.6028!ScrollBar	SCROLLBAR	90152	success	1	30054A32	CreateWindowExA
IPTR	IPTR	9013E	success	1	400F2	unknown
_WwC	_WwC	700FC	success	1	30054A32	CreateWindowExA
_WwC	_WwC	60112	success	1	30054A32	CreateWindowExA
IPTR	IPTR	400E6	success	1	4544B896	unknown
IPTR	IPTR	400F0	success	1	101A12F8	unknown
IPTR	IPTR	70100	success	1	3B31940	unknown
IPTR	IPTR	30126	success	1	FFFFFFFF	unknown

Window UIs Enumerated

Window name	Class name	HWND of window	Completion	Count	Source Address	Symbol
NULL	MSOBALLOON	0	error	1	30063D12	FindWindowA
NULL	MsoHelp10	0	error	1	30063D27	FindWindowA
NULL	AgentAnim	0	error	1	30063D40	FindWindowA
NULL	Shell_TrayWnd	1005E	success	1	3163DD74	unknown

HWND	Completion	Count	Source Address	Symbol
40136	success	1	3163DD74	unknown

Desktop HWND	Parent HWND	Enum Childrens	TID	Window Handles	Completion	Count	Source Address	Symbol
0	1005E	true	0	10064, 10066, 10068, 1006A, 1006C, 1006E, 10078, 10084, 10088, 1, 88000000, 88000000, 88000000, 88000000, 88000000	success or wait	1	3163DD74	unknown
0	0	false	6E8	40136, 5012E, 30154, 400FA, 40132, 1, 10078, 10084, 10088, 1, 88000000, 88000000, 88000000, 88000000, 88000000	success or wait	1	3163DD74	unknown

Information about Foreground Window Queried

HWND	Completion	Count	Source Address	Symbol
1008C	success	1	300037BB	NtUserGetForegroundWindow
0	error	1	3163DD74	unknown
5012E	success	9	30063CEF	NtUserGetForegroundWindow

Window UI Shown

HWND	Command	Completion	Count	Source Address	Symbol
40136	show no activate	error	1	1	unknown
40134	show normal	error	1	3005545D	NtUserShowWindow
3011C	show no activate	error	1	3163DD74	unknown
3011C	show no activate	success	1	3163DD74	unknown
5012E	show maximized	error	1	3002CCA5	NtUserShowWindow
40134	show normal	success	5	3005545D	NtUserShowWindow
400EC	show normal	error	1	300747CC	NtUserShowWindow
400E4	show normal	error	1	300747CC	NtUserShowWindow
400DE	show normal	error	1	300747CC	NtUserShowWindow
40128	show normal	error	1	300747CC	NtUserShowWindow
500DC	show normal	error	1	300747CC	NtUserShowWindow
400D6	show normal	error	1	300747CC	NtUserShowWindow
400EC	show normal	success	3	300747CC	NtUserShowWindow
400E4	show normal	success	3	300747CC	NtUserShowWindow
400DE	show normal	success	3	300747CC	NtUserShowWindow
40128	show normal	success	3	300747CC	NtUserShowWindow
500DC	show normal	success	3	300747CC	NtUserShowWindow
400D6	show normal	success	3	300747CC	NtUserShowWindow
5012C	show normal	error	1	3006A9F5	NtUserShowWindow
50106	show normal	error	1	30074BAC	NtUserShowWindow
500DC	show	success	1	30074BC1	NtUserShowWindow
400D6	show	success	1	30074BD6	NtUserShowWindow
900FE	show normal	error	1	300747CC	NtUserShowWindow
90152	show normal	error	1	300747CC	NtUserShowWindow
9013E	show normal	error	1	300747CC	NtUserShowWindow
500F8	show normal	error	1	300747CC	NtUserShowWindow
60112	show normal	error	1	300747CC	NtUserShowWindow
900FE	show normal	success	2	300747CC	NtUserShowWindow
90152	show normal	success	2	300747CC	NtUserShowWindow
9013E	show normal	success	2	300747CC	NtUserShowWindow
500F8	show normal	success	2	300747CC	NtUserShowWindow
60112	show normal	success	2	300747CC	NtUserShowWindow
50124	show normal	error	1	30074BAC	NtUserShowWindow
60112	show	success	1	30074BC1	NtUserShowWindow
400D8	show normal	error	1	3005545D	NtUserShowWindow
400F2	hide	error	1	30294A11	NtUserShowWindow
90058	hide	success	1	3024E018	NtUserShowWindow
90058	show	error	1	30250866	NtUserShowWindow

Window UI Placement Queried

HWND	Command	Completion	Count	Source Address	Symbol
5012E	show maximized	success	2	3006ADB8	NtUserGetWindowPlacement

Message Posted to Windows UI

HWND	Message	LParam	WParam	Completion	Count	Source Address	Symbol
5012E	D00	37	0	success	2	3163DD74	unknown
5012E	45F	0	0	success	1	30003B2E	PostMessageA
50136	DDE_ACK	524352	55447496	success	1	3067D00E	PostMessageA
30126	401	1	53076984	success	10	101DFB64	unknown
5012E	NCCREATE	0	1239824	success	1	3002A1BB	DefWindowProcW
40132	NCCREATE	0	1239796	success	1	30029D25	CreateWindowExW
5012E	NCCALCSIZE	0	1239864	error	1	3002A1BB	DefWindowProcW
5012E	WINDOWPOSCHANGING	0	1239844	error	1	3002A83F	DefWindowProcA
5012E	NCCALCSIZE	1	1239800	error	1	3002A1BB	DefWindowProcW
30154	NCCREATE	0	1239976	success	1	1	unknown
30154	NCCALCSIZE	0	1240016	error	1	1	unknown
4014A	NCCREATE	0	1239144	success	1	3002D684	CoInitialize
4014A	NCCALCSIZE	0	1239184	error	1	3002D684	CoInitialize
40134	NCCREATE	0	1238664	success	1	30054C56	DefWindowProcA
40138	NCCREATE	0	1238952	success	4	3163DD74	unknown
40138	NCCALCSIZE	0	1238992	error	4	3163DD74	unknown
50108	NCCREATE	0	1237660	success	3	340046	unknown
50108	NCCALCSIZE	0	1237700	error	3	340046	unknown
50108	SETTEXT	0	8912904	success	3	340046	unknown
5010A	WINDOWPOSCHANGING	0	1240492	error	4	3163DD74	unknown
5010A	NCCALCSIZE	1	1240448	error	4	3163DD74	unknown
400E8	NCCALCSIZE	1	1240312	error	1	3163DD74	unknown
50108	NCCALCSIZE	1	1240368	error	2	3163DD74	unknown
40134	WINDOWPOSCHANGING	0	1240240	error	1	30054C56	DefWindowProcA
5010A	WINDOWPOSCHANGING	0	1240328	error	4	3163DD74	unknown
3011C	NCCALCSIZE	1	1240284	error	3	3163DD74	unknown
90058	NCCREATE	0	1238704	success	1	300631FF	DefWindowProcA
90058	NCCALCSIZE	0	1238756	error	1	300631FF	DefWindowProcA
5012E	WINDOWPOSCHANGING	0	1240708	error	1	3002A83F	DefWindowProcA
5012E	NCCALCSIZE	1	1240664	error	1	3002A1BB	DefWindowProcW
5012E	NCACTIVATE	1	0	success	2	3002A1BB	DefWindowProcW
400FA	NCCREATE	0	1234616	success	1	3002A1BB	DefWindowProcW
400FA	NCCALCSIZE	0	1234656	error	1	3002A1BB	DefWindowProcW
A0118	NCCREATE	0	1238464	success	1	3163DD74	unknown
A0118	NCCALCSIZE	0	1238528	error	1	3163DD74	unknown
5012E	NCPAINT	1	0	error	16	3002A1BB	DefWindowProcW
90058	NCPAINT	1	0	error	30	300631FF	DefWindowProcA
5012E	SETICON	1	197243	error	1	3002A1BB	DefWindowProcW
5012E	SETICON	0	197151	error	1	3002A1BB	DefWindowProcW
5012E	GETICON	2	0	success	2	3002A1BB	DefWindowProcW
5012E	GETICON	0	0	success	1	3002A1BB	DefWindowProcW
5012E	GETICON	1	0	success	1	3002A1BB	DefWindowProcW
80040	NCCREATE	0	1237124	success	1	3067DCDA	DefWindowProcA
80040	NCCALCSIZE	0	1237164	error	1	3067DCDA	DefWindowProcA
50136	DDE_ACK	524352	3221864481	success	1	3067B376	SendMessageA
5012E	88	4	0	error	1	3002A1BB	DefWindowProcW
5012E	PAINT	0	0	error	2	3002A1BB	DefWindowProcW
90058	PAINT	0	0	error	3	300631FF	DefWindowProcA
90058	WINDOWPOSCHANGING	0	1201920	error	1	300631FF	DefWindowProcA
40134	WINDOWPOSCHANGING	0	1201932	error	1	30054C56	DefWindowProcA
5010A	WINDOWPOSCHANGING	0	1202020	error	4	6	unknown
40134	WINDOWPOSCHANGING	0	1202008	error	2	30054C56	DefWindowProcA
5012C	NCCREATE	0	1200884	success	1	3006C360	DefWindowProcW
5012C	NCCALCSIZE	0	1200924	error	1	3006C360	DefWindowProcW

TID	Message	LParam	WParam	Completion	Count	Source Address	Symbol
6E8	C087	17	327982	success	1	7C90E473	KiUserApcDispatcher
61C	C087	1	0	success	1	3163DD74	unknown
6E8	C087	0	0	success	1	3163DD74	unknown
7DC	C088	0	0	success	3	3163DD74	unknown
7DC	C0C3	0	1768	success	4	3006A390	DispatchMessageA
7DC	C08C	0	1980	success	1	7C80B72F	unknown
6E8	C087	17	327942	success	1	7C90E473	KiUserApcDispatcher

Window UIs Hook Set

Module	Thread id	Hook code	Completion	Count	Source Address	Symbol
C:\WINDOWS\system32\MSCTF.dll	1768	keyboard	success	1	30029D25	CreateWindowExW
C:\WINDOWS\system32\MSCTF.dll	1768	mouse	success	1	30029D25	CreateWindowExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	1768	FFFFFFFF	success	1	30007EF6	SetWindowsHookExW
C:\WINDOWS\system32\MSCTF.dll	1624	keyboard	success	1	3B31940	unknown
C:\WINDOWS\system32\MSCTF.dll	1624	mouse	success	1	3B31940	unknown

Process Token Activites

Status	Privilege	Completion	Count	Source Address	Symbol
on	Load Driver	success or wait	2	FFFF	unknown

Chronological Activities

Operation	Data	Completion	Time
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CWDIllegalInDLLSearch	object name not found	614796698
System info queried	Type: BasicInformation	success or wait	614798311
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 140000 Length: 12FB14 Allocation Type: unknown Protection: page read and write	success or wait	614798574
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 140000 Length: 12FB18 Allocation Type: unknown Protection: page read and write	success or wait	614798780
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 141000 Length: 12F7F4 Allocation Type: unknown Protection: page read and write	success or wait	614799182
System info queried	Type: BasicInformation	success or wait	614799431
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 240000 Length: 12FB14 Allocation Type: unknown Protection: page read and write	success or wait	614799633
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 240000 Length: 12FB18 Allocation Type: unknown Protection: page read and write	success or wait	614799827
File opened	Path: C:\Program Files\AutoIt3 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	614800723
File control set	Path: C:\Program Files\AutoIt3 Control Code: 90028 Input Buffer:	success or wait	614801565
Section loaded	Path: \KnownDlls\kernel32.dll Access: write and read and execute Type: unknown Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	614802521
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C801000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614803756
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C801000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614804990
Process information queried	PID: 1160 Info Class: Cookie	success or wait	614806018
System info queried	Type: RangeStartInformation	success or wait	614806265
System info queried	Type: BasicInformation	success or wait	614806447
Section loaded	Path: unknown Access: query and write and read and execute and extend size Type: reserve Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	614806694
System info queried	Type: BasicInformation	success or wait	614807655
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 250000 Length: 12F340 Allocation Type: unknown Protection: page read and write	success or wait	614808116
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	614810438
Section loaded	Path: \NLS\NlsSectionUnicode Access: read Type: unknown Baseaddress: 260000 Size: 90112 Protection: readonly Mapped to pid: own pid	success or wait	614811459
Section loaded	Path: \NLS\NlsSectionLocale Access: read Type: unknown Baseaddress: 280000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	614812817
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 143000 Length: 12F21C Allocation Type: unknown Protection: page read and write	success or wait	614813827
Section loaded	Path: \NLS\NlsSectionSortkey Access: query and read Type: unknown Baseaddress: 2D0000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	614814143
Section loaded	Path: \NLS\NlsSectionSortTbls Access: read Type: unknown Baseaddress: 320000 Size: 24576 Protection: readonly Mapped to pid: own pid	success or wait	614814837
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	614816353
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	614816596
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 251000 Length: 12F168 Allocation Type: unknown Protection: page read and write	success or wait	614816815
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE.2.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	614819032
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE.2.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	614820975
Section loaded	Path: \KnownDlls\ADVAPI32.dll Access: write and read and execute Type: unknown Baseaddress: 77DD0000 Size: 634880 Protection: read write Mapped to pid: own pid	success or wait	614851330
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614852826
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614853432
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614853733
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614854180
Section loaded	Path: \KnownDlls\RPCRT4.dll Access: write and read and execute Type: unknown Baseaddress: 77E70000 Size: 602112 Protection: read write Mapped to pid: own pid	success or wait	614854466
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614855761
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614856435
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614856694
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614857052
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614857310
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614857580
Section loaded	Path: \KnownDlls\Secur32.dll Access: write and read and execute Type: unknown Baseaddress: 77FE0000 Size: 69632 Protection: read write Mapped to pid: own pid	success or wait	614857873
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614859148
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614859495
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614859857
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614860140
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614860410
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614860754
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614861004
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614861254
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614861495
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614861999
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614862226
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614862606
Section loaded	Path: \KnownDlls\GDI32.dll Access: write and read and execute Type: unknown Baseaddress: 77F10000 Size: 299008 Protection: read write Mapped to pid: own pid	success or wait	614862801
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614864017
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614864432
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614864678
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614864928
Section loaded	Path: \KnownDlls\USER32.dll Access: write and read and execute Type: unknown Baseaddress: 7E410000 Size: 593920 Protection: read write Mapped to pid: own pid	success or wait	614865207
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614866472
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614867274
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614867534
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614867836
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614868091
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614868456
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614868696
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614869316
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614869580
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614869882
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614870114
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614870529
Section loaded	Path: \KnownDlls\ole32.dll Access: write and read and execute Type: unknown Baseaddress: 774E0000 Size: 1302528 Protection: read write Mapped to pid: own pid	success or wait	614870793
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614872068
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614872465
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614872709
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614872959
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614873201
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614873614
Section loaded	Path: \KnownDlls\msvcrt.dll Access: write and read and execute Type: unknown Baseaddress: 77C10000 Size: 360448 Protection: read write Mapped to pid: own pid	success or wait	614874415
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614875652
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614876103
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614876363
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614876613
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614876852
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614877350
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614877591
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614877837
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614878079
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614878422
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614878663
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614879017
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614879244
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614879760
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614879990
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614880359
Section loaded	Path: \KnownDlls\VERSION.dll Access: write and read and execute Type: unknown Baseaddress: 77C00000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	614880673
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614881832
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614882235
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614882481
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614882733
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614882963
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614883190
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614883421
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614883677
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 144000 Length: 12F894 Allocation Type: unknown Protection: page read and write	success or wait	614884335
Process information queried	PID: 1160 Info Class: ImageInformation	success or wait	614886561
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	614887165
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	614890012
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSUserEnabled	success or wait	614890595
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: LeakTrack	object name not found	614891492
System info queried	Type: BasicInformation	success or wait	614892393
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: SafeDllSearchMode	object name not found	614893527
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	614894394
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 410000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	614895155
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	614897012
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 410000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	614897760
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	614899352
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: query and write and read and execute Type: image Baseaddress: 76390000 Size: 118784 Protection: read write Mapped to pid: own pid	success or wait	614900320
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: TransparentEnabled	success or wait	614900831
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614902895
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614903289
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614903548
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614903868
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614904128
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614904412
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614904669
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614904933
System info queried	Type: BasicInformation	success or wait	614905477
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize Name: DisableMetaFiles	object name not found	614906623
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Name: AppInit_DLLs	success or wait	614909746
System info queried	Type: BasicInformation	success or wait	614911456
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 840000 Length: 12F91C Allocation Type: unknown Protection: page read and write	success or wait	614911672
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 840000 Length: 12F920 Allocation Type: unknown Protection: page read and write	success or wait	614911881
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 841000 Length: 12F5FC Allocation Type: unknown Protection: page read and write	success or wait	614912155
Section loaded	Path: \NLS\NlsSectionCType Access: read Type: unknown Baseaddress: 850000 Size: 12288 Protection: readonly Mapped to pid: own pid	success or wait	614913061
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 843000 Length: 12F6B8 Allocation Type: unknown Protection: page read and write	success or wait	614914799
Process information queried	PID: 1160 Info Class: Cookie	success or wait	614915997
Process information queried	PID: 1160 Info Class: Cookie	success or wait	614916200
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 166000 Length: 12F5BC Allocation Type: unknown Protection: page read and write	success or wait	614916699
File opened	Path: \Device\KsecDD Access: read data or list directory and synchronize Options: synchronous io alert Overwritten: false	success or wait	614917598
System info queried	Type: BasicInformation	success or wait	614920534
System info queried	Type: ProcessorInformation	success or wait	614920738
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CriticalSectionTimeout	success or wait	614921119
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: RWLockResourceTimeOut	object name not found	614921735
System info queried	Type: BasicInformation	success or wait	614922225
System info queried	Type: ProcessorInformation	success or wait	614922430
System info queried	Type: BasicInformation	success or wait	614922620
System info queried	Type: ProcessorInformation	success or wait	614922825
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAll	object name not found	614923116
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAllForOle32	object name not found	614923334
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableTypeLib	object name not found	614923548
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAll	object name not found	614924060
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAllForOle32	object name not found	614924273
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30B81000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	614924961
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: CommonFilesDir	success or wait	614925676
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	614926371
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Access: write and read and execute Type: commit Baseaddress: 860000 Size: 12259328 Protection: execute Mapped to pid: own pid	success or wait	614927266
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	614929120
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Access: query and write and read and execute Type: image Baseaddress: 30C90000 Size: 12304384 Protection: read write Mapped to pid: own pid	success or wait	614929938
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll.2.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	614932084
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll.2.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	614932992
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614963166
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614963625
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614963991
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614964405
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614964700
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614965259
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614965500
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614965834
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614966074
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614966471
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614966708
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614966952
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	614967186
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	614967449
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mso.dll Name: CheckAppHelp	success or wait	614968119
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility Name: DisableAppCompat	object name not found	614969402
Section loaded	Path: \BaseNamedObjects\ShimSharedMemory Access: write Type: unknown Baseaddress: 870000 Size: 57344 Protection: read write Mapped to pid: own pid	success or wait	614969924
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 167000 Length: 12ED44 Allocation Type: unknown Protection: page read and write	success or wait	615117357
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 3165E000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	615118065
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	615118930
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	615119375
File opened	Path: C:\Program Files\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	615120694
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	615121995
Mutant created	Name: \BaseNamedObjects\Local\Mutex_MSOSharedMem	success or wait	615123264
System info queried	Type: BasicInformation	success or wait	615125093
System info queried	Type: ProcessorInformation	success or wait	615125286
Process information queried	PID: 1160 Info Class: Cookie	success or wait	615129148
Process information queried	PID: 1160 Info Class: Cookie	success or wait	615129327
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 880000 Length: 12F8B8 Allocation Type: unknown Protection: page no access	success or wait	615132172
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 880000 Length: 12F8B8 Allocation Type: unknown Protection: page read and write	success or wait	615132379
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency	success or wait	615135776
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	success or wait	615139106
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Name: y	object name not found	615139868
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Name: y Type: binary Data: 79 13 02 00 88 04 00 00 01 00 00 00 00 00 00 00 00 00 00 00 Old data:	success or wait	615140327
Foreground Window Got	HWND: 1008C	success	615140927
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	615141179
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	615141371
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\General Name: InstalledOnWin2k	success or wait	615142969
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: UserData	success or wait	615143410
Process information queried	PID: 1160 Info Class: Times	success or wait	615143708
Process information queried	PID: 1160 Info Class: Times	success or wait	615143894
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common Name: QMStrMax	object name not found	615144252
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 890000 Length: 12F8CC Allocation Type: unknown Protection: page no access	success or wait	615144624
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 890000 Length: 12F8CC Allocation Type: unknown Protection: page read and write	success or wait	615144822
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: QMStudyID	object name not found	615145249
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 891000 Length: 12F85C Allocation Type: unknown Protection: page read and write	success or wait	615145558
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8A0000 Length: 12F888 Allocation Type: unknown Protection: page no access	success or wait	615145807
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8A0000 Length: 12F888 Allocation Type: unknown Protection: page read and write	success or wait	615146000
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8B0000 Length: 12F810 Allocation Type: unknown Protection: page no access	success or wait	615146214
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8B0000 Length: 12F810 Allocation Type: unknown Protection: page read and write	success or wait	615146407
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: UserData	success or wait	615147145
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\LanguageResources Name: SKULanguage	success or wait	615147686
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: InstallLanguage	success or wait	615148355
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: UILanguage	success or wait	615148678
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: HelpLanguage	success or wait	615149011
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: ExeMode	object name not found	615149328
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: WinXPLanguagePatch	success or wait	615149652
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: PreviousInstallLanguage	success or wait	615151384
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: WebLocale	success or wait	615151705
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: LangTuneUp	success or wait	615152098
Key value replaced with new	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: 2055 Type: unicode Data: On Old data: Off	success or wait	615154284
Key value replaced with new	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: 2055 Type: unicode Data: Off Old data: On	success or wait	615157921
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Name: OfficeUILanguage	success or wait	615158597
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Name: OfficeUILanguage	success or wait	615158959
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: InstallFonts	object name not found	615159294
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\1033\wwintl.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615160069
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\1033\WWINTL.DLL Access: write and read and execute Type: commit Baseaddress: 8C0000 Size: 778240 Protection: execute Mapped to pid: own pid	success or wait	615160921
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\1033\wwintl.dll Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: null	success or wait	615162670
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\1033\WWINTL.DLL Access: query and read Type: commit Baseaddress: 8C0000 Size: 778240 Protection: readonly Mapped to pid: own pid	success or wait	615163496
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: UILanguage	success or wait	615169219
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 00000401	success or wait	615170752
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 0000040D	success or wait	615171275
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 0000041E	success or wait	615171851
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 0000042A	success or wait	615172376
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 168000 Length: 12F074 Allocation Type: unknown Protection: page read and write	success or wait	615172904
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 00000439	success or wait	615173182
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 00000420	success or wait	615173812
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 00000429	success or wait	615174334
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Migration\Word	success or wait	615176672
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 980000 Length: 12F45C Allocation Type: unknown Protection: page read and write	success or wait	615180049
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 980000 Length: 12F458 Allocation Type: unknown Protection: page read and write	success or wait	615180268
System info queried	Type: PerformanceInformation	success or wait	615180520
Process information queried	PID: 1160 Info Class: QuotaLimits	success or wait	615180950
Process information queried	PID: 1160 Info Class: VmCounters	success or wait	615181155
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9A0000 Length: 12F164 Allocation Type: unknown Protection: page no access	success or wait	615181490
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9A0000 Length: 12F164 Allocation Type: unknown Protection: page read and write	success or wait	615181681
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ASKFORPRINTERPICTURE	object name not found	615188169
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8B1000 Length: 12F114 Allocation Type: unknown Protection: page read and write	success or wait	615188641
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8B2000 Length: 12F0DC Allocation Type: unknown Protection: page read and write	success or wait	615188990
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8B3000 Length: 12F084 Allocation Type: unknown Protection: page read and write	success or wait	615189439
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8B4000 Length: 12F0C4 Allocation Type: unknown Protection: page read and write	success or wait	615189835
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9B0000 Length: 12F110 Allocation Type: unknown Protection: page no access	success or wait	615190228
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9B0000 Length: 12F110 Allocation Type: unknown Protection: page read and write	success or wait	615190425
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9C0000 Length: 12F114 Allocation Type: unknown Protection: page no access	success or wait	615190893
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9C0000 Length: 12F114 Allocation Type: unknown Protection: page read and write	success or wait	615191087
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: CACHESIZE	object name not found	615191425
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9D0000 Length: 12F258 Allocation Type: unknown Protection: page no access	success or wait	615191725
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9D0000 Length: 12F258 Allocation Type: unknown Protection: page read and write	success or wait	615191919
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9C1000 Length: 12F0F8 Allocation Type: unknown Protection: page read and write	success or wait	615192169
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9F0000 Length: 12F258 Allocation Type: unknown Protection: page no access	success or wait	615192416
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9F0000 Length: 12F258 Allocation Type: unknown Protection: page read and write	success or wait	615192607
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9C2000 Length: 12F208 Allocation Type: unknown Protection: page read and write	success or wait	615193137
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9C3000 Length: 12EC38 Allocation Type: unknown Protection: page read and write	success or wait	615193852
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8B5000 Length: 12EC98 Allocation Type: unknown Protection: page read and write	success or wait	615194140
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: UserTemplates	object name not found	615195972
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: AppData	success or wait	615196842
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: Templates	success or wait	615197451
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	615198585
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: A00000 Length: 12B1A0 Allocation Type: unknown Protection: page no access	success or wait	615198982
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: A00000 Length: 12B1A0 Allocation Type: unknown Protection: page read and write	success or wait	615199180
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8B6000 Length: 127988 Allocation Type: unknown Protection: page read and write	success or wait	615201574
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 881000 Length: 12C8D8 Allocation Type: unknown Protection: page read and write	success or wait	615202069
Memory allocated	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: A00000 Length: 12C870 Allocation Type: unknown Protection: page no access	success or wait	615202434
System info queried	Type: BasicInformation	success or wait	615219388
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc Name: MaxRpcSize	object name not found	615219888
System time queried	Time: 129876420050625000	success or wait	615220604
System info queried	Type: PerformanceInformation	success or wait	615221023
Process information queried	PID: 1160 Info Class: QuotaLimits	success or wait	615221478
Process information queried	PID: 1160 Info Class: VmCounters	success or wait	615221691
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19211108172 Access: query and write and read and execute and extend size Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	615222769
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19211108172 Access: query and write and read Type: reserve Baseaddress: A10000 Size: 126976 Protection: read write Mapped to pid: own pid	success or wait	615223004
Mutant created	Name: \BaseNamedObjects\Local\Mso97SharedDg19211108172Mutex	success or wait	615223775
Section loaded	Path: \KnownDlls\uxtheme.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	615225083
File opened	Path: C:\WINDOWS\system32\uxtheme.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615225757
Section loaded	Path: C:\WINDOWS\system32\uxtheme.dll Access: query and write and read and execute Type: image Baseaddress: 5AD70000 Size: 229376 Protection: read write Mapped to pid: own pid	success or wait	615226535
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615228343
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615228752
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615229065
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615229403
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615229663
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615229970
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615230277
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615230535
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615230792
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615231050
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\ThemeManager Name: Compositing	object name not found	615232328
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: LameButtonText	object name not found	615233605
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\Settings Name: Anchor Color	success or wait	615236365
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\Settings Name: Anchor Color Visited	success or wait	615236693
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoClearTypeNW	object name not found	615237171
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: FontInfoCache	object name not found	615238043
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: UseOfficeUIFont	object name not found	615238578
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: FontInfoCache	object name not found	615241912
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: FontInfoCache Type: binary Data: 60 00 00 00 60 00 00 00 F5 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 BC 02 00 00 00 00 00 00 00 40 00 22 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 12 00 20 E9 90 7C 10 00 00 00 00 F1 12 00 08 F1 12 00 00 00 00 00 E4 F0 12 00 D6 20 91 7C 54 F2 12 00 0E 00 00 00 F0 F0 12 00 24 F1 12 00 1C 00 00 00 54 F2 12 00 9C 00 00 00 00 00 00 00 00 00 00 00 30 F2 12 00 3A 2C 81 7C 08 F1 12 00 0E 00 00 00 00 00 00 00 D4 F2 12 00 4D 2C 81 7C 1C 00 1E 00 24 F1 12 00 0E 00 80 00 54 F2 12 00 1C 01 00 00 05 00 00 00 01 00 00 00 28 0A 00 00 02 00 00 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 33 00 00 00 12 00 5C F6 90 7C 61 F6 90 7C B4 F1 12 00 6E D9 90 7C 74 F2 12 00 4C F1 12 00 7A D9 90 7C 08 50 41 7E 32 F2 12 00 00 39 41 7E D0 00 00 00 C0 F1 12 00 3B 7D 91 7C 32 F2 12 00 DC 02 00 00 00 00 41 7E 98 44 41 7E 08 50 41 7E 00 00 00 00 01 00 00 00 30 F2 12 00 00 00 00 00 01 00 00 00 00 00 41 7E D8 00 41 7E 98 F1 12 00 01 00 00 00 D0 F1 12 00 85 03 91 7C 00 00 41 7E 00 00 00 00 8C F2 12 00 02 7C 91 7C 00 00 41 7E 32 F2 12 00 2C F2 12 00 2C F2 12 00 32 F2 12 00 A7 7C 91 7C 74 E1 97 7C 51 7C 91 7C 74 DD 00 30 40 AE 80 7C FF FF 00 00 00 F0 FD 7F 7A CF 90 7C 42 9B 80 7C FF FF FF FF 50 F2 12 00 00 00 00 00 54 F2 12 00 00 10 00 00 59 9B 80 7C 04 00 00 00 00 20 00 00 00 10 00 00 00 00 00 00 E8 22 24 00 18 F2 12 00 00 00 45 6E B0 FF 12 00 D8 9A 83 7C 60 9B 80 7C FF FF FF FF 59 9B 80 7C 09 9B 80 7C FF FF FF FF 00 10 9A 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 9A 00 D2 B9 CB 30 00 10 9A 00 00 10 00 00 F4 B9 CB 30 28 2F 62 31 40 02 00 00 00 00 9A 00 03 20 00 00 00 10 00 00 CE B8 CB 30 03 00 00 00 FD 3F 00 00 0D 00 00 00 0B 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 06 00 00 00 1A 00 00 00 BC 02 00 00 00 00 00 00 60 00 00 00 60 00 00 00 1E FF 1F 20 00 00 00 27 00 00 01 01 87 7A 00 61 00 00 00 80 08 00 00 00 00 00 00 00 01 00 00 00 00 00 28 20 07 00 00 00 F5 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 00 00 00 00 00 00 40 00 22 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 12 00 20 E9 90 7C 10 00 00 00 00 F1 12 00 08 F1 12 00 00 00 00 00 E4 F0 12 00 D6 20 91 7C 54 F2 12 00 0E 00 00 00 F0 F0 12 00 24 F1 12 00 1C 00 00 00 54 F2 12 00 9C 00 00 00 00 00 00 00 00 00 00 00 30 F2 12 00 3A 2C 81 7C 08 F1 12 00 0E 00 00 00 00 00 00 00 D4 F2 12 00 4D 2C 81 7C 1C 00 1E 00 24 F1 12 00 0E 00 80 00 54 F2 12 00 1C 01 00 00 05 00 00 00 01 00 00 00 28 0A 00 00 02 00 00 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 33 00 00 00 12 00 5C F6 90 7C 61 F6 90 7C B4 F1 12 00 6E D9 90 7C 74 F2 12 00 4C F1 12 00 7A D9 90 7C 08 50 41 7E 32 F2 12 00 00 39 41 7E D0 00 00 00 C0 F1 12 00 3B 7D 91 7C 32 F2 12 00 DC 02 00 00 00 00 41 7E 98 44 41 7E 08 50 41 7E 00 00 00 00 01 00 00 00 30 F2 12 00 00 00 00 00 01 00 00 00 00 00 41 7E D8 00 41 7E 98 F1 12 00 01 00 00 00 D0 F1 12 00 85 03 91 7C 00 00 41 7E 00 00 00 00 8C F2 12 00 02 7C 91 7C 00 00 41 7E 32 F2 12 00 2C F2 12 00 2C F2 12 00 32 F2 12 00 A7 7C 91 7C 74 E1 97 7C 51 7C 91 7C 74 DD 00 30 40 AE 80 7C FF FF 00 00 00 F0 FD 7F 7A CF 90 7C 42 9B 80 7C FF FF FF FF 50 F2 12 00 00 00 00 00 54 F2 12 00 00 10 00 00 59 9B 80 7C 04 00 00 00 00 20 00 00 00 10 00 00 00 00 00 00 E8 22 24 00 18 F2 12 00 00 00 45 6E B0 FF 12 00 D8 9A 83 7C 60 9B 80 7C FF FF FF FF 59 9B 80 7C 09 9B 80 7C FF FF FF FF 00 10 9A 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 9A 00 D2 B9 CB 30 00 10 9A 00 00 10 00 00 F4 B9 CB 30 28 2F 62 31 40 02 00 00 00 00 9A 00 03 20 00 00 00 10 00 00 CE B8 CB 30 03 00 00 00 FD 3F 00 00 0D 00 00 00 0B 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 05 00 00 00 15 00 00 00 90 01 00 00 00 00 00 00 60 00 00 00 60 00 00 00 1E FF 1F 20 00 00 00 27 00 00 01 01 87 7A 00 61 00 00 00 80 08 00 00 00 00 00 00 00 01 00 00 00 00 00 28 20 06 00 00 00 F7 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 90 01 00 00 00 00 00 00 00 40 00 22 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 12 00 20 E9 90 7C 10 00 00 00 00 F1 12 00 08 F1 12 00 00 00 00 00 E4 F0 12 00 D6 20 91 7C 54 F2 12 00 0E 00 00 00 F0 F0 12 00 24 F1 12 00 1C 00 00 00 54 F2 12 00 9C 00 00 00 00 00 00 00 00 00 00 00 30 F2 12 00 3A 2C 81 7C 08 F1 12 00 0E 00 00 00 00 00 00 00 D4 F2 12 00 4D 2C 81 7C 1C 00 1E 00 24 F1 12 00 0E 00 80 00 54 F2 12 00 1C 01 00 00 05 00 00 00 01 00 00 00 28 0A 00 00 02 00 00 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 33 00 00 00 12 00 5C F6 90 7C 61 F6 90 7C B4 F1 12 00 6E D9 90 7C 74 F2 12 00 4C F1 12 00 7A D9 90 7C 08 50 41 7E 32 F2 12 00 00 39 41 7E D0 00 00 00 C0 F1 12 00 3B 7D 91 7C 32 F2 12 00 DC 02 00 00 00 00 41 7E 98 44 41 7E 08 50 41 7E 00 00 00 00 01 00 00 00 30 F2 12 00 00 00 00 00 01 00 00 00 00 00 41 7E D8 00 41 7E 98 F1 12 00 01 00 00 00 D0 F1 12 00 85 03 91 7C 00 00 41 7E 00 00 00 00 8C F2 12 00 02 7C 91 7C 00 00 41 7E 32 F2 12 00 2C F2 12 00 2C F2 12 00 32 F2 12 00 A7 7C 91 7C 74 E1 97 7C 51 7C 91 7C 74 DD 00 30 40 AE 80 7C FF FF 00 00 00 F0 FD 7F 7A CF 90 7C 42 9B 80 7C FF FF FF FF 50 F2 12 00 00 00 00 00 54 F2 12 00 00 10 00 00 59 9B 80 7C 04 00 00 00 00 20 00 00 00 10 00 00 00 00 00 00 E8 22 24 00 18 F2 12 00 00 00 45 6E B0 FF 12 00 D8 9A 83 7C 60 9B 80 7C FF FF FF FF 59 9B 80 7C 09 9B 80 7C FF FF FF FF 00 10 9A 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 9A 00 D2 B9 CB 30 00 10 9A 00 00 10 00 00 F4 B9 CB 30 28 2F 62 31 40 02 00 00 00 00 9A 00 03 20 00 00 00 10 00 00 CE B8 CB 30 03 00 00 00 FD 3F 00 00 0B 00 00 00 09 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 04 00 00 00 11 00 00 00 90 01 00 00 00 00 00 00 60 00 00 00 60 00 00 00 1E FF 1F 20 00 00 00 27 00 00 01 01 87 7A 00 61 00 00 00 80 08 00 00 00 00 00 00 00 01 00 00 00 00 00 28 20 05 00 00 00 F5 FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 BC 02 00 00 00 00 00 00 00 40 00 22 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 00 61 00 68 00 6F 00 6D 00 61 00 00 00 12 00 20 E9 90 7C 10 00 00 00 00 F1 12 00 08 F1 12 00 00 00 00 00 E4 F0 12 00 D6 20 91 7C 54 F2 12 00 0E 00 00 00 F0 F0 12 00 24 F1 12 00 1C 00 00 00 54 F2 12 00 9C 00 00 00 00 00 00 00 00 00 00 00 30 F2 12 00 3A 2C 81 7C 08 F1 12 00 0E 00 00 00 00 00 00 00 D4 F2 12 00 4D 2C 81 7C 1C 00 1E 00 24 F1 12 00 0E 00 80 00 54 F2 12 00 1C 01 00 00 05 00 00 00 01 00 00 00 28 0A 00 00 02 00 00 00 53 00 65 00 72 00 76 00 69 00 63 00 65 00 20 00 50 00 61 00 63 00 6B 00 20 00 33 00 00 00 12 00 5C F6 90 7C 61 F6 90 7C B4 F1 12 00 6E D9 90 7C 74 F2 12 00 4C F1 12 00 7A D9 90 7C 08 50 41 7E 32 F2 12 00 00 39 41 7E D0 00 00 00 C0 F1 12 00 3B 7D 91 7C 32 F2 12 00 DC 02 00 00 00 00 41 7E 98 44 41 7E 08 50 41 7E 00 00 00 00 01 00 00 00 30 F2 12 00 00 00 00 00 01 00 00 00 00 00 41 7E D8 00 41 7E 98 F1 12 00 01 00 00 00 D0 F1 12 00 85 03 91 7C 00 00 41 7E 00 00 00 00 8C F2 12 00 02 7C 91 7C 00 00 41 7E 32 F2 12 00 2C F2 12 00 2C F2 12 00 32 F2 12 00 A7 7C 91 7C 74 E1 97 7C 51 7C 91 7C 74 DD 00 30 40 AE 80 7C FF FF 00 00 00 F0 FD 7F 7A CF 90 7C 42 9B 80 7C FF FF FF FF 50 F2 12 00 00 00 00 00 54 F2 12 00 00 10 00 00 59 9B 80 7C 04 00 00 00 00 20 00 00 00 10 00 00 00 00 00 00 E8 22 24 00 18 F2 12 00 00 00 45 6E B0 FF 12 00 D8 9A 83 7C 60 9B 80 7C FF FF FF FF 59 9B 80 7C 09 9B 80 7C FF FF FF FF 00 10 9A 00 00 10 00 00 00 10 00 00 04 00 00 00 00 00 9A 00 D2 B9 CB 30 00 10 9A 00 00 10 00 00 F4 B9 CB 30 28 2F 62 31 40 02 00 00 00 00 9A 00 03 20 00 00 00 10 00 00 CE B8 CB 30 03 00 00 00 FD 3F 00 00 0D 00 00 00 0B 00 00 00 02 00 00 00 02 00 00 00 00 00 00 00 06 00 00 00 1A 00 00 00 BC 02 00 00 00 00 00 00 60 00 00 00 60 00 00 00 1E FF 1F 20 00 00 00 27 00 00 01 01 87 7A 00 61 00 00 00 80 08 00 00 00 00 00 00 00 01 00 00 00 00 00 28 20 07 00 00 00 Old data:	success or wait	615244013
Key value queried	Path: HKEY_USERS\Control Panel\International Name: iCountry	success or wait	615250816
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseNTWordDefPgSzBehavior	object name not found	615251145
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseAlternateTOCDelimiter	object name not found	615251465
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UpdateAllNumpages	object name not found	615251780
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AlternateReplaceAllMethodBehaviour	object name not found	615252099
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: WordPartialProtectDocTableResize	object name not found	615252469
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FieldCalcSecurityLevel	object name not found	615252785
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Wizards	success or wait	615253154
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Wizards Name: PageSize Type: unicode Data: Letter Old data:	success or wait	615253722
Key value queried	Path: HKEY_USERS\Control Panel\International Name: iMeasure	success or wait	615254085
Key value queried	Path: HKEY_USERS\Control Panel\International Name: iTimePrefix	success or wait	615254512
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DOC-EXTENSION	object name not found	615255386
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DOT-EXTENSION	object name not found	615255962
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BAK-EXTENSION	object name not found	615256563
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BitmapMemory	object name not found	615257119
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: MessageBeeps	object name not found	615257618
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: EnableSubDocPutSaved	object name not found	615258105
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FavorWord97ListIndents	object name not found	615258423
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DoNotConfirmConverterSecurity	object name not found	615258737
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: WordRTFOutPathPref	object name not found	615259047
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: CalcDataFieldOnOpen	object name not found	615259360
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: SlowShading	object name not found	615259756
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: HideFileNotSavedDlg	object name not found	615260240
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NumberingGapUL	object name not found	615261098
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AlternateRevisionStepThrough	object name not found	615261468
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BlockDocCloseDuringCmdExec	object name not found	615261783
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: EnsurePrintLongVertCell	object name not found	615262097
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AlternativeLongTablesLayout	object name not found	615262409
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BulletProofOnCorruption	object name not found	615262720
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UpdateHeaderFooter	object name not found	615263031
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: EnsureFlagsOfProtectedDocForVbaSel	object name not found	615263346
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: RestoreXmlEvents	object name not found	615263656
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseLocalBiDiStyle	object name not found	615263967
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AlternateBreakThroughTab	object name not found	615264280
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UpdateWwdVBAUponToggleXML	object name not found	615264643
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: SpecialFieldsProtHandling	object name not found	615264956
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: WriteUrlWithSubitemAsBinary	object name not found	615265269
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ForceGrayscalePrint	object name not found	615265630
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoSmartTagRecognition	object name not found	615266251
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoSmartTagActions	object name not found	615266565
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DefaultFormat	object name not found	615266873
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BackgroundSave	object name not found	615267183
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BackgroundOpen	object name not found	615267495
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BackgroundPrint	object name not found	615267858
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: PlainTextAutoFormat	object name not found	615268169
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Outlook\Options\Calendar Name: Text Direction	success or wait	615268760
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Outlook\Options\Calendar Name: Text Direction	success or wait	615269078
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: NoTrack	object name not found	615269493
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: Bidi Spelling	object name not found	615269808
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AutoSpell	object name not found	615270118
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AutoGrammar	object name not found	615270426
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoLiveScrolling	object name not found	615270732
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoFontMRUList	object name not found	615271137
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: InsertFloating	object name not found	615271496
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoRecentDocsHistory	object name not found	615271962
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: DisableScalingUpForHighDPI	object name not found	615272503
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: WordName	success or wait	615273348
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	615274364
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\Comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615275384
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: write and read and execute Type: commit Baseaddress: A30000 Size: 1056768 Protection: execute Mapped to pid: own pid	success or wait	615276389
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\Comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615279101
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: query and write and read and execute Type: image Baseaddress: 773D0000 Size: 1060864 Protection: read write Mapped to pid: own pid	success or wait	615280109
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615281610
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615281941
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615282201
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615282452
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615282760
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615283082
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615283400
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615283671
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615283925
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615284250
Section loaded	Path: \KnownDlls\SHLWAPI.dll Access: write and read and execute Type: unknown Baseaddress: 77F60000 Size: 483328 Protection: read write Mapped to pid: own pid	success or wait	615284542
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615285921
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615286340
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615286611
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615286887
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615287154
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615287545
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615287812
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615288076
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615288342
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615288720
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615288970
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615289366
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615289618
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615289916
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615292328
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: write and read and execute Type: commit Baseaddress: A30000 Size: 4096 Protection: execute Mapped to pid: own pid	success or wait	615293274
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: null	success or wait	615295260
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: query and read Type: commit Baseaddress: A30000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	615296119
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615297572
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: read Type: commit Baseaddress: A30000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	615298353
File opened	Path: C:\WINDOWS\WindowsShell.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	615299149
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	615330097
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: EnableBalloonTips	object name not found	615331024
Window created	Window Name: OpusApp Class Name: OpusApp HWND: 5012E	success	615334574
File opened	Path: C:\WINDOWS\system32\MSCTF.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615335085
Section loaded	Path: C:\WINDOWS\system32\msctf.dll Access: write and read and execute Type: commit Baseaddress: A50000 Size: 299008 Protection: execute Mapped to pid: own pid	success or wait	615335849
File opened	Path: C:\WINDOWS\system32\MSCTF.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615337612
Section loaded	Path: C:\WINDOWS\system32\msctf.dll Access: query and write and read and execute Type: image Baseaddress: 74720000 Size: 311296 Protection: read write Mapped to pid: own pid	success or wait	615338361
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615339856
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615340270
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615340536
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615340799
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615341064
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615341434
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615341695
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615342005
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615342266
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615342521
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	615343415
Section loaded	Path: \BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read Type: commit Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name exists	615344928
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared Name: CUAS	success or wait	615345726
Mutant created	Name: \BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	615347407
Mutant created	Name: \BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	615347693
Mutant created	Name: \BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	615347975
Mutant created	Name: \BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	615348252
Mutant created	Name: \BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	615348525
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	615348939
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	615349309
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	615349671
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	615350031
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF Name: EnableAnchorContext	object name not found	615351970
Mutant created	Name: \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500MUTEX.DefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	615352895
Section loaded	Path: \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500SFM.DefaultS-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read and execute and extend size Type: unknown Baseaddress: A50000 Size: 262144 Protection: read write Mapped to pid: own pid	success or wait	615353216
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 1768 Hook ID: keyboard	success	615354256
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 1768 Hook ID: mouse	success	615354481
Message sent	HWND: 5012E Message: NCCREATE WParam: 0 LParam: 1239824	success	615354948
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM Name: Ime File	success or wait	615355684
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	615356251
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615356803
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: write and read and execute Type: commit Baseaddress: A90000 Size: 180224 Protection: execute Mapped to pid: own pid	success or wait	615357602
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: null	success or wait	615359508
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: query and read Type: commit Baseaddress: A90000 Size: 180224 Protection: readonly Mapped to pid: own pid	success or wait	615360352
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	615361713
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	615363329
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615363801
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: write and read and execute Type: commit Baseaddress: A90000 Size: 180224 Protection: execute Mapped to pid: own pid	success or wait	615364594
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: null	success or wait	615366248
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: query and read Type: commit Baseaddress: A90000 Size: 180224 Protection: readonly Mapped to pid: own pid	success or wait	615367034
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	615368395
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615370016
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: write and read and execute Type: commit Baseaddress: A90000 Size: 180224 Protection: execute Mapped to pid: own pid	success or wait	615370846
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615372398
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: query and write and read and execute Type: image Baseaddress: 755C0000 Size: 188416 Protection: read write Mapped to pid: own pid	success or wait	615373179
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615375838
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615377228
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615377525
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615377836
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615378126
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615378420
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615378712
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615379027
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615379316
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615379611
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615379902
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615380191
Message sent	HWND: 40132 Message: NCCREATE WParam: 0 LParam: 1239796	success	615382145
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF Name: Disable Thread Input Manager	object name not found	615382760
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared Name: CUAS	success or wait	615384643
Message sent	HWND: 5012E Message: NCCALCSIZE WParam: 0 LParam: 1239864	error	615386572
Message sent	HWND: 5012E Message: WINDOWPOSCHANGING WParam: 0 LParam: 1239844	error	615386929
Message sent	HWND: 5012E Message: NCCALCSIZE WParam: 1 LParam: 1239800	error	615387174
Section loaded	Path: \BaseNamedObjects\PrimaryWord11SharedMemoryArea Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	615387927
Section loaded	Path: \BaseNamedObjects\PrimaryWord11SharedMemoryArea Access: query and write and read Type: commit Baseaddress: A90000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	615388162
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\1033\msointl.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615390190
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\1033\MSOINTL.DLL Access: write and read and execute Type: commit Baseaddress: AA0000 Size: 1757184 Protection: execute Mapped to pid: own pid	success or wait	615391044
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\1033\msointl.dll Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: null	success or wait	615392866
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\1033\MSOINTL.DLL Access: query and read Type: commit Baseaddress: AA0000 Size: 1757184 Protection: readonly Mapped to pid: own pid	success or wait	615393705
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: ScreenReaderPresent	object name not found	615394925
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg20321108172 Access: query and write and read and execute and extend size Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	615395289
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg20321108172 Access: query and write and read Type: reserve Baseaddress: C50000 Size: 126976 Protection: read write Mapped to pid: own pid	success or wait	615395526
Mutant created	Name: \BaseNamedObjects\Local\Mso97SharedDg20321108172Mutex	success or wait	615396415
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: UseAlternateShowUIMethodForFtpSession	object name not found	615397418
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: MaxCachedStreamSize	object name not found	615397748
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: ShowOtherTablesInDataSrc	object name not found	615398140
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: HypAlternateResolveToRel	object name not found	615398466
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: RepairSmartTags	object name not found	615398786
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: AddressBookNameMax4096	object name not found	615399111
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: ShowDispNameInToolTip	object name not found	615399432
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: AllowConsecutiveSlashesInUrlPathComponent	object name not found	615399759
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: UseCaseInsensitivePathForHyperlink	object name not found	615400133
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: LastUILang	object name not found	615400486
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: LastUILang	object name not found	615400800
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Name: OfficeUILanguage	success or wait	615401115
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Name: OfficeUILanguage	success or wait	615401429
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: AcbControl	object name not found	615401888
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: AcbOn	object name not found	615402514
System info queried	Type: PerformanceInformation	success or wait	615402948
Process information queried	PID: 1160 Info Class: QuotaLimits	success or wait	615403324
Process information queried	PID: 1160 Info Class: VmCounters	success or wait	615403527
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: CurrentProvider	success or wait	615405175
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: MaxWords	object name not found	615405508
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: MaxWordsJapan	object name not found	615405828
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: UseOnline	object name not found	615406147
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: PreferOffline	object name not found	615406466
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: PreferOffline	object name not found	615406777
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: UseMT	object name not found	615407112
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	615408105
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: RestrictRun	object name not found	615409348
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file and open no recall Attributes: none Content Overwritten: null	success or wait	615409885
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip Offset: unknown Length: 12 Value: 19 00 04 00 19 00 19 00 8C 06 00 00	success or wait	615410792
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip Offset: unknown Length: 1676 Value: 68 00 00 00 88 05 00 00 80 06 00 00 88 06 00 00 E7 69 CD 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	615412096
Window created	Window Name: IPTR Class Name: IPTR HWND: 30154	success	615437502
Message sent	HWND: 30154 Message: NCCREATE WParam: 0 LParam: 1239976	success	615437761
Message sent	HWND: 30154 Message: NCCALCSIZE WParam: 0 LParam: 1240016	error	615438004
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: Sound	object name not found	615439024
Process information queried	PID: 1160 Info Class: Times	success or wait	615440153
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: MTTT	object name not found	615440375
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: MTTT	object name not found	615440700
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: MTTT	object name not found	615441014
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: MTTT Type: binary Data: 88 04 00 00 8C 88 76 79 EA 69 CD 01 00 00 00 00 Old data:	success or wait	615441361
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	615442265
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	615442851
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	615443327
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: ProInfo	success or wait	615444019
Key value queried	Path: HKEY_USERS\Control Panel\International Name: NumShape	success or wait	615444344
Window created	Window Name: IPTR Class Name: IPTR HWND: 40136	success	615479174
Window shown	HWND: 40136 CMD: show no activate	error	615479600
Key value queried	Path: HKEY_USERS\Control Panel\International Name: NumShape	success or wait	615489544
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: DisableFontLinking	object name not found	615489956
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\UserInfo	success or wait	615501270
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\UserInfo Name: UserInfo Type: binary Data: 09 04 68 06 FF 80 40 60 50 38 24 16 0D 06 5F C1 E0 0F 98 33 E9 FE FD 81 BF A0 8C 78 03 7D 7E FC 1F AE 59 87 C3 9A 61 F2 CB 80 3D DF C3 F8 0C 25 FE 3A 7F 44 20 51 28 1A EE 02 BD 7D B7 C6 CB 75 FA B4 DE 79 67 C0 1E CF D6 FC 02 55 27 87 BB E5 70 43 F8 C5 74 98 46 3D 8D EB 69 A4 D8 F4 AB 15 18 C6 07 B7 CA 85 9A 4C 59 87 DF CD A7 A3 10 C8 7A 4C 33 47 63 88 21 F9 AC D6 2B 2D 5E AE F5 C3 38 FE 6D 36 3E 95 4E 55 73 59 F6 F6 4B 2D 1E B3 6A DB C9 6A AD 7C 9A D6 96 7B 2D 9D AD 6A 77 AF 96 EA 67 69 BC F6 6A 76 AD AE CF 65 B2 D5 8B 36 7E 02 9E CB 55 73 EC 1A 85 6B 05 A0 8B AC 32 D6 95 8A 5E E3 71 EE DD 23 F5 AD 95 BF 9B 5F AE AC DA BC F6 7E 5E B5 9E D3 D8 13 1C 62 EE 6C 2D A6 21 98 D8 CD 30 FB 75 8B 8C 63 73 F0 E5 62 CD 63 2C F6 5B 46 2A D0 F6 88 62 BB C3 1B C8 13 DD DF 12 8C 42 A4 30 57 BF 8A 42 DF 86 79 BC 70 49 CF AB DD EF F8 7C 7E 5F 3F A7 D7 ED F7 FC 7E 7F 5F BF E7 F7 FD FF 80 20 18 0A 03 81 20 58 1A 07 82 20 98 2A 0B 83 20 D8 3A 0F 84 21 18 49 EE Old data:	success or wait	615502113
Windows hook set	Module: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE TID: 1768 Hook ID: FFFFFFFF	success	615503530
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows Name: Device	success or wait	615503933
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices Name: Microsoft XPS Document Writer	success or wait	615504447
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: ScreenReaderPresent	object name not found	615505036
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Messaging Subsystem Name: MAPIX	object name not found	615505918
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Messaging Subsystem Name: MAPIX	object name not found	615506245
File opened	Path: C:\WINDOWS\system32\rpcss.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615507231
Section loaded	Path: C:\WINDOWS\system32\rpcss.dll Access: write and read and execute Type: commit Baseaddress: CF0000 Size: 401408 Protection: execute Mapped to pid: own pid	success or wait	615507999
System info queried	Type: BasicInformation	success or wait	615509833
System info queried	Type: BasicInformation	success or wait	615510033
System info queried	Type: BasicInformation	success or wait	615510249
Window created	Window Name: IPTR Class Name: IPTR HWND: 4014A	success	615534680
Message sent	HWND: 4014A Message: NCCREATE WParam: 0 LParam: 1239144	success	615534937
Message sent	HWND: 4014A Message: NCCALCSIZE WParam: 0 LParam: 1239184	error	615535165
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoRereg	object name not found	615535472
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 Name: NULL	success or wait	615536792
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	615537186
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	615538046
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	615538242
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	615538628
File opened	Path: C:\Program Files\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	615539833
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	615540998
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document\CurVer Name: NULL	success or wait	615541699
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: GlobalDotName	object name not found	615542175
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	615543724
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	615545985
Section loaded	Path: \KnownDlls\SHELL32.dll Access: write and read and execute Type: unknown Baseaddress: 7C9C0000 Size: 8482816 Protection: read write Mapped to pid: own pid	success or wait	615550751
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	615552098
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	615552590
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	615552842
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	615553120
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	615553372
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	615553794
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	615554043
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	615554302
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	615554603
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	615554860
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	615555112
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	615555362
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	615555611
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	615555988
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	615556237
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	615556768
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	615558745
File opened	Path: C:\WINDOWS\system32\SHELL32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615560115
Section loaded	Path: C:\WINDOWS\system32\shell32.dll Access: read Type: commit Baseaddress: CF0000 Size: 8462336 Protection: readonly Mapped to pid: own pid	success or wait	615561446
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	615562197
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	615563283
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	615603005
Section loaded	Path: \KnownDlls\comctl32.dll Access: write and read and execute Type: unknown Baseaddress: 5D090000 Size: 630784 Protection: read write Mapped to pid: own pid	success or wait	615604650
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615606017
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615606453
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615606797
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615607112
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615607401
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615607730
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615608066
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615608347
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	615608632
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	615609023
System info queried	Type: BasicInformation	success or wait	615609935
File opened	Path: C:\WINDOWS\system32\comctl32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	615612719
Section loaded	Path: C:\WINDOWS\system32\comctl32.dll Access: read Type: commit Baseaddress: CF0000 Size: 618496 Protection: readonly Mapped to pid: own pid	success or wait	615613545
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	615614394
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	615615411
Process information queried	PID: 1160 Info Class: SessionInformation	success or wait	615621175
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	615622364
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ScriptAnchorVis	object name not found	615633776
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools Name: FormatConsistencyWavyUnderlineColor	object name not found	615634806
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: GlobalDotName	object name not found	615666016
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	615667385
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	615669263
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Name:	object name not found	615675711
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Name: Type: binary Data: 05 14 02 00 88 04 00 00 04 00 00 00 00 00 00 00 BE 00 00 00 01 00 00 00 B6 00 00 00 57 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 41 00 70 00 70 00 6C 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20 00 44 00 61 00 74 00 61 00 5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 5C 00 54 00 65 00 6D 00 70 00 6C 00 61 00 74 00 65 00 73 00 5C 00 4E 00 6F 00 72 00 6D 00 61 00 6C 00 2E 00 64 00 6F 00 74 00 00 00 00 00 00 00 Old data:	success or wait	615676216
Section loaded	Path: \BaseNamedObjects\DfSharedHeap35EFC Access: query and write and read Type: reserve Baseaddress: DA0000 Size: 4194304 Protection: read write Mapped to pid: own pid	success or wait	615679239
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dot Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: null	success or wait	615680778
System info queried	Type: PerformanceInformation	success or wait	615681738
Process information queried	PID: 1160 Info Class: QuotaLimits	success or wait	615682534
Process information queried	PID: 1160 Info Class: VmCounters	success or wait	615682754
Section loaded	Path: \BaseNamedObjects\DFMap0-220928 Access: query and write and read Type: commit Baseaddress: D10000 Size: 524288 Protection: read write Mapped to pid: own pid	success or wait	615683012
Section loaded	Path: \BaseNamedObjects\DfRoot000035EFC Access: query and write and read Type: commit Baseaddress: 11A0000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	615688234
File created	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF5F05.tmp Access: read attributes and delete and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and delete on close Attributes: temporary Content Overwritten: null	success or wait	615690610
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF5F05.tmp New path: Disposition: PositionInformation Data : Offset: 512	success or wait	615699064
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF5F05.tmp New path: Disposition: EndOfFileInformation Data : unknown	success or wait	615699288
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF5F05.tmp New path: Disposition: AllocationInformation Data : unknown	success or wait	615702945
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF5F05.tmp New path: Disposition: PositionInformation Data : Offset: 0	success or wait	615703737
System info queried	Type: PerformanceInformation	success or wait	615703929
Process information queried	PID: 1160 Info Class: QuotaLimits	success or wait	615704360
Process information queried	PID: 1160 Info Class: VmCounters	success or wait	615704571
Section loaded	Path: \BaseNamedObjects\DFMap0-220944 Access: query and write and read Type: commit Baseaddress: 11B0000 Size: 524288 Protection: read write Mapped to pid: own pid	success or wait	615704906
File created	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dot Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: hidden Content Overwritten: null	success or wait	615711576
File write	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dot Offset: unknown Length: 54 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	615715203
File write	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dot Offset: unknown Length: 108 Value: 00 00 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 48 00 00 00 00 00 3E 00 02 02 00 00 06 00 09 00 34 00 00 00 00 00 90 00 90 00 00 00 00 00 0F 00 00 00 FF FF FF 00 00 00 00 00 00 00 14 00 14 00 00 00 00 00 00 00 02 63 78 00 C8 00 00 00 00 00 14 00 00 00 00 00 90 00 90 00 80 00 16 00 00 00	success or wait	615716383
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Cache	success or wait	615738846
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cache Type: unicode Data: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files Old data:	success or wait	615740969
File opened	Path: C:\Program Files\AutoIt3\:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word Access: read attributes and delete Options: non directory file and open for backup ident and open reparse point Overwritten: false	object name invalid	615744056
File created	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Attributes: normal Content Overwritten: null	success or wait	615744728
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	615747908
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and archive and temporary and sparse file	success or wait	615748785
File created	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRS0000.tmp Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: null	success or wait	615751599
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Keyname:	success or wait	615757640
Window created	Window Name: _WwC Class Name: _WwC HWND: 40134	success	615761522
Message sent	HWND: 40134 Message: NCCREATE WParam: 0 LParam: 1238664	success	615761779
Window shown	HWND: 40134 CMD: show normal	error	615762195
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF Name: Disable Thread Input Manager	object name not found	615762905
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000409\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} Name: Enable	success or wait	615763654
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000807\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} Name: Enable	success or wait	615764560
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} Name: Enable	success or wait	615765801
Window created	Window Name: IPTR Class Name: IPTR HWND: 40138	success	615791342
Message sent	HWND: 40138 Message: NCCREATE WParam: 0 LParam: 1238952	success	615791608
Message sent	HWND: 40138 Message: NCCALCSIZE WParam: 0 LParam: 1238992	error	615791846
Window created	Window Name: IPTR Class Name: IPTR HWND: 3011C	success	615816462
Message sent	HWND: 40138 Message: NCCREATE WParam: 0 LParam: 1238952	success	615816715
Message sent	HWND: 40138 Message: NCCALCSIZE WParam: 0 LParam: 1238992	error	615816949
Window created	Window Name: IPTR Class Name: IPTR HWND: 800F4	success	615841139
Message sent	HWND: 40138 Message: NCCREATE WParam: 0 LParam: 1238952	success	615841336
Message sent	HWND: 40138 Message: NCCALCSIZE WParam: 0 LParam: 1238992	error	615841569
Window created	Window Name: IPTR Class Name: IPTR HWND: 5010A	success	615865728
Message sent	HWND: 40138 Message: NCCREATE WParam: 0 LParam: 1238952	success	615865925
Message sent	HWND: 40138 Message: NCCALCSIZE WParam: 0 LParam: 1238992	error	615866302
Window created	Window Name: IPTR Class Name: IPTR HWND: 50108	success	615890024
Message sent	HWND: 50108 Message: NCCREATE WParam: 0 LParam: 1237660	success	615890290
Message sent	HWND: 50108 Message: NCCALCSIZE WParam: 0 LParam: 1237700	error	615890661
Message sent	HWND: 50108 Message: SETTEXT WParam: 0 LParam: 8912904	success	615896987
Window created	Window Name: IPTR Class Name: IPTR HWND: 400E0	success	615922751
Message sent	HWND: 50108 Message: NCCREATE WParam: 0 LParam: 1237660	success	615923213
Message sent	HWND: 50108 Message: NCCALCSIZE WParam: 0 LParam: 1237700	error	615923443
Message sent	HWND: 50108 Message: SETTEXT WParam: 0 LParam: 8912904	success	615923743
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 00000409	success or wait	615929343
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	615930805
Window created	Window Name: IPTR Class Name: IPTR HWND: 400E8	success	615956173
Message sent	HWND: 50108 Message: NCCREATE WParam: 0 LParam: 1237660	success	615956404
Message sent	HWND: 50108 Message: NCCALCSIZE WParam: 0 LParam: 1237700	error	615956771
Message sent	HWND: 50108 Message: SETTEXT WParam: 0 LParam: 8912904	success	615957077
Message sent	HWND: 5010A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240492	error	615958825
Message sent	HWND: 5010A Message: NCCALCSIZE WParam: 1 LParam: 1240448	error	615959098
Message sent	HWND: 5010A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240492	error	615959317
Message sent	HWND: 5010A Message: NCCALCSIZE WParam: 1 LParam: 1240448	error	615959532
Message sent	HWND: 5010A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240492	error	615959744
Message sent	HWND: 5010A Message: NCCALCSIZE WParam: 1 LParam: 1240448	error	615959955
Message sent	HWND: 5010A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240492	error	615960170
Message sent	HWND: 5010A Message: NCCALCSIZE WParam: 1 LParam: 1240448	error	615960383
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	616024400
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	616024908
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	616056867
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: ProInfo	success or wait	616057368
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail Name: NULL	success or wait	616063298
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Outlook Express\Envelope\CLSID Name: NULL	success or wait	616063772
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	616087610
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	616157424
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	616157973
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: ProInfo	success or wait	616161023
Message sent	HWND: 400E8 Message: NCCALCSIZE WParam: 1 LParam: 1240312	error	616161943
Message sent	HWND: 50108 Message: NCCALCSIZE WParam: 1 LParam: 1240368	error	616165173
Message sent	HWND: 50108 Message: NCCALCSIZE WParam: 1 LParam: 1240368	error	616165404
Message sent	HWND: 40134 Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240240	error	616166064
Message sent	HWND: 5010A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240328	error	616169590
Message sent	HWND: 5010A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240328	error	616169818
Message sent	HWND: 3011C Message: NCCALCSIZE WParam: 1 LParam: 1240284	error	616170041
Message sent	HWND: 5010A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240328	error	616171359
Message sent	HWND: 3011C Message: NCCALCSIZE WParam: 1 LParam: 1240284	error	616171582
Message sent	HWND: 5010A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240328	error	616171806
Message sent	HWND: 3011C Message: NCCALCSIZE WParam: 1 LParam: 1240284	error	616173826
Window shown	HWND: 3011C CMD: show no activate	error	616174333
Window shown	HWND: 3011C CMD: show no activate	success	616174508
Window created	Window Name: _WwF Class Name: _WwF HWND: 90058	success	616180241
Message sent	HWND: 90058 Message: NCCREATE WParam: 0 LParam: 1238704	success	616180531
Message sent	HWND: 90058 Message: NCCALCSIZE WParam: 0 LParam: 1238756	error	616180757
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseAlternateForegroundWindowDetectionMethod	object name not found	616182598
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseSpaceAsTextDelimiter	object name not found	616182934
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AlternateTableHeightLayout	object name not found	616183310
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AdjustSdtCaSmart	object name not found	616185006
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: MMDataSrcHeuristic	object name not found	616188014
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DontJumpForegroundInDDEExec	object name not found	616188345
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DisableODSOUIInDataSrc	object name not found	616188668
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseTempCopyForNonLocDoc	object name not found	616190366
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: KeepUISpecModeAtVbaEnd	object name not found	616190744
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseAlternatePageNumberFormat	object name not found	616191142
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DontUpdateSmartDocAtInsert	object name not found	616192778
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ShowFileNameOnlyInIconCaption	object name not found	616193569
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AlternateStyleCopyPasteNoOverwrite	object name not found	616193890
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DontShowDocActionsPaneAtOpen	object name not found	616195129
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FastTableRenderOnIMETS	object name not found	616195460
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: MntrSynchronize1stTabCell	object name not found	616195782
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoLinkBltinCharStyles	object name not found	616196264
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoDocChangeEventOnStoryRange	object name not found	616196586
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: TreatLocationReferenceAsLocal	object name not found	616196958
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ForceSetCopyCount	object name not found	616198053
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ListDefaultDictForAllLanFirst	object name not found	616198378
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: MailMergeFastSetPrintOrient	object name not found	616198693
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: SuppressPrinterIconEnum	object name not found	616199749
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoActivateOleLinkObjAtOpen	object name not found	616200072
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: CheckDupAddin4ShellLoad	object name not found	616200389
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: CleanupOldHyphBeforeHyphenate	object name not found	616201543
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: KeepDocActPaneWhileInReviewPane	object name not found	616201868
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FireSelChangeEventInTableCell	object name not found	616202284
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UpdateHdrFtrOnVBAFldUpdate	object name not found	616202669
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ForceUpdateToolbarAtInit	object name not found	616202988
Window shown	HWND: 5012E CMD: show maximized	error	616203283
Message sent	HWND: 5012E Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240708	error	616203496
Message sent	HWND: 5012E Message: NCCALCSIZE WParam: 1 LParam: 1240664	error	616213035
Foreground Window Got	HWND: 0	error	616239855
Message posted	HWND: 5012E Message: D00 WParam: 37 LParam: 0	success	616241903
Foreground Window Got	HWND: 5012E	success	616242077
Windows found	Window Name: NULL Class Name: MSOBALLOON HWND: 0	error	616242285
Windows found	Window Name: NULL Class Name: MsoHelp10 HWND: 0	error	616242498
Windows found	Window Name: NULL Class Name: AgentAnim HWND: 0	error	616242706
Message sent	HWND: 5012E Message: NCACTIVATE WParam: 1 LParam: 0	success	616242945
Message posted	HWND: 5012E Message: D00 WParam: 37 LParam: 0	success	616244005
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\riched20.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616255091
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\RICHED20.DLL Access: write and read and execute Type: commit Baseaddress: 1240000 Size: 1105920 Protection: execute Mapped to pid: own pid	success or wait	616255960
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\riched20.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616257851
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\RICHED20.DLL Access: query and write and read and execute Type: image Baseaddress: 39700000 Size: 1097728 Protection: read write Mapped to pid: own pid	success or wait	616258692
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	616260852
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	616261355
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	616261609
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	616261915
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	616262169
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	616262510
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	616262763
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	616263225
System info queried	Type: BasicInformation	success or wait	616263877
Section loaded	Path: \KnownDlls\OLEAUT32.dll Access: write and read and execute Type: unknown Baseaddress: 77120000 Size: 569344 Protection: read write Mapped to pid: own pid	success or wait	616265195
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616266375
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616282640
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616282897
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616283202
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616283451
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616283814
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616284058
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616284322
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616284564
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616284817
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616286131
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616286563
Message posted	TID: 6E8 Message: C087 WParam: 17 LParam: 327982	success	616287700
Window created	Window Name: MSCTFIME UI Class Name: MSCTFIME UI HWND: 400FA	success	616289003
Message sent	HWND: 400FA Message: NCCREATE WParam: 0 LParam: 1234616	success	616290408
Message sent	HWND: 400FA Message: NCCALCSIZE WParam: 0 LParam: 1234656	error	616291247
File opened	Path: C:\WINDOWS\system32\Msimtf.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616291981
Section loaded	Path: C:\WINDOWS\system32\msimtf.dll Access: write and read and execute Type: commit Baseaddress: 1300000 Size: 159744 Protection: execute Mapped to pid: own pid	success or wait	616306050
Foreground Window Got	HWND: 5012E	success	616308358
File opened	Path: C:\WINDOWS\system32\Msimtf.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616309199
Section loaded	Path: C:\WINDOWS\system32\msimtf.dll Access: write and read and execute Type: commit Baseaddress: 1300000 Size: 159744 Protection: execute Mapped to pid: own pid	success or wait	616310071
File opened	Path: C:\WINDOWS\system32\Msimtf.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616315914
Section loaded	Path: C:\WINDOWS\system32\msimtf.dll Access: write and read and execute Type: commit Baseaddress: 1300000 Size: 159744 Protection: execute Mapped to pid: own pid	success or wait	616316854
File opened	Path: C:\WINDOWS\system32\Msimtf.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616319381
Section loaded	Path: C:\WINDOWS\system32\msimtf.dll Access: write and read and execute Type: commit Baseaddress: 1300000 Size: 159744 Protection: execute Mapped to pid: own pid	success or wait	616320290
Foreground Window Got	HWND: 5012E	success	616325024
Windows found	Window Name: NULL Class Name: Shell_TrayWnd HWND: 1005E	success	616325488
Windows enumerated	Desktop: 0 Parent: 1005E Enum Children: true TID: 0 HWNDs: 10064, 10066, 10068, 1006A, 1006C, 1006E, 10078, 10084, 10088, 1, 88000000, 88000000, 88000000, 88000000, 88000000	success or wait	616325703
Message posted	TID: 61C Message: C087 WParam: 1 LParam: 0	success	616326189
Message posted	TID: 6E8 Message: C087 WParam: 0 LParam: 0	success	616326569
Section loaded	Path: \BaseNamedObjects\CTF.AsmListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read and execute and extend size Type: unknown Baseaddress: 1300000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	616327354
Window created	Window Name: CicMarshalWndClass Class Name: CicMarshalWndClass HWND: A0118	success	616340296
Message sent	HWND: A0118 Message: NCCREATE WParam: 0 LParam: 1238464	success	616340577
Message sent	HWND: A0118 Message: NCCALCSIZE WParam: 0 LParam: 1238528	error	616340824
Message posted	TID: 7DC Message: C088 WParam: 0 LParam: 0	success	616341211
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	616342348
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	616343552
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	616349609
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	616350145
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	616350382
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	616350727
Foreground Window Got	HWND: 5012E	success	616351306
System info queried	Type: BasicInformation	success or wait	616351773
System info queried	Type: ProcessorInformation	success or wait	616352019
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: AddIns	success or wait	616358148
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Word\Addins\WebPage.Connect Name: LoadBehavior	success or wait	616359281
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: Com+Enabled	success or wait	616359896
Section loaded	Path: \KnownDlls\CLBCATQ.DLL Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	616360465
File opened	Path: C:\WINDOWS\system32\CLBCATQ.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616362318
Section loaded	Path: C:\WINDOWS\system32\clbcatq.dll Access: query and write and read and execute Type: image Baseaddress: 76FD0000 Size: 520192 Protection: read write Mapped to pid: own pid	success or wait	616363103
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616364896
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616365403
Section loaded	Path: \KnownDlls\COMRes.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	616365709
File opened	Path: C:\WINDOWS\system32\COMRes.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616366469
Section loaded	Path: C:\WINDOWS\system32\comres.dll Access: query and write and read and execute Type: image Baseaddress: 77050000 Size: 806912 Protection: read write Mapped to pid: own pid	success or wait	616367381
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77051000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616369137
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77051000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616369490
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616369761
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616370188
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616370454
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616389046
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616389325
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616389589
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616389853
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616390121
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616390390
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616390702
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: MinimumFreeMemPercentageToCreateProcess	object name not found	616392684
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: MinimumFreeMemPercentageToCreateObject	object name not found	616393057
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	616394889
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: Com+Enabled	success or wait	616395247
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	616398146
System info queried	Type: BasicInformation	success or wait	616399075
System info queried	Type: ProcessorInformation	success or wait	616399293
File opened	Path: C:\WINDOWS\Registration\R000000000007.clb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: null	success or wait	616409692
File other op	Path: C:\WINDOWS\Registration\R000000000007.clb New path: Disposition: PositionInformation Data : Offset: 22512	success or wait	616410524
File other op	Path: C:\WINDOWS\Registration\R000000000007.clb New path: Disposition: PositionInformation Data : Offset: 0	success or wait	616411175
File read	Path: C:\WINDOWS\Registration\R000000000007.clb Offset: unknown Length: 22512 Value: 43 4F 4D 2B 01 00 00 00 01 00 12 00 24 00 00 00 00 01 01 00 63 00 00 00 00 00 00 01 01 00 00 00 00 01 10 00 00 00 00 00 C0 00 00 00 00 00 00 46 0E 00 00 00 30 01 00 00 A0 03 00 00 33 5F 30 00 D0 04 00 00 0C 00 00 00 33 5F 31 00 DC 04 00 00 88 02 00 00 33 5F 32 00 64 07 00 00 3C 00 00 00 33 5F 33 00	success or wait	616411386
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Word\Addins\WebPage.Connect Name: FileName	object name not found	616428783
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Word\Addins\WordEEFonts.Connect Name: LoadBehavior	success or wait	616429720
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	616430205
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Word\Addins\WordEEFonts.Connect Name: FileName	object name not found	616430803
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF Name: Disable Thread Input Manager	object name not found	616431770
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d} Name: Enable	success or wait	616433570
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000409\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} Name: Enable	success or wait	616434822
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000807\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} Name: Enable	success or wait	616435711
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} Name: Enable	success or wait	616437433
Window destroyed	HWND: 40136	success	616439628
Windows enumerated	Desktop: 0 Parent: 0 Enum Children: false TID: 6E8 HWNDs: 40136, 5012E, 30154, 400FA, 40132, 1, 10078, 10084, 10088, 1, 88000000, 88000000, 88000000, 88000000, 88000000	success or wait	616439797
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	616440249
Window shown	HWND: 40134 CMD: show normal	success	616446590
Message sent	HWND: 5012E Message: SETICON WParam: 1 LParam: 197243	error	616451498
Message sent	HWND: 5012E Message: SETICON WParam: 0 LParam: 197151	error	616454393
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: QuickPreview	object name not found	616455491
Window shown	HWND: 40134 CMD: show normal	success	616455795
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Local AppData	success or wait	616458408
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Local AppData Type: unicode Data: C:\Documents and Settings\Administrator\Local Settings\Application Data Old data:	success or wait	616460268
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Schemas\MS Word_restart.xml Access: read attributes and delete Options: non directory file and open for backup ident and open reparse point Overwritten: false	object path not found	616461003
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: STARTUP-PATH	object name not found	616461960
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: Startup	success or wait	616463240
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Word\STARTUP\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	616470135
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\STARTUP\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	616471769
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: VolumePref	object name not found	616474285
Process information queried	PID: 1160 Info Class: Times	success or wait	616474604
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Keyname: y	success or wait	616475025
Key deleted	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	success or wait	616476084
Key deleted	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency	success or wait	616479118
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FirstRun	object name not found	616479844
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: FirstRun	success or wait	616481561
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FirstRun	object name not found	616481950
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FirstRun Type: dword Data: 0 Old data:	success or wait	616482275
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\UserInfo Name: UserName	success or wait	616484820
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\UserInfo Name: UserInitials	success or wait	616485142
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\UserInfo Name: Company	success or wait	616485475
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Wizards Name: Assistant Time Stamp	object name not found	616489049
Mutant created	Name: \BaseNamedObjects\OfficeAssistantStateMutex	success or wait	616489428
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Assistant Name: AsstState	object name not found	616490261
System info queried	Type: PerformanceInformation	success or wait	616490698
Process information queried	PID: 1160 Info Class: QuotaLimits	success or wait	616491092
Process information queried	PID: 1160 Info Class: VmCounters	success or wait	616491291
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\Common\Assistant Name: CurrAsstState Type: dword Data: 38 Old data:	success or wait	616491530
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: ScreenReaderPresent	object name not found	616493869
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	616501058
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	616501745
System info queried	Type: BasicInformation	success or wait	616502372
System info queried	Type: ProcessorInformation	success or wait	616504688
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1F4E726-8CF1-11D1-BF92-0060081ED811}\LocalServer32 Name: LocalServer32	object name not found	616508589
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1F4E726-8CF1-11D1-BF92-0060081ED811}\LocalServer32 Name: NULL	success or wait	616511109
Process information queried	PID: 1160 Info Class: SessionInformation	success or wait	616512668
System info queried	Type: BasicInformation	success or wait	616514924
File opened	Path: C:\WINDOWS\system32\winlogon.exe Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616515914
Section loaded	Path: C:\WINDOWS\system32\winlogon.exe Access: write and read and execute Type: commit Baseaddress: 1330000 Size: 507904 Protection: execute Mapped to pid: own pid	success or wait	616518917
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: MaximumAllowedAllocationSize	object name not found	616524523
Section loaded	Path: \KnownDlls\xpsp2res.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	616525430
File opened	Path: C:\WINDOWS\system32\xpsp2res.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616526172
Section loaded	Path: C:\WINDOWS\system32\xpsp2res.dll Access: query and write and read and execute Type: image Baseaddress: 1330000 Size: 2904064 Protection: read write Mapped to pid: own pid	conflicting addresses	616526974
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: DefaultAccessPermission	object name not found	616529503
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	616530602
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: null	success or wait	616531765
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	616532642
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	616532978
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	616533367
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 21 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	616534090
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	616535155
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........t.......\.....9............B..$...d..................................CF..w.tC..2............................	pending	616536718
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,..........................B..$...d.	pending	616537976
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	616541192
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 16FE000 Length: 1000 New Protection: page read and write and page guard New Protection: page read and write	success or wait	616542761
Thread created	PID: 1160 TID: 1824 EIP: 7C8106F9 EAX: 77E76C7D Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	616543757
Thread resumed	TID: 1824 PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	616544573
Memory attributes changed	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 17FE000 Length: 1000 New Protection: page read and write and page guard New Protection: page read and write	success or wait	616550397
Thread created	PID: 1160 TID: 1876 EIP: 7C8106F9 EAX: 774FE4DF Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	616551382
Thread resumed	TID: 1876 PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	616552192
Thread delayed	Time: -60 TID: 1876	user apc	616557048
Message sent	HWND: 5012E Message: GETICON WParam: 2 LParam: 0	success	616569363
Message sent	HWND: 5012E Message: GETICON WParam: 0 LParam: 0	success	616572792
Message sent	HWND: 5012E Message: GETICON WParam: 1 LParam: 0	success	616573368
Message sent	HWND: 5012E Message: GETICON WParam: 2 LParam: 0	success	616849432
Thread created	PID: 1160 TID: 1788 EIP: 7C8106F9 EAX: 77E76C7D Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	618879093
Thread resumed	TID: 1788 PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	618879879
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5EB2502A-8CF1-11D1-BF92-0060081ED811}\ProxyStubClsid32 Name: NULL	success or wait	618881460
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	618882473
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	618883299
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32 Name: InprocServer32	object name not found	618885514
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32 Name: NULL	success or wait	618893990
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145} Name: AppID	object name not found	618896350
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	618897996
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	618902532
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32 Name: InprocServer32	object name not found	618904768
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32 Name: NULL	success or wait	618906877
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145} Name: AppID	object name not found	618912839
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32 Name: ThreadingModel	success or wait	618915610
File opened	Path: C:\WINDOWS\system32\sti.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	618916774
Section loaded	Path: C:\WINDOWS\system32\sti.dll Access: write and read and execute Type: commit Baseaddress: 1900000 Size: 69632 Protection: execute Mapped to pid: own pid	success or wait	618917643
File opened	Path: C:\WINDOWS\system32\sti.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	618919662
Section loaded	Path: C:\WINDOWS\system32\sti.dll Access: query and write and read and execute Type: image Baseaddress: 73BA0000 Size: 77824 Protection: read write Mapped to pid: own pid	success or wait	618922665
Section loaded	Path: \KnownDlls\CFGMGR32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	618925381
File opened	Path: C:\WINDOWS\system32\CFGMGR32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	619003541
Section loaded	Path: C:\WINDOWS\system32\cfgmgr32.dll Access: query and write and read and execute Type: image Baseaddress: 74AE0000 Size: 28672 Protection: read write Mapped to pid: own pid	success or wait	619004414
Section loaded	Path: \KnownDlls\setupapi.DLL Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	619006463
File opened	Path: C:\WINDOWS\system32\setupapi.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	619007007
Section loaded	Path: C:\WINDOWS\system32\setupapi.dll Access: query and write and read and execute Type: image Baseaddress: 77920000 Size: 995328 Protection: read write Mapped to pid: own pid	success or wait	619007934
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	619018561
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	619018988
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\PnP Name: seed	success or wait	619019831
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: OsLoaderPath	success or wait	619020680
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: OsLoaderPath	success or wait	619021168
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemPartition	success or wait	619022014
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemPartition	success or wait	619022461
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: SourcePath	success or wait	619023297
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: SourcePath	success or wait	619023746
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackSourcePath	success or wait	619024552
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackSourcePath	success or wait	619025000
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackCachePath	success or wait	619025885
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackCachePath	success or wait	619026384
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: DriverCachePath	success or wait	619027250
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: DriverCachePath	success or wait	619027692
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: DevicePath	success or wait	619028505
Mutant created	Name: unknown	success or wait	619029239
Mutant created	Name: unknown	success or wait	619029594
Mutant created	Name: unknown	success or wait	619029914
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogLevel	success or wait	619030332
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogLevel	success or wait	619030777
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogPath	object name not found	619031276
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	619032334
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Hostname	success or wait	619033208
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Domain	success or wait	619034080
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: MaxSize	object name not found	619035490
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: Level	object name not found	619035935
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: Mode	object name not found	619036365
File opened	Path: C:\WINDOWS\Sti_Trace.log Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: null	success or wait	619036827
File other op	Path: C:\WINDOWS\Sti_Trace.log New path: Disposition: PositionInformation Data : Offset: 0	success or wait	619037563
Mutant created	Name: \BaseNamedObjects\StiTraceMutexSti_Trace.log	access denied	619038119
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1F4E726-8CF1-11D1-BF92-0060081ED811} Name: InsecureQI	object name not found	619422801
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: null	success or wait	619423826
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	619424778
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	619425164
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	619425605
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 24 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 48 00 41 00 4E 00 55 00 45 00 4C 00 45 00 2D 00 42 00 43 00 36 00 30 00 37 00 32 00 30 00 52 00	success or wait	619427453
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	619428468
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ................p.....D..........."M...#............&.(.................N.T. .A.U.T.H.O.R.I.T.Y.\.S.Y.S.T.E.M...........................	pending	619430273
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,........................."M...#....	pending	619431275
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	619435776
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ................p.....D.........u..C..-f.F..........&.(.................N.T. .A.U.T.H.O.R.I.T.Y.\.S.Y.S.T.E.M...........................	pending	619437330
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,.......................u..C..-f.F..	pending	619438311
Process information queried	PID: 1160 Info Class: Times	success or wait	619554026
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common Name: QMEnable	success or wait	619554352
Message posted	HWND: 5012E Message: 45F WParam: 0 LParam: 0	success	619554796
Foreground Window Got	HWND: 5012E	success	619555353
Message posted	TID: 7DC Message: C088 WParam: 0 LParam: 0	success	619555740
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	619562345
Window created	Window Name: _WwB Class Name: _WwB HWND: 80040	success	619573385
Message sent	HWND: 80040 Message: NCCREATE WParam: 0 LParam: 1237124	success	619573674
Message sent	HWND: 80040 Message: NCCALCSIZE WParam: 0 LParam: 1237164	error	619573959
Message sent	HWND: 50136 Message: DDE_ACK WParam: 524352 LParam: 3221864481	success	619574288
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	619578793
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	619579151
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	619579500
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	619580997
Message posted	TID: 7DC Message: C0C3 WParam: 0 LParam: 1768	success	619581993
Message posted	TID: 7DC Message: C0C3 WParam: 0 LParam: 1768	success	619583345
Message posted	TID: 7DC Message: C0C3 WParam: 0 LParam: 1768	success	619585401
Message posted	TID: 7DC Message: C0C3 WParam: 0 LParam: 1768	success	619588442
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG..LMIJC Access: query and write and read Type: commit Baseaddress: 1900000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	619589414
Message sent	HWND: 5012E Message: 88 WParam: 4 LParam: 0	error	619592198
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	619592384
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	619593543
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	619600004
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	619600312
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	619601132
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	619601412
Mutant created	Name: \BaseNamedObjects\MSCTF.Shared.MUTEX.MNH	object name exists	619606754
Section loaded	Path: \BaseNamedObjects\MSCTF.Shared.SFM.MNH Access: query and write and read and execute and extend size Type: unknown Baseaddress: 1910000 Size: 524288 Protection: read write Mapped to pid: own pid	success or wait	619607200
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG.B.LNIJC Access: query and write and read Type: commit Baseaddress: 1900000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	619608760
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG.C.LNIJC Access: query and write and read Type: commit Baseaddress: 1990000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	619609466
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG.D.LNIJC Access: query and write and read Type: commit Baseaddress: 19A0000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	619610187
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG.E.LNIJC Access: query and write and read Type: commit Baseaddress: 1900000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	619615802
Message sent	HWND: 5012E Message: PAINT WParam: 0 LParam: 0	error	619619975
Message sent	HWND: 90058 Message: PAINT WParam: 0 LParam: 0	error	619622208
Message sent	HWND: 90058 Message: PAINT WParam: 0 LParam: 0	error	619622486
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19521108172 Access: query and write and read and execute and extend size Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	619632632
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19521108172 Access: query and write and read Type: reserve Baseaddress: 19B0000 Size: 126976 Protection: read write Mapped to pid: own pid	success or wait	619632878
Mutant created	Name: \BaseNamedObjects\Local\Mso97SharedDg19521108172Mutex	success or wait	619633670
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG.F.KOIJC Access: query and write and read Type: commit Baseaddress: 1900000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	619688086
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.IOG.G.KOIJC Access: query and write and read Type: commit Baseaddress: 1900000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	619691693
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MNH.CB.KPIJC Access: query and write and read and execute and extend size Type: unknown Baseaddress: 1900000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	619719769
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MNH.DB.KPIJC Access: query and write and read and execute and extend size Type: unknown Baseaddress: 1900000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	619720827
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MNH.EB.KPIJC Access: query and write and read and execute and extend size Type: unknown Baseaddress: 1900000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	619722526
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19521108172 Access: query and write and read and execute and extend size Type: unknown Baseaddress: 1990000 Size: 126976 Protection: read write Mapped to pid: own pid	success or wait	619740946
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19531108172 Access: query and write and read and execute and extend size Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	619742602
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19531108172 Access: query and write and read Type: reserve Baseaddress: 1990000 Size: 126976 Protection: read write Mapped to pid: own pid	success or wait	619742897
Mutant created	Name: \BaseNamedObjects\Local\Mso97SharedDg19531108172Mutex	success or wait	619744645
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	619767341
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	619767536
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	619771775
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	619775486
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	619775913
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: ProInfo	success or wait	619776394
Foreground Window Got	HWND: 5012E	success	619793558
Foreground Window Got	HWND: 5012E	success	619793750
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	619802998
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: NoTrack	object name not found	619804187
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoNetHood	object name not found	619805670
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoNetHood	object name not found	619806383
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoPropertiesMyComputer	object name not found	619807058
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoPropertiesMyComputer	object name not found	619808497
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoInternetIcon	object name not found	619809169
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoInternetIcon	object name not found	619809798
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoCommonGroups	object name not found	619810962
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoCommonGroups	object name not found	619813077
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Desktop	success or wait	619814906
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Desktop Type: unicode Data: C:\Documents and Settings\Administrator\Desktop Old data:	success or wait	619817084
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoControlPanel	object name not found	619818893
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoControlPanel	object name not found	619819705
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoSetFolders	object name not found	619820552
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoSetFolders	object name not found	619823770
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Name: NULL	success or wait	619825009
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619825911
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	619826807
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........j.......R............{....}K.>\.....*.,.................S.e.L.o.a.d.D.r.i.v.e.r.P.r.i.v.i.l.e.g.e.	pending	619828377
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,....................{....}K.>\.....	pending	619829394
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	619830382
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........b.......J...........!..:."fO........".$.................S.e.U.n.d.o.c.k.P.r.i.v.i.l.e.g.e.	pending	619831771
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,...................!..:."fO........	pending	619832688
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	619833537
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	619840933
File opened	Path: IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	619848177
File opened	Path: IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	619850742
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	619853818
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f} Name: Data	buffer overflow	619859989
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f} Name: Data	success or wait	619861869
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f} Name: Generation	success or wait	619863439
File opened	Path: STORAGE#Volume#1&30a96598&0&SignatureF4ACF4ACOffset7E00Length3BFEFCE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	619864161
File opened	Path: STORAGE#Volume#1&30a96598&0&SignatureF4ACF4ACOffset7E00Length3BFEFCE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	619865858
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	619868066
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Data	buffer overflow	619872258
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Data	success or wait	619872723
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	619874298
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	619874994
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	619879691
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: BaseClass Type: unicode Data: Drive Old data:	success or wait	619884674
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	619885231
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	619889776
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{811e0202-1746-11df-8a4d-806d6172696f} Name: BaseClass Type: unicode Data: Drive Old data:	success or wait	619894947
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619895438
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619895742
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619896030
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	619896858
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	619897529
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: DontShowSuperHidden	object name not found	619900785
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: DontShowSuperHidden	object name not found	619902100
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer Name: ShellState	success or wait	619903061
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer Name: ShellState	success or wait	619903494
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: ForceActiveDesktopOn	object name not found	619904316
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: ForceActiveDesktopOn	object name not found	619905121
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoActiveDesktop	object name not found	619906015
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoActiveDesktop	object name not found	619906819
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoWebView	object name not found	619907737
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoWebView	object name not found	619908547
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: ClassicShell	object name not found	619909387
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: ClassicShell	object name not found	619910193
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: SeparateProcess	object name not found	619911067
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: SeparateProcess	object name not found	619911872
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoNetCrawling	object name not found	619912761
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoNetCrawling	object name not found	619913566
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoSimpleStartMenu	object name not found	619914406
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoSimpleStartMenu	object name not found	619915210
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: Hidden	success or wait	619916068
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: ShowCompColor	success or wait	619916491
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	619916909
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: DontPrettyPath	success or wait	619917350
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: ShowInfoTip	success or wait	619917770
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideIcons	success or wait	619918240
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: MapNetDrvBtn	success or wait	619918660
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: WebView	success or wait	619919113
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: Filter	success or wait	619919531
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: ShowSuperHidden	success or wait	619919949
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: SeparateProcess	success or wait	619920440
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: NoNetCrawling	success or wait	619920863
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: DocObject	object name not found	619922370
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: BrowseInPlace	object name not found	619923172
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: IsShortcut	object name not found	619924844
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: AlwaysShowExt	success or wait	619925642
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: NeverShowExt	object name not found	619926441
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	619927468
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	619928901
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619930427
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619930678
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619930923
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619931165
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	619931688
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	619931892
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	619932088
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619938898
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619939162
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	619939981
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	619941269
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619941829
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	619942344
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	619943631
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	619945509
File opened	Path: C:\Documents and Settings\Administrator\Desktop\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	619946882
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: AllowFileCLSIDJunctions	object name not found	619948406
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: AllowFileCLSIDJunctions	object name not found	619949105
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619949756
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619950011
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	619950750
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	619952016
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	619952524
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	619953028
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	619954387
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	619955714
File opened	Path: C:\Documents and Settings\Administrator\Desktop\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	619957848
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency	success or wait	619967795
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	success or wait	619968829
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Name: 9	object name not found	619969814
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Name: 9 Type: binary Data: 39 19 02 00 88 04 00 00 06 00 00 00 01 00 00 00 9A 00 00 00 02 00 00 00 8A 00 00 00 04 00 00 00 63 00 3A 00 5C 00 64 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 73 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 61 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 64 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 69 00 70 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 62 00 61 00 74 00 74 00 65 00 72 00 79 00 2E 00 64 00 6F 00 63 00 00 00 00 00 00 00 Old data:	success or wait	619970272
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	619971211
Section loaded	Path: \BaseNamedObjects\DfSharedHeap37B58 Access: query and write and read Type: reserve Baseaddress: 19D0000 Size: 4194304 Protection: read write Mapped to pid: own pid	success or wait	619972088
File opened	Path: C:\Documents and Settings\Administrator\Desktop\iPhone 5 Battery.doc Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	619973334
System info queried	Type: PerformanceInformation	success or wait	619974220
Process information queried	PID: 1160 Info Class: QuotaLimits	success or wait	619974629
Process information queried	PID: 1160 Info Class: VmCounters	success or wait	619974841
Section loaded	Path: \BaseNamedObjects\DFMap0-228188 Access: query and write and read Type: commit Baseaddress: 1DD0000 Size: 598016 Protection: read write Mapped to pid: own pid	success or wait	619975102
Section loaded	Path: \BaseNamedObjects\DfRoot000037B58 Access: query and write and read Type: commit Baseaddress: 1E70000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	619976566
File created	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF7B61.tmp Access: read attributes and delete and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and delete on close Attributes: temporary Content Overwritten: true	success or wait	619978138
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF7B61.tmp New path: Disposition: PositionInformation Data : Offset: 512	success or wait	619984792
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF7B61.tmp New path: Disposition: EndOfFileInformation Data : unknown	success or wait	619985018
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF7B61.tmp New path: Disposition: AllocationInformation Data : unknown	success or wait	619989517
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DF7B61.tmp New path: Disposition: PositionInformation Data : Offset: 0	success or wait	619990167
System info queried	Type: PerformanceInformation	success or wait	619990362
Process information queried	PID: 1160 Info Class: QuotaLimits	success or wait	619990816
Process information queried	PID: 1160 Info Class: VmCounters	success or wait	619991028
Section loaded	Path: \BaseNamedObjects\DFMap0-228204 Access: query and write and read Type: commit Baseaddress: 1E80000 Size: 524288 Protection: read write Mapped to pid: own pid	success or wait	619991315
File created	Path: C:\Documents and Settings\Administrator\Desktop\~$hone 5 Battery.doc Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: hidden Content Overwritten: true	success or wait	619994472
File write	Path: C:\Documents and Settings\Administrator\Desktop\~$hone 5 Battery.doc Offset: unknown Length: 54 Value: 0D 48 61 6E 75 65 6C 65 20 42 61 73 65 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	619999738
File write	Path: C:\Documents and Settings\Administrator\Desktop\~$hone 5 Battery.doc Offset: unknown Length: 108 Value: 0D 00 48 00 61 00 6E 00 75 00 65 00 6C 00 65 00 20 00 42 00 61 00 73 00 65 00 72 00 00 00 00 00 1E 00 00 00 0D 00 48 00 61 00 6E 00 75 00 65 00 6C 00 65 00 20 00 42 00 61 00 73 00 65 00 72 00 00 00 00 00 16 00 00 00 40 00 08 00 36 01 05 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1A 00 00 00	success or wait	620000901
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows Name: Device	success or wait	620003646
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices Name: Microsoft XPS Document Writer	success or wait	620004090
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows Name: Device	success or wait	620004583
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices Name: Microsoft XPS Document Writer	success or wait	620004992
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: PrinterHangTimeOut	object name not found	620005689
Thread created	PID: 1160 TID: 1980 EIP: 7C8106F9 EAX: 30D5382C Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	620006879
Thread resumed	TID: 1980 PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	620007684
Section loaded	Path: \KnownDlls\winspool.drv Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	620011349
File opened	Path: C:\WINDOWS\system32\winspool.drv Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620012073
Section loaded	Path: C:\WINDOWS\system32\winspool.drv Access: query and write and read and execute Type: image Baseaddress: 73000000 Size: 155648 Protection: read write Mapped to pid: own pid	success or wait	620012873
System info queried	Type: BasicInformation	success or wait	620018608
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620025033
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620026055
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620026941
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620027129
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unidrvui.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620070031
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll Access: write and read and execute Type: commit Baseaddress: 2020000 Size: 745472 Protection: execute Mapped to pid: own pid	success or wait	620070893
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unidrvui.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620074615
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll Access: query and write and read and execute Type: image Baseaddress: 7E5A0000 Size: 761856 Protection: read write Mapped to pid: own pid	success or wait	620075441
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620091180
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620092763
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620094027
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2020000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	620096175
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620099761
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620101554
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620109913
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2030000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	620111037
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	620112689
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620114301
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2030000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	620115129
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620118936
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	620119817
System info queried	Type: BasicInformation	success or wait	620132301
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620133452
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620133747
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620133972
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620134196
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620134420
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620134696
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620134921
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620135154
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620135919
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620136161
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620136395
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620136627
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620136860
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620137092
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620137322
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620137553
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620137785
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620138855
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620139097
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620139332
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620139564
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620139795
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620140018
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620140307
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620141222
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620141993
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620142215
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620142432
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620142650
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620142867
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620143085
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620143302
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620143519
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620143737
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620145585
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620145817
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620146338
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620146555
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620146781
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620147850
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620148335
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620149820
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620150009
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620151805
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620152280
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620155129
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2020000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	620156939
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620157913
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620159666
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620163420
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2030000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	620164267
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	620166426
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620166883
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2030000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	620167703
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620169936
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	620170757
System info queried	Type: BasicInformation	success or wait	620179431
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620180581
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620180875
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620181101
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620181325
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620182359
Process information queried	PID: 1160 Info Class: Cookie	success or wait	620182591
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620191982
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620192888
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620193339
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620194311
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2020000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	620195188
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620196245
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620197471
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620201213
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2030000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	620202607
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	620203867
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620204314
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2030000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	620205182
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620206781
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	620207597
System info queried	Type: BasicInformation	success or wait	620214355
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620229601
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620230512
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620231471
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620231915
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620232860
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2020000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	620233730
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620234731
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620236040
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620239795
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2030000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	620240691
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	620241946
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620242393
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2030000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	620243207
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620245310
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	620246120
System info queried	Type: BasicInformation	success or wait	620252380
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620339431
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620673192
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620674682
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620675155
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620676135
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2020000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	620677270
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620678234
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620679463
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620683247
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2030000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	620684089
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	620685342
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620685790
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2030000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	620686606
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620688255
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	620689111
System info queried	Type: BasicInformation	success or wait	620695359
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620708523
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620709437
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620710325
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620710796
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620711832
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2020000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	620712699
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620713650
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620714924
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620719603
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2030000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	620720451
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	620721702
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620722148
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2030000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	620722957
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620724570
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	620725382
System info queried	Type: BasicInformation	success or wait	620731786
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unires.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620745881
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll Access: write and read and execute Type: commit Baseaddress: 2040000 Size: 761856 Protection: execute Mapped to pid: own pid	success or wait	620746736
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unires.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620750863
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll Access: query and write and read and execute Type: image Baseaddress: 2040000 Size: 765952 Protection: read write Mapped to pid: own pid	conflicting addresses	620751705
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620757901
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620758808
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620760207
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620760718
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620761661
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2020000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	620762533
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620763493
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620764768
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620768515
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2030000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	620769406
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	620770647
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620771090
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2030000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	620772232
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620773831
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	620774705
System info queried	Type: BasicInformation	success or wait	620780919
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unires.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620792851
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll Access: write and read and execute Type: commit Baseaddress: 2040000 Size: 761856 Protection: execute Mapped to pid: own pid	success or wait	620793698
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unires.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620795469
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll Access: query and write and read and execute Type: image Baseaddress: 2040000 Size: 765952 Protection: read write Mapped to pid: own pid	conflicting addresses	620796308
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620801745
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdrv.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620803475
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll Access: write and read and execute Type: commit Baseaddress: 2020000 Size: 765952 Protection: execute Mapped to pid: own pid	success or wait	620804301
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdrv.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620806204
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll Access: query and write and read and execute Type: image Baseaddress: 3F500000 Size: 786432 Protection: read write Mapped to pid: own pid	success or wait	620807110
System info queried	Type: BasicInformation	success or wait	620814419
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620835509
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620835702
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620836675
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620837146
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620838104
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2030000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	620838994
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620839984
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620841228
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620845004
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2040000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	620846386
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	620847694
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620848154
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2040000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	620848981
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620850629
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	620851455
System info queried	Type: BasicInformation	success or wait	620857981
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620870352
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620870550
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620871472
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620871931
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620872898
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2030000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	620873782
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620874818
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620876085
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620879851
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2040000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	620880701
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	620882057
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620882519
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2040000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	620883266
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620885341
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	620886170
System info queried	Type: BasicInformation	success or wait	620893208
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620910495
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620910712
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620911630
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620912113
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620913062
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2430000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	620914014
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620915184
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620916463
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620920318
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2440000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	620921187
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	620922549
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620923023
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2440000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	620923862
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620925571
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	620926413
System info queried	Type: BasicInformation	success or wait	620934493
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620948304
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620948514
Process information queried	PID: 1160 Info Class: Wow64Information	success or wait	620949447
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620950908
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2430000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	620951807
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620952876
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620954143
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620957731
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2440000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	620958598
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	620959973
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620960446
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2440000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	620961336
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620963033
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	620963869
System info queried	Type: BasicInformation	success or wait	620970624
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620986577
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2430000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	620987477
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620988596
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620989952
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	620993834
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2440000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	620994702
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	620996465
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620996943
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2440000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	620997788
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	620999490
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621000510
System info queried	Type: BasicInformation	success or wait	621007358
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621026731
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2430000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621027663
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621028745
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621030019
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621033865
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2440000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621034740
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621036089
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621036556
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2440000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621037394
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621039146
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621039986
System info queried	Type: BasicInformation	success or wait	621046754
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621063726
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2430000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621064628
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621065700
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621066968
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621070822
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2440000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621071693
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621073040
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621073514
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2440000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621074351
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621076101
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621076968
System info queried	Type: BasicInformation	success or wait	621083808
File opened	Path: C:\WINDOWS\system32\FontSub.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621111067
Section loaded	Path: C:\WINDOWS\system32\fontsub.dll Access: write and read and execute Type: commit Baseaddress: 2430000 Size: 81920 Protection: execute Mapped to pid: own pid	success or wait	621111858
File opened	Path: C:\WINDOWS\system32\FontSub.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621116960
Section loaded	Path: C:\WINDOWS\system32\fontsub.dll Access: query and write and read and execute Type: image Baseaddress: 69310000 Size: 94208 Protection: read write Mapped to pid: own pid	success or wait	621117777
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621138328
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2430000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621139303
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621140339
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621141582
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621145418
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2440000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621146824
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621148128
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621148590
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2440000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621149415
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621151064
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621151890
System info queried	Type: BasicInformation	success or wait	621158417
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621173932
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2430000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621174841
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621175868
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621177111
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621180903
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2440000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621181761
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621183065
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621183524
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2440000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621184348
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621185990
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621186812
System info queried	Type: BasicInformation	success or wait	621193847
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621211096
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2430000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621211982
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621213013
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621214257
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621218068
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2440000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621218848
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621222474
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621222942
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2440000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621223773
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621226451
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621227385
System info queried	Type: BasicInformation	success or wait	621237849
Message posted	TID: 7DC Message: C08C WParam: 0 LParam: 1980	success	621258851
Thread terminated	TID: 1980 PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	unknown	621260366
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621273635
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621275880
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621276857
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621278131
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621281950
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621282801
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621284306
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621284761
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621285580
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621287193
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621288009
System info queried	Type: BasicInformation	success or wait	621294435
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621311409
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621312282
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621313292
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621314623
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621318927
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621319780
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621321107
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621321560
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621322381
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621324002
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621324819
System info queried	Type: BasicInformation	success or wait	621331230
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621350889
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621351829
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621352793
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621354545
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621358336
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621359182
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621360995
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621361448
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621362781
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621364407
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621365225
System info queried	Type: BasicInformation	success or wait	621372590
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621391663
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621392532
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621393577
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621394796
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621398546
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621399391
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621400637
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621401079
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621401939
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621404050
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621404863
System info queried	Type: BasicInformation	success or wait	621411007
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621427181
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621428045
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621429068
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621430290
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621434076
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621434986
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621436234
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621436679
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621437491
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621439073
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621439880
System info queried	Type: BasicInformation	success or wait	621447058
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoWideTextPrinting	object name not found	621460232
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoWideTextPrinting	object name not found	621460863
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621464789
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621465748
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621466698
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621467960
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621471721
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621472554
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621473841
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621474288
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621475139
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621476729
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621477539
System info queried	Type: BasicInformation	success or wait	621483717
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unires.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621497426
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll Access: write and read and execute Type: commit Baseaddress: 1F20000 Size: 761856 Protection: execute Mapped to pid: own pid	success or wait	621498273
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unires.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621500201
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll Access: query and write and read and execute Type: image Baseaddress: 1F20000 Size: 765952 Protection: read write Mapped to pid: own pid	conflicting addresses	621501088
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621511851
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621512722
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621514462
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621515686
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621519456
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621520298
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621521976
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621522421
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621523229
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621524868
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621525678
System info queried	Type: BasicInformation	success or wait	621533879
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unires.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621547175
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll Access: write and read and execute Type: commit Baseaddress: 1F20000 Size: 761856 Protection: execute Mapped to pid: own pid	success or wait	621548021
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unires.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621549827
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll Access: query and write and read and execute Type: image Baseaddress: 1F20000 Size: 765952 Protection: read write Mapped to pid: own pid	conflicting addresses	621550659
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621561498
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621562369
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621563316
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621564776
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621568540
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621569380
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621570623
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621571811
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621572619
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621574201
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621575540
System info queried	Type: BasicInformation	success or wait	621583209
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unires.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621596543
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll Access: write and read and execute Type: commit Baseaddress: 1F20000 Size: 761856 Protection: execute Mapped to pid: own pid	success or wait	621597395
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unires.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	621599232
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unires.dll Access: query and write and read and execute Type: image Baseaddress: 1F20000 Size: 765952 Protection: read write Mapped to pid: own pid	conflicting addresses	621600067
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621607922
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621608875
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621609910
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621611803
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621617011
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621618408
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621619783
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621621103
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621625406
System info queried	Type: BasicInformation	success or wait	621633328
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621650213
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621651113
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621652144
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621653420
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621657280
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621658156
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621659517
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621661415
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621663966
System info queried	Type: BasicInformation	success or wait	621671146
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621692009
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621693038
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621694157
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621695455
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621699298
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621700176
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621701568
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621702904
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621706044
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621730075
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621730984
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621732068
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621733401
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621737234
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621738111
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621739505
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621740837
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621743528
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621768602
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621769525
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621770637
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621772013
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621775905
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621776803
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621778512
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621779890
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621782764
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621807896
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621808820
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621809933
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621811255
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621815172
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621816110
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621817570
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621818979
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621821666
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621846977
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621847902
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621849018
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621850345
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621854200
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621855148
Process information queried	PID: 1160 Info Class: DefaultHardErrorMode	success or wait	621856613
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621857994
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621860682
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621888872
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	621889795
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621891363
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621892694
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	621896551
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	621897447
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	621900492
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	621903229
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622312474
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	622313430
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622314595
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622315929
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622319864
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	622320764
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	622323665
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	622326341
File opened	Path: C:\WINDOWS\system32\FontSub.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	622352459
Section loaded	Path: C:\WINDOWS\system32\fontsub.dll Access: write and read and execute Type: commit Baseaddress: 1F00000 Size: 81920 Protection: execute Mapped to pid: own pid	success or wait	622353269
File opened	Path: C:\WINDOWS\system32\FontSub.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	622354909
Section loaded	Path: C:\WINDOWS\system32\fontsub.dll Access: query and write and read and execute Type: image Baseaddress: 69310000 Size: 94208 Protection: read write Mapped to pid: own pid	success or wait	622355758
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622364540
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	622365445
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622366608
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622367897
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622371730
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	622372818
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	622375611
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	622378250
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622402326
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	622403325
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622404433
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622405772
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622409604
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	622410479
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	622413205
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	622415793
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622439224
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	622440129
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622441281
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622442574
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622446451
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	622447328
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	622450069
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	622452906
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622480311
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	622481179
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622482124
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622483336
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622487248
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	622488092
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	622490588
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	622493006
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622515850
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	622516716
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622517662
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622518929
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622523262
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	622524102
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	622526594
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	622529015
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoWideTextPrinting	object name not found	622917390
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoWideTextPrinting	object name not found	622917975
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622924387
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	622925271
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622926320
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622927543
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622931328
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	622932171
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	622934699
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	622937091
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622961016
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	622961972
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622962915
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622964172
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	622967929
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	622968766
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	622971250
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	622973629
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoWideTextPrinting	object name not found	622993401
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoWideTextPrinting	object name not found	622993984
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows Name: Device	success or wait	622997204
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices Name: Microsoft XPS Document Writer	success or wait	622997645
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623002312
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623003183
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623004135
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623005354
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623012171
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623013029
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623015810
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623018216
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623040129
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623041002
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623041961
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623043183
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623046951
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623047792
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623050297
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623052739
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623073127
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623074000
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623074951
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623076226
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623080512
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623081361
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623083865
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623086263
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623111691
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623112568
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623113551
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623114792
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623118558
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623119408
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623122184
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623125339
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623146463
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623147342
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623148319
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623149556
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623153367
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623154226
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623156786
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623159239
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623182672
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623183568
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623184587
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623185847
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623189681
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623190542
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623193181
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623195742
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623218335
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623219231
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623220253
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623221588
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623225451
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623226322
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623229002
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623231520
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623254552
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623255449
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623256469
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623257833
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623261672
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623262536
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623265188
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623267760
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623293791
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623295281
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623297108
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623298388
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	623302204
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623303070
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623307457
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623310722
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623335677
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623343329
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623346392
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623350155
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623384122
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623391129
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623393696
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623396193
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623424489
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623431378
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623433939
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623436385
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623458322
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623465400
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623468493
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623470947
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows Name: Device	success or wait	623502089
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices Name: Microsoft XPS Document Writer	success or wait	623502535
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623508073
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623516229
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623518982
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623521443
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623543588
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623550415
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623553462
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623555874
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623588375
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623595785
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623598307
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623600709
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	623793555
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	623800629
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	623806946
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	623809956
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624173021
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624181095
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624198815
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624201309
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624279438
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624286998
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624291244
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624293771
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624324136
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624331702
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624334432
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624336959
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624360345
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624367341
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624370609
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624373136
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624399438
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624406399
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624409257
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624412508
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624435254
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624442287
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624444940
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624447541
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624477616
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624484497
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624487069
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624489516
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624511897
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624630026
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624633007
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624635474
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624657284
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624664196
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624666818
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624669803
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624701396
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624708217
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624710788
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624713764
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624739007
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624746486
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624749356
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624751876
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624774279
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624781138
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624783760
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624786230
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624823539
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624830606
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624833317
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624835882
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624861245
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624868277
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624871017
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624873576
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624897713
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624904847
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624907550
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624910123
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	624945100
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	624952196
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	624954889
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	624957497
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625376993
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625384320
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625388194
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625414986
File opened	Path: C:\WINDOWS\system32\prntvpt.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	625473530
Section loaded	Path: C:\WINDOWS\system32\prntvpt.dll Access: write and read and execute Type: commit Baseaddress: 1F00000 Size: 118784 Protection: execute Mapped to pid: own pid	success or wait	625474334
File opened	Path: C:\WINDOWS\system32\prntvpt.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	625477265
Section loaded	Path: C:\WINDOWS\system32\prntvpt.dll Access: query and write and read and execute Type: image Baseaddress: 3FB50000 Size: 131072 Protection: read write Mapped to pid: own pid	success or wait	625478058
Section loaded	Path: \BaseNamedObjects\AtlDebugAllocator_FileMappingNameStatic3_488 Access: query and write and read Type: reserve Baseaddress: 2430000 Size: 4194304 Protection: read write Mapped to pid: own pid	success or wait	625493512
System info queried	Type: ProcessorInformation	success or wait	625494398
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625501802
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625509658
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625513152
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625515691
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625558566
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625567868
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625571019
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625573515
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625596541
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625603622
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625606225
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625608744
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625636089
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625643428
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625645921
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625648306
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625672047
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625678745
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625681284
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625683697
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoWideTextPrinting	object name not found	625703897
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoWideTextPrinting	object name not found	625704475
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Font Mapping Name: SimSun	object name not found	625708758
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625714825
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625721718
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625724298
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625726767
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625752313
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625759292
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625761916
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625764426
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625787394
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625794391
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625797071
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625799616
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625827294
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625835058
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625837802
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625840405
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625865010
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625872640
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625875391
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625878000
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625902076
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625909189
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625911935
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625915074
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625943254
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625950434
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625953234
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625955850
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	625980647
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	625987791
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	625990539
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	625993148
File opened	Path: C:\WINDOWS\system32\prntvpt.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	626022501
Section loaded	Path: C:\WINDOWS\system32\prntvpt.dll Access: write and read and execute Type: commit Baseaddress: 1F00000 Size: 118784 Protection: execute Mapped to pid: own pid	success or wait	626023305
File opened	Path: C:\WINDOWS\system32\prntvpt.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	626024940
Section loaded	Path: C:\WINDOWS\system32\prntvpt.dll Access: query and write and read and execute Type: image Baseaddress: 3FB50000 Size: 131072 Protection: read write Mapped to pid: own pid	success or wait	626025722
Section loaded	Path: \BaseNamedObjects\AtlDebugAllocator_FileMappingNameStatic3_488 Access: query and write and read Type: reserve Baseaddress: 2430000 Size: 4194304 Protection: read write Mapped to pid: own pid	success or wait	626034671
System info queried	Type: ProcessorInformation	success or wait	626035552
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	626040429
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	626047993
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	626050649
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	626053182
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	626076244
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	626083185
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	626087155
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	626089942
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	626112894
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	626119883
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	626122532
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	626125059
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	626153005
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	626159905
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	626162391
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	626164778
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 1F00000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	626188616
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 1F10000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	626195342
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 1F10000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	626198053
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	626202174
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoWideTextPrinting	object name not found	626222634
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoWideTextPrinting	object name not found	626223208
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Font Mapping Name: ??	object name not found	626223854
Key created	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose	success or wait	626225136
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: SimSun	object name not found	626225726
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Times New Roman	object name not found	626229246
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Times New Roman Type: binary Data: 02 02 06 03 05 04 05 02 03 04 Old data:	success or wait	626237613
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Arial	object name not found	626238669
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Arial Type: binary Data: 02 0B 06 04 02 02 02 02 02 04 Old data:	success or wait	626240791
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Courier New	object name not found	626242856
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Courier New Type: binary Data: 02 07 03 09 02 02 05 02 04 04 Old data:	success or wait	626249452
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Symbol	object name not found	626250416
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Symbol Type: binary Data: 05 05 01 02 01 07 06 02 05 07 Old data:	success or wait	626255905
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Wingdings	object name not found	626258683
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Wingdings Type: binary Data: 05 00 00 00 00 00 00 00 00 00 Old data:	success or wait	626264044
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Mangal	object name not found	626265003
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Latha	object name not found	626265888
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Sylfaen	object name not found	626266814
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Sylfaen Type: binary Data: 01 0A 05 02 05 03 06 03 03 03 Old data:	success or wait	626272379
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Vrinda	object name not found	626273380
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Vrinda Type: binary Data: 01 01 06 00 01 01 01 01 01 01 Old data:	success or wait	626278733
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Raavi	object name not found	626279681
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Shruti	object name not found	626280605
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Gautami	object name not found	626281510
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Tunga	object name not found	626282414
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Estrangelo Edessa	object name not found	626283325
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Kartika	object name not found	626284234
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Kartika Type: binary Data: 02 02 05 03 03 04 04 06 02 03 Old data:	success or wait	626290385
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Tahoma	object name not found	626291373
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Tahoma Type: binary Data: 02 0B 06 04 03 05 04 04 02 04 Old data:	success or wait	626294510
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Marlett	object name not found	626295463
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Marlett Type: binary Data: 00 00 00 00 00 00 00 00 00 00 Old data:	success or wait	626296767
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Lucida Console	object name not found	626297742
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Lucida Console Type: binary Data: 02 0B 06 09 04 05 04 02 02 04 Old data:	success or wait	626302296
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Lucida Sans Unicode	object name not found	626303245
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Lucida Sans Unicode Type: binary Data: 02 0B 06 02 03 05 04 02 02 04 Old data:	success or wait	626312410
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Verdana	object name not found	626313428
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Verdana Type: binary Data: 02 0B 06 04 03 05 04 04 02 04 Old data:	success or wait	626319716
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Arial Black	object name not found	626320679
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Arial Black Type: binary Data: 02 0B 0A 04 02 01 02 02 02 04 Old data:	success or wait	626328881
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Comic Sans MS	object name not found	626329951
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Comic Sans MS Type: binary Data: 03 0F 07 02 03 03 02 02 02 04 Old data:	success or wait	626335214
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Impact	object name not found	626336207
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Impact Type: binary Data: 02 0B 08 06 03 09 02 05 02 04 Old data:	success or wait	626341638
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Georgia	object name not found	626342642
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Georgia Type: binary Data: 02 04 05 02 05 04 05 02 03 03 Old data:	success or wait	626348459
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Franklin Gothic Medium	object name not found	626349445
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Franklin Gothic Medium Type: binary Data: 02 0B 06 03 02 01 02 02 02 04 Old data:	success or wait	626355892
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Palatino Linotype	object name not found	626356905
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Palatino Linotype Type: binary Data: 02 04 05 02 05 05 05 03 03 04 Old data:	success or wait	626365132
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Trebuchet MS	object name not found	626366142
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Trebuchet MS Type: binary Data: 02 0B 06 03 02 02 02 02 02 04 Old data:	success or wait	626370933
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Webdings	object name not found	626372011
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Webdings Type: binary Data: 05 03 01 02 01 05 09 06 07 03 Old data:	success or wait	626377034
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: MV Boli	object name not found	626378016
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Microsoft Sans Serif	object name not found	626378973
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Microsoft Sans Serif Type: binary Data: 02 0B 06 04 02 02 02 02 02 04 Old data:	success or wait	626388831
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Book Antiqua	object name not found	626389895
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Book Antiqua Type: binary Data: 02 04 06 02 05 03 05 03 03 04 Old data:	success or wait	626396609
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Bookman Old Style	object name not found	626397603
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Bookman Old Style Type: binary Data: 02 05 06 04 05 05 05 02 02 04 Old data:	success or wait	626404453
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Century Gothic	object name not found	626405480
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Century Gothic Type: binary Data: 02 0B 05 02 02 02 02 02 02 04 Old data:	success or wait	626412543
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Garamond	object name not found	626413532
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Garamond Type: binary Data: 02 02 04 04 03 03 01 01 08 03 Old data:	success or wait	626420300
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Monotype Corsiva	object name not found	626421694
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Monotype Corsiva Type: binary Data: 03 01 01 01 01 02 01 01 01 01 Old data:	success or wait	626428374
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Wingdings 2	object name not found	626429922
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Wingdings 2 Type: binary Data: 05 02 01 02 01 05 07 07 07 07 Old data:	success or wait	626435141
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Wingdings 3	object name not found	626438706
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Wingdings 3 Type: binary Data: 05 04 01 02 01 08 07 07 07 07 Old data:	success or wait	626443809
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Bookshelf Symbol 7	object name not found	626444804
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Bookshelf Symbol 7 Type: binary Data: 05 01 01 01 01 01 01 01 01 01 Old data:	success or wait	626450473
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: MS Reference Sans Serif	object name not found	626451500
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: MS Reference Sans Serif Type: binary Data: 02 0B 06 04 03 05 04 04 02 04 Old data:	success or wait	626459046
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: MS Reference Specialty	object name not found	626460049
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: MS Reference Specialty Type: binary Data: 05 00 05 00 00 00 00 00 00 00 Old data:	success or wait	626465816
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Arial Narrow	object name not found	626466847
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Panose Name: Arial Narrow Type: binary Data: 02 0B 06 06 02 02 02 03 02 04 Old data:	success or wait	626473141
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools Name: SpellingWavyUnderlineColor	object name not found	626486997
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools Name: GrammarWavyUnderlineColor	object name not found	626487334
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: NoTrack	object name not found	626488199
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: MaxPropsStreamSize	object name not found	626489658
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	626495300
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	626495834
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Recent	object name not found	626497115
Section loaded	Path: \KnownDlls\USERENV.dll Access: write and read and execute Type: unknown Baseaddress: 769C0000 Size: 737280 Protection: read write Mapped to pid: own pid	success or wait	626497891
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	626503249
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: ChkAccDebugLevel	object name not found	626504015
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions Name: ProductType	success or wait	626504789
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Personal	success or wait	626506120
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Local Settings	success or wait	626506524
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: RsopDebugLevel	object name not found	626507533
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	626508266
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: RsopLogging	object name not found	626508669
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: UserEnvDebugLevel	object name not found	626509461
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: RsopLogging	object name not found	626509859
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	626510590
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: UserEnvDebugLevel	object name not found	626511334
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: ProfileImagePath	success or wait	626512159
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dot Name: Progid	object name not found	626513549
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dot Name: Application	object name not found	626514322
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dot Name: NULL	success or wait	626515894
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dot Name: PerceivedType	object name not found	626518598
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8 Name: DocObject	object name not found	626519530
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot Name: DocObject	object name not found	626520241
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8 Name: BrowseInPlace	object name not found	626520931
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot Name: BrowseInPlace	object name not found	626521609
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8\CLSID Name: NULL	success or wait	626522686
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8 Name: IsShortcut	object name not found	626523681
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot Name: IsShortcut	object name not found	626524356
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8 Name: AlwaysShowExt	object name not found	626525025
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot Name: AlwaysShowExt	object name not found	626525764
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8 Name: NeverShowExt	object name not found	626526451
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot Name: NeverShowExt	object name not found	626527126
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\ReviewCycle Name: ReviewToken	success or wait	626528601
Mutant created	Name: \BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-507921405-1960408961-839522115-500	success or wait	626529626
Section loaded	Path: \BaseNamedObjects\Local\MSO_Formal11108172_S-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read and execute and extend size Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	626529984
Section loaded	Path: \BaseNamedObjects\Local\MSO_Formal11108172_S-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read Type: commit Baseaddress: 1F10000 Size: 8192 Protection: read write Mapped to pid: own pid	success or wait	626530236
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\review.rcd Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	object name not found	626531919
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\review.rcd Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	object name not found	626533579
Mutant created	Name: \BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-507921405-1960408961-839522115-500	success or wait	626534559
Section loaded	Path: \BaseNamedObjects\Local\MSO_AdHoc11108172_S-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read and execute and extend size Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	626534902
Section loaded	Path: \BaseNamedObjects\Local\MSO_AdHoc11108172_S-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read Type: commit Baseaddress: 1F20000 Size: 8192 Protection: read write Mapped to pid: own pid	success or wait	626535150
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\adhoc.rcd Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	object name not found	626536529
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\adhoc.rcd Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	object name not found	626537670
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: DoNotDismissFileNewTaskPane	object name not found	626538681
Window placement got	HWND: 5012E CMD: show maximized	success	626539024
Message sent	HWND: 90058 Message: WINDOWPOSCHANGING WParam: 0 LParam: 1201920	error	626539342
Message sent	HWND: 40134 Message: WINDOWPOSCHANGING WParam: 0 LParam: 1201932	error	626539573
Message sent	HWND: 5010A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1202020	error	626539835
Message sent	HWND: 5010A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1202020	error	626540068
Message sent	HWND: 5010A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1202020	error	626540278
Message sent	HWND: 5010A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1202020	error	626540487
Message sent	HWND: 40134 Message: WINDOWPOSCHANGING WParam: 0 LParam: 1202008	error	626540825
Message sent	HWND: 40134 Message: WINDOWPOSCHANGING WParam: 0 LParam: 1202008	error	626541043
Window created	Window Name: _WwB Class Name: _WwB HWND: 5012C	success	626541312
Message sent	HWND: 5012C Message: NCCREATE WParam: 0 LParam: 1200884	success	626541532
Message sent	HWND: 5012C Message: NCCALCSIZE WParam: 0 LParam: 1200924	error	626541766
Foreground Window Got	HWND: 5012E	success	626557465
Window created	Window Name: _WwG Class Name: _WwG HWND: 50106	success	626558602
Window created	Window Name: 6.0.2600.6028!ScrollBar Class Name: SCROLLBAR HWND: 400EC	success	626561968
Window created	Window Name: _WwC Class Name: _WwC HWND: 40120	success	626563378
Window created	Window Name: IPTR Class Name: IPTR HWND: 40128	success	626591524
Window created	Window Name: 6.0.2600.6028!ScrollBar Class Name: SCROLLBAR HWND: 400E4	success	626592832
Window created	Window Name: IPTR Class Name: IPTR HWND: 400DE	success	626615778
Window created	Window Name: _WwC Class Name: _WwC HWND: 400DA	success	626616986
Window created	Window Name: _WwC Class Name: _WwC HWND: 500DC	success	626617515
Window created	Window Name: _WwC Class Name: _WwC HWND: 400D6	success	626618331
Window shown	HWND: 400EC CMD: show normal	error	626644839
Window shown	HWND: 400E4 CMD: show normal	error	626645010
Window shown	HWND: 400DE CMD: show normal	error	626645173
Window shown	HWND: 40128 CMD: show normal	error	626645728
Window shown	HWND: 500DC CMD: show normal	error	626646364
Window shown	HWND: 400D6 CMD: show normal	error	626646527
Message sent	HWND: 5012E Message: NCACTIVATE WParam: 1 LParam: 0	success	626652502
Message posted	TID: 6E8 Message: C087 WParam: 17 LParam: 327942	success	626652856
File opened	Path: C:\WINDOWS\system32\Msimtf.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	626653906
Section loaded	Path: C:\WINDOWS\system32\msimtf.dll Access: write and read and execute Type: commit Baseaddress: 1F70000 Size: 159744 Protection: execute Mapped to pid: own pid	success or wait	626654872
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet Name: PixelsPerInch	object name not found	626658519
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet Name: PixelsPerInch	object name not found	626658865
Window shown	HWND: 400EC CMD: show normal	success	626659203
Window shown	HWND: 400E4 CMD: show normal	success	626659362
Window shown	HWND: 400DE CMD: show normal	success	626659518
Window shown	HWND: 40128 CMD: show normal	success	626660319
Window shown	HWND: 500DC CMD: show normal	success	626660835
Window shown	HWND: 400D6 CMD: show normal	success	626660991
Window shown	HWND: 400EC CMD: show normal	success	626662701
Window shown	HWND: 400E4 CMD: show normal	success	626662856
Window shown	HWND: 400DE CMD: show normal	success	626663012
Window shown	HWND: 40128 CMD: show normal	success	626663392
Window shown	HWND: 500DC CMD: show normal	success	626663731
Window shown	HWND: 400D6 CMD: show normal	success	626663887
Window shown	HWND: 40134 CMD: show normal	success	626664059
Window shown	HWND: 5012C CMD: show normal	error	626664216
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	626664615
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	626665208
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	626665448
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	626665701
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	626665940
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	626666174
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	626666410
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	626666644
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	626667267
Window shown	HWND: 50106 CMD: show normal	error	626673791
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	626674055
Window shown	HWND: 500DC CMD: show	success	626674518
Window shown	HWND: 400D6 CMD: show	success	626674676
Window shown	HWND: 40134 CMD: show normal	success	626675495
Window shown	HWND: 400EC CMD: show normal	success	626675652
Window shown	HWND: 400E4 CMD: show normal	success	626677700
Window shown	HWND: 400DE CMD: show normal	success	626679047
Window shown	HWND: 40128 CMD: show normal	success	626679898
Window shown	HWND: 500DC CMD: show normal	success	626680515
Window shown	HWND: 400D6 CMD: show normal	success	626680671
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	626684955
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	626695296
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	626697835
Section loaded	Path: \BaseNamedObjects\Global\RotHintTable Access: read Type: unknown Baseaddress: 1F70000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	626698558
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	626699712
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	626701333
File opened	Path: C:\Documents and Settings\Administrator\Desktop\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	626702628
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common Name: VbaOff	object name not found	626708638
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: VbaOff	object name not found	626708978
Section loaded	Path: \KnownDlls\msi.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	626709520
File opened	Path: C:\WINDOWS\system32\msi.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	626710206
Section loaded	Path: C:\WINDOWS\system32\msi.dll Access: query and write and read and execute Type: image Baseaddress: 7D1E0000 Size: 2867200 Protection: read write Mapped to pid: own pid	success or wait	626710953
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer Name: DisableUserInstalls	object name not found	626720084
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer Name: Debug	object name not found	626720595
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\InstallProperties Name: WindowsInstaller	success or wait	626722997
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: DigitalProductID	buffer overflow	626724585
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: DigitalProductID	success or wait	626724977
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\InstallProperties Name: WindowsInstaller	success or wait	626727128
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: WORDFiles	success or wait	626728770
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	626730002
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	626730329
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	success or wait	626730648
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C Name: 9040110900063D11C8EF10054038389C	success or wait	626731292
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A453DD12EE71CEF49A4EB2A8684FB83A Name: 9040110900063D11C8EF10054038389C	success or wait	626732025
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5861C19D5F3D8C8439408F306F31034A Name: 9040110900063D11C8EF10054038389C	success or wait	626732751
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\311714883E93F274A838DDB012991F9D Name: 9040110900063D11C8EF10054038389C	success or wait	626733447
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72E940125B15C02498F17C8F91EADC14 Name: 9040110900063D11C8EF10054038389C	success or wait	626734135
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16EFE5D0815A2D11A92E0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626734829
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41AE703BF87339947BDCC4715F97EFED Name: 9040110900063D11C8EF10054038389C	success or wait	626735553
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	626736130
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	626736834
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	626737164
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	626737488
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	626738283
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	626738985
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626740057
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	626740810
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	626741541
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	626741878
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	626742583
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	626743317
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	626744036
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	626744401
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	626745110
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	626745847
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	626746548
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	626747250
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	626747946
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: WORDFiles	success or wait	626750088
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: WORDFiles Type: dword Data: 1089994754 Old data: 1089994753	success or wait	626750472
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	626751986
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	626753812
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	626754511
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	626754838
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	626755156
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	626755903
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	626756876
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626757564
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	626758552
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	626759246
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	626759571
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	626760266
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	626760952
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	626761636
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	626761960
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	626762649
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	626763337
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	626764022
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	626764707
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	626765391
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: ProductFiles	success or wait	626767319
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: ProductFiles Type: dword Data: 1089994755 Old data: 1089994754	success or wait	626767671
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: VBAFiles	success or wait	626768685
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: VBAFiles	buffer overflow	626769435
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: VBAFiles	buffer overflow	626769789
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: VBAFiles	success or wait	626770119
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0020F700D33C1D112897000CF42C6133 Name: 9040110900063D11C8EF10054038389C	buffer overflow	626771148
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0020F700D33C1D112897000CF42C6133 Name: 9040110900063D11C8EF10054038389C	success or wait	626771484
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\359E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	626772205
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C1B74D56F7A1D11A9CC0006794C4E25 Name: 9040110900063D11C8EF10054038389C	buffer overflow	626773469
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C1B74D56F7A1D11A9CC0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626773806
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4EEF86DD963C1D111A37000A9CA05BF0 Name: 9040110900063D11C8EF10054038389C	success or wait	626774676
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2EEF86DD963C1D111A37000A9CA05BF0 Name: 9040110900063D11C8EF10054038389C	success or wait	626775471
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A457B2D1A9DC1D112897000CF42C6133 Name: 9040110900063D11C8EF10054038389C	success or wait	626776357
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1178400169C22D11A9790006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626777080
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SHAREDFiles	success or wait	626777706
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	626778426
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	626778758
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	626779345
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	626779943
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	626780661
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	626780997
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	626781333
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	626782115
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	626782836
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626783553
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	626784270
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	626784990
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	626785329
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	626786053
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	626786767
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	626787520
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	626787858
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	626788582
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	626789302
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	626790021
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	626790739
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	626791459
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA Name: Vbe6DllPath	success or wait	626792816
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	626794308
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: write and read and execute Type: commit Baseaddress: 2830000 Size: 2588672 Protection: execute Mapped to pid: own pid	success or wait	626795113
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	626797893
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: query and read Type: commit Baseaddress: 2830000 Size: 2588672 Protection: readonly Mapped to pid: own pid	success or wait	626798689
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	626821070
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: write and read and execute Type: commit Baseaddress: 2830000 Size: 2588672 Protection: execute Mapped to pid: own pid	success or wait	626821867
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	626823363
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: query and read Type: commit Baseaddress: 2830000 Size: 2588672 Protection: readonly Mapped to pid: own pid	success or wait	626824148
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\029E403DA86A1D115B5B0006799C897E Name: vbe.dll_6.0	success or wait	626835875
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: VBAFiles	success or wait	626836791
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: VBAFiles	buffer overflow	626837520
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: VBAFiles	buffer overflow	626837856
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: VBAFiles	success or wait	626838190
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0020F700D33C1D112897000CF42C6133 Name: 9040110900063D11C8EF10054038389C	buffer overflow	626838834
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0020F700D33C1D112897000CF42C6133 Name: 9040110900063D11C8EF10054038389C	success or wait	626839175
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\359E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	626839888
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C1B74D56F7A1D11A9CC0006794C4E25 Name: 9040110900063D11C8EF10054038389C	buffer overflow	626840600
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1C1B74D56F7A1D11A9CC0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626840937
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4EEF86DD963C1D111A37000A9CA05BF0 Name: 9040110900063D11C8EF10054038389C	success or wait	626841654
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2EEF86DD963C1D111A37000A9CA05BF0 Name: 9040110900063D11C8EF10054038389C	success or wait	626842387
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A457B2D1A9DC1D112897000CF42C6133 Name: 9040110900063D11C8EF10054038389C	success or wait	626843152
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1178400169C22D11A9790006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626843862
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SHAREDFiles	success or wait	626844478
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	626845200
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	626845536
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	626846078
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	626846678
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	626847405
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	626847747
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	626848082
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	626848858
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	626849583
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626850307
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	626851030
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	626851757
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	626852099
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	626852831
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	626853555
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	626854276
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	626854616
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	626855347
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	626856078
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	626856799
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	626857517
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	626858776
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\359E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	626860022
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: VBAFiles	object name not found	626861855
Key value set	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: VBAFiles Type: dword Data: 1089994753 Old data:	success or wait	626862200
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\vbe6.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	626864385
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL Access: write and read and execute Type: commit Baseaddress: 2830000 Size: 2588672 Protection: execute Mapped to pid: own pid	success or wait	626865224
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\vbe6.dll Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	626866729
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL Access: query and read Type: commit Baseaddress: 2830000 Size: 2588672 Protection: readonly Mapped to pid: own pid	success or wait	626867560
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\vbe6.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	626887365
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL Access: write and read and execute Type: commit Baseaddress: 2830000 Size: 2588672 Protection: execute Mapped to pid: own pid	success or wait	626888199
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\vbe6.dll Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	626889693
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\VBA\VBA6\VBE6.DLL Access: query and read Type: commit Baseaddress: 2830000 Size: 2588672 Protection: readonly Mapped to pid: own pid	success or wait	626890519
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	626904024
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	626904682
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 Name: LocalServer32	success or wait	626906984
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt Name: {90110409-6000-11D3-8CFE-0150048383C9}	object name not found	626908141
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: WORDFiles	success or wait	626909278
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	626910029
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	626910379
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	success or wait	626910721
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C Name: 9040110900063D11C8EF10054038389C	success or wait	626911372
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A453DD12EE71CEF49A4EB2A8684FB83A Name: 9040110900063D11C8EF10054038389C	success or wait	626912755
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5861C19D5F3D8C8439408F306F31034A Name: 9040110900063D11C8EF10054038389C	success or wait	626914112
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\311714883E93F274A838DDB012991F9D Name: 9040110900063D11C8EF10054038389C	success or wait	626915467
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72E940125B15C02498F17C8F91EADC14 Name: 9040110900063D11C8EF10054038389C	success or wait	626916874
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16EFE5D0815A2D11A92E0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626918237
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41AE703BF87339947BDCC4715F97EFED Name: 9040110900063D11C8EF10054038389C	success or wait	626919628
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	626920861
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	626921613
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	626921968
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	626922315
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	626923086
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	626924841
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626926221
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	626927785
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	626928822
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	626929178
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	626930589
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	626931965
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	626933340
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	626933694
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	626935073
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	626936446
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	626937199
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	626938570
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	626939942
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C Name: 9040110900063D11C8EF10054038389C	success or wait	626941689
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: WORDFiles	success or wait	626944767
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: WORDFiles Type: dword Data: 1089994755 Old data: 1089994754	success or wait	626945151
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\InprocHandler32 Name: NULL	success or wait	626946800
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	626948549
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	626949170
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 Name: LocalServer32	success or wait	626951408
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt Name: {90110409-6000-11D3-8CFE-0150048383C9}	object name not found	626952104
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: WORDFiles	success or wait	626953230
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	626953979
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	626954376
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	success or wait	626954720
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C Name: 9040110900063D11C8EF10054038389C	success or wait	626955379
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A453DD12EE71CEF49A4EB2A8684FB83A Name: 9040110900063D11C8EF10054038389C	success or wait	626956752
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5861C19D5F3D8C8439408F306F31034A Name: 9040110900063D11C8EF10054038389C	success or wait	626958113
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\311714883E93F274A838DDB012991F9D Name: 9040110900063D11C8EF10054038389C	success or wait	626959516
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72E940125B15C02498F17C8F91EADC14 Name: 9040110900063D11C8EF10054038389C	success or wait	626960872
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16EFE5D0815A2D11A92E0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626962235
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41AE703BF87339947BDCC4715F97EFED Name: 9040110900063D11C8EF10054038389C	success or wait	626963593
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	626964832
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	626965584
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	626965938
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	626966286
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	626967058
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	626968468
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	626969834
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	626971203
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	626972227
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	626972585
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	626974005
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	626975373
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	626976740
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	626977092
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	626978463
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	626979995
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	626980755
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	626982372
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	626983755
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C Name: 9040110900063D11C8EF10054038389C	success or wait	626985500
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: WORDFiles	success or wait	626988609
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: WORDFiles Type: dword Data: 1089994756 Old data: 1089994755	success or wait	626988993
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\InprocHandler32 Name: NULL	success or wait	626990612
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627005453
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627006100
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\LocalServer32 Name: LocalServer32	object name not found	627008467
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\LocalServer32 Name: NULL	success or wait	627010591
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627013621
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627014258
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\LocalServer32 Name: LocalServer32	object name not found	627016577
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{18A06B6B-2F3F-4E2B-A611-52BE631B2D22}\LocalServer32 Name: NULL	success or wait	627018709
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627021725
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627022366
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020907-0000-0000-C000-000000000046}\LocalServer32 Name: LocalServer32	success or wait	627024631
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt Name: {90110409-6000-11D3-8CFE-0150048383C9}	object name not found	627025371
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: WORDFiles	success or wait	627026569
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	627027331
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	627027685
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	success or wait	627028028
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C Name: 9040110900063D11C8EF10054038389C	success or wait	627028677
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A453DD12EE71CEF49A4EB2A8684FB83A Name: 9040110900063D11C8EF10054038389C	success or wait	627030611
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5861C19D5F3D8C8439408F306F31034A Name: 9040110900063D11C8EF10054038389C	success or wait	627031973
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\311714883E93F274A838DDB012991F9D Name: 9040110900063D11C8EF10054038389C	success or wait	627033324
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72E940125B15C02498F17C8F91EADC14 Name: 9040110900063D11C8EF10054038389C	success or wait	627034672
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16EFE5D0815A2D11A92E0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	627037743
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41AE703BF87339947BDCC4715F97EFED Name: 9040110900063D11C8EF10054038389C	success or wait	627039533
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	627040823
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	627041580
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	627041936
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	627042283
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	627043085
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	627044484
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	627045891
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	627047265
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	627048295
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	627048650
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	627050029
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	627051406
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	627052831
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	627053188
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	627054569
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	627055932
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	627056680
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	627058046
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	627059441
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C Name: 9040110900063D11C8EF10054038389C	success or wait	627061182
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: WORDFiles	success or wait	627063733
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: WORDFiles Type: dword Data: 1089994758 Old data: 1089994757	success or wait	627064113
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020907-0000-0000-C000-000000000046}\InprocHandler32 Name: NULL	success or wait	627065743
Window created	Window Name: IPTR Class Name: IPTR HWND: 4011A	success	627098208
Window created	Window Name: CLIPBRDWNDCLASS Class Name: CLIPBRDWNDCLASS HWND: 7010C	success	627099099
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.3\0\win32 Name: NULL	success or wait	627103289
Section loaded	Path: \KnownDlls\SXS.DLL Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	627103962
File opened	Path: C:\WINDOWS\system32\SXS.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	627104663
Section loaded	Path: C:\WINDOWS\system32\sxs.dll Access: query and write and read and execute Type: image Baseaddress: 7E720000 Size: 720896 Protection: read write Mapped to pid: own pid	success or wait	627105426
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627112162
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627112852
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627113658
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627114289
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627116484
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627117112
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627118840
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627119480
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627121181
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	627121918
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020905-0000-0000-C000-000000000046}\8.3\0\win32 Name: NULL	success or wait	627126829
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: none Content Overwritten: true	success or wait	627127586
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 0	success or wait	627128691
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 64 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 00 00 00	success or wait	627128903
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 0	success or wait	627130445
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 184	success or wait	627130682
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 4 Value: 50 45 00 00	success or wait	627130874
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 20 Value: 4C 01 02 00 A1 95 00 46 00 00 00 00 00 00 00 00 E0 00 0E 21	success or wait	627131093
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 432	success or wait	627131339
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 40 Value: 2E 72 73 72 63 00 00 00 98 06 0A 00 00 10 00 00 00 08 0A 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	627131533
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 472	success or wait	627131786
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 512	success or wait	627131985
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00	success or wait	627132178
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 8 Value: A0 00 00 80 20 00 00 80	success or wait	627132402
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 536	success or wait	627132628
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 672	success or wait	627132825
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 2 Value: 07 00	success or wait	627133018
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 14 Value: 54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	627133235
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 536	success or wait	627133461
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 472	success or wait	627133658
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 472	success or wait	627133859
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 544	success or wait	627134057
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	627134249
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 560	success or wait	627134481
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 8 Value: 01 00 00 00 50 00 00 80	success or wait	627134673
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 472	success or wait	627134896
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 472	success or wait	627135096
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 592	success or wait	627135293
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	627135486
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 8 Value: 09 04 00 00 80 00 00 00	success or wait	627135709
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 472	success or wait	627135932
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB New path: Disposition: PositionInformation Data : Offset: 640	success or wait	627136127
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Offset: unknown Length: 16 Value: B0 10 00 00 44 01 0A 00 00 00 00 00 00 00 00 00	success or wait	627136316
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB Access: query and read Type: commit Baseaddress: 2830000 Size: 659456 Protection: readonly Mapped to pid: own pid	success or wait	627136595
System info queried	Type: ProcessorInformation	success or wait	627137113
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA Name: Vbe6DllPath	success or wait	627146312
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\VBA Name: Vbe6DllPath	success or wait	627146648
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	627147384
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: write and read and execute Type: commit Baseaddress: 28E0000 Size: 2588672 Protection: execute Mapped to pid: own pid	success or wait	627148197
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	627150038
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: query and write and read and execute Type: image Baseaddress: 65000000 Size: 2588672 Protection: read write Mapped to pid: own pid	success or wait	627150840
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbe6.dll Name: CheckAppHelp	success or wait	627162611
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\1033\VBE6INTL.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	627252525
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\1033\VBE6INTL.DLL Access: write and read and execute Type: commit Baseaddress: 1FA0000 Size: 163840 Protection: execute Mapped to pid: own pid	success or wait	627253376
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\1033\VBE6INTL.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	627256391
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\1033\VBE6INTL.DLL Access: query and write and read and execute Type: image Baseaddress: 65300000 Size: 155648 Protection: read write Mapped to pid: own pid	success or wait	627257218
Window created	Window Name: ThunderMain Class Name: ThunderMain HWND: 400EE	success	627260481
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage Name: 932	success or wait	627261746
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage Name: 949	success or wait	627262328
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage Name: 950	success or wait	627262892
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\CodePage Name: 936	success or wait	627263456
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: DoNotDismissFileNewTaskPane	object name not found	627266352
Window placement got	HWND: 5012E CMD: show maximized	success	627266739
Window created	Window Name: OpusApp Class Name: OpusApp HWND: 9014E	success	627267020
Section loaded	Path: \KnownDlls\MSIMG32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	627303167
File opened	Path: C:\WINDOWS\system32\MSIMG32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	627306156
Section loaded	Path: C:\WINDOWS\system32\msimg32.dll Access: query and write and read and execute Type: image Baseaddress: 76380000 Size: 20480 Protection: read write Mapped to pid: own pid	success or wait	627307144
Window created	Window Name: _WwC Class Name: _WwC HWND: 400D8	success	627324436
Window created	Window Name: _WwF Class Name: _WwF HWND: 7013C	success	627324986
Window created	Window Name: _WwB Class Name: _WwB HWND: 400F2	success	627328828
Window created	Window Name: _WwG Class Name: _WwG HWND: 50124	success	627330095
Window created	Window Name: 6.0.2600.6028!ScrollBar Class Name: SCROLLBAR HWND: 900FE	success	627333481
Window created	Window Name: _WwC Class Name: _WwC HWND: 400EA	success	627334233
Window created	Window Name: IPTR Class Name: IPTR HWND: 500F8	success	627356428
Window created	Window Name: 6.0.2600.6028!ScrollBar Class Name: SCROLLBAR HWND: 90152	success	627361306
Window created	Window Name: IPTR Class Name: IPTR HWND: 9013E	success	627387146
Window created	Window Name: _WwC Class Name: _WwC HWND: 700FC	success	627388434
Window created	Window Name: _WwC Class Name: _WwC HWND: 60112	success	627388949
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet Name: PixelsPerInch	object name not found	627392115
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet Name: PixelsPerInch	object name not found	627392463
Window shown	HWND: 900FE CMD: show normal	error	627392790
Window shown	HWND: 90152 CMD: show normal	error	627392958
Window shown	HWND: 9013E CMD: show normal	error	627393118
Window shown	HWND: 500F8 CMD: show normal	error	627394081
Window shown	HWND: 60112 CMD: show normal	error	627394744
Window shown	HWND: 900FE CMD: show normal	success	627397726
Window shown	HWND: 90152 CMD: show normal	success	627397881
Window shown	HWND: 9013E CMD: show normal	success	627398034
Window shown	HWND: 500F8 CMD: show normal	success	627398420
Window shown	HWND: 60112 CMD: show normal	success	627398764
Window shown	HWND: 40134 CMD: show normal	success	627398942
Window shown	HWND: 50124 CMD: show normal	error	627399172
Window shown	HWND: 60112 CMD: show	success	627399338
Window shown	HWND: 400D8 CMD: show normal	error	627401081
Window shown	HWND: 900FE CMD: show normal	success	627401251
Window shown	HWND: 90152 CMD: show normal	success	627401408
Window shown	HWND: 9013E CMD: show normal	success	627401563
Window shown	HWND: 500F8 CMD: show normal	success	627401982
Window shown	HWND: 60112 CMD: show normal	success	627402370
Window shown	HWND: 400F2 CMD: hide	error	627402550
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF0001.tmp Access: read data or list directory and read ea and read attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	627405459
Section loaded	Path: \BaseNamedObjects\DfSharedHeap38B25 Access: query and write and read Type: reserve Baseaddress: 2A30000 Size: 4194304 Protection: read write Mapped to pid: own pid	success or wait	627406557
File created	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF0001.tmp Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	627407794
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF0001.tmp New path: Disposition: PositionInformation Data : Offset: 512	success or wait	627412151
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF0001.tmp New path: Disposition: EndOfFileInformation Data : unknown	success or wait	627412353
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF0001.tmp New path: Disposition: AllocationInformation Data : unknown	success or wait	627413191
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRF0001.tmp New path: Disposition: PositionInformation Data : Offset: 0	success or wait	627413841
System info queried	Type: PerformanceInformation	success or wait	627414026
Process information queried	PID: 1160 Info Class: QuotaLimits	success or wait	627414422
Process information queried	PID: 1160 Info Class: VmCounters	success or wait	627414628
Section loaded	Path: \BaseNamedObjects\DFMap0-232234 Access: query and write and read Type: commit Baseaddress: 2E30000 Size: 524288 Protection: read write Mapped to pid: own pid	success or wait	627414884
Section loaded	Path: \BaseNamedObjects\DfRoot000038B25 Access: query and write and read Type: commit Baseaddress: 1FE0000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	627415963
Key created	Path: HKEY_USERS\Software\Microsoft\VBA	success or wait	627478613
Key created	Path: HKEY_USERS\Software\Microsoft\VBA\6.0	success or wait	627481384
Key created	Path: HKEY_USERS\Software\Microsoft\VBA\6.0\Common	success or wait	627482617
Key value queried	Path: HKEY_USERS\Software\Microsoft\VBA\6.0\Common Name: RequireDeclaration	object name not found	627560301
Key value queried	Path: HKEY_USERS\Software\Microsoft\VBA\6.0\Common Name: CompileOnDemand	object name not found	627560631
Key value queried	Path: HKEY_USERS\Software\Microsoft\VBA\6.0\Common Name: NotifyUserBeforeStateLoss	object name not found	627560953
Key value queried	Path: HKEY_USERS\Software\Microsoft\VBA\6.0\Common Name: BackGroundCompile	object name not found	627561273
Key value queried	Path: HKEY_USERS\Software\Microsoft\VBA\6.0\Common Name: BreakOnAllErrors	object name not found	627561590
Key value queried	Path: HKEY_USERS\Software\Microsoft\VBA\6.0\Common Name: BreakOnServerErrors	object name not found	627561906
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020905-0000-0000-C000-000000000046}\8.3\0\win32 Name: NULL	success or wait	627602409
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.0\9\win32 Name: NULL	success or wait	627638101
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: none Content Overwritten: true	success or wait	627651981
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 0	success or wait	627652858
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 64 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 00	success or wait	627653046
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 0	success or wait	627653863
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 248	success or wait	627654055
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 4 Value: 50 45 00 00	success or wait	627654239
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 20 Value: 4C 01 04 00 F1 05 41 46 00 00 00 00 00 00 00 00 E0 00 02 21	success or wait	627655433
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 496	success or wait	627655661
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 40 Value: 2E 74 65 78 74 00 00 00 CC FF 22 00 00 10 00 00 00 00 23 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	627655842
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 40 Value: 2E 64 61 74 61 00 00 00 A0 F0 00 00 00 10 23 00 00 D0 00 00 00 10 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	627656079
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 40 Value: 2E 72 73 72 63 00 00 00 A0 E7 01 00 00 10 24 00 00 F0 01 00 00 E0 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	627656308
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 616	success or wait	627656547
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2351104	success or wait	627656735
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 00	success or wait	627656921
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 8 Value: 40 18 00 80 60 00 00 80	success or wait	627657242
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2351128	success or wait	627657989
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2357312	success or wait	627658182
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 2 Value: 07 00	success or wait	627658366
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 14 Value: 54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	627658620
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2351128	success or wait	627658838
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 616	success or wait	627659030
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 616	success or wait	627659220
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2351200	success or wait	627659406
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00	success or wait	627659590
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2351216	success or wait	627659853
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 8 Value: 01 00 00 00 E0 04 00 80	success or wait	627660038
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 616	success or wait	627660252
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 616	success or wait	627660443
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2352352	success or wait	627660632
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	627660816
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 8 Value: 09 04 00 00 80 10 00 00	success or wait	627661031
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 616	success or wait	627661244
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2355328	success or wait	627661428
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 16 Value: 00 3E 25 00 40 B9 00 00 00 00 00 00 00 00 00 00	success or wait	627661609
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: query and read Type: commit Baseaddress: 2F40000 Size: 53248 Protection: readonly Mapped to pid: own pid	success or wait	627661883
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32 Name: NULL	success or wait	627673453
File opened	Path: C:\WINDOWS\system32\stdole2.tlb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: none Content Overwritten: true	success or wait	627674575
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 0	success or wait	627675339
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 64 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00	success or wait	627675542
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 0	success or wait	627676279
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 192	success or wait	627676488
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 4 Value: 50 45 00 00	success or wait	627676689
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 20 Value: 4C 01 01 00 CE 29 02 48 00 00 00 00 00 00 00 00 E0 00 0F 21	success or wait	627676916
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 440	success or wait	627677159
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 40 Value: 2E 72 73 72 63 00 00 00 60 3E 00 00 00 10 00 00 00 40 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	627677358
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 480	success or wait	627677613
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 512	success or wait	627677818
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00	success or wait	627678019
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 8 Value: A0 00 00 80 20 00 00 80	success or wait	627678253
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 536	success or wait	627678490
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 672	success or wait	627678696
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 2 Value: 07 00	success or wait	627678899
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 14 Value: 54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	627679123
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 536	success or wait	627679359
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 480	success or wait	627679567
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 480	success or wait	627679776
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 544	success or wait	627679981
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	627680184
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 560	success or wait	627680424
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 8 Value: 01 00 00 00 50 00 00 80	success or wait	627680624
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 480	success or wait	627680856
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 480	success or wait	627681063
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 592	success or wait	627681267
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	627681469
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 8 Value: 09 04 00 00 80 00 00 00	success or wait	627681700
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 480	success or wait	627681933
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 16 Value: B0 10 00 00 40 3A 00 00 00 00 00 00 00 00 00 00	success or wait	627682331
Section loaded	Path: C:\WINDOWS\system32\stdole2.tlb Access: query and read Type: commit Baseaddress: 2F50000 Size: 16384 Protection: readonly Mapped to pid: own pid	success or wait	627682620
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32 Name: NULL	success or wait	627694841
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL\3 Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: none Content Overwritten: true	object path not found	627700113
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: none Content Overwritten: true	success or wait	627701535
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 0	success or wait	627702336
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 64 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 00	success or wait	627702518
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 0	success or wait	627702921
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 248	success or wait	627703109
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 4 Value: 50 45 00 00	success or wait	627703290
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 20 Value: 4C 01 04 00 F1 05 41 46 00 00 00 00 00 00 00 00 E0 00 02 21	success or wait	627703496
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 496	success or wait	627703718
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 40 Value: 2E 74 65 78 74 00 00 00 CC FF 22 00 00 10 00 00 00 00 23 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	627703897
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 40 Value: 2E 64 61 74 61 00 00 00 A0 F0 00 00 00 10 23 00 00 D0 00 00 00 10 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	627704125
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 40 Value: 2E 72 73 72 63 00 00 00 A0 E7 01 00 00 10 24 00 00 F0 01 00 00 E0 23 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	627704352
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 616	success or wait	627704588
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2351104	success or wait	627704774
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 00	success or wait	627704956
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 8 Value: 40 18 00 80 60 00 00 80	success or wait	627705211
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2351128	success or wait	627705425
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2357312	success or wait	627705611
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 2 Value: 07 00	success or wait	627705790
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 14 Value: 54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	627705993
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2351128	success or wait	627706206
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 616	success or wait	627706392
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 616	success or wait	627706579
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2351200	success or wait	627706763
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00	success or wait	627707070
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 2351216	success or wait	627707294
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 8 Value: 01 00 00 00 E0 04 00 80	success or wait	627707478
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 8 Value: 03 00 00 00 F8 04 00 80	success or wait	627707863
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 616	success or wait	627708077
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 616	success or wait	627708264
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	627708631
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 8 Value: 09 04 00 00 90 10 00 00	success or wait	627708842
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL New path: Disposition: PositionInformation Data : Offset: 616	success or wait	627709053
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Offset: unknown Length: 16 Value: 60 FE 24 00 54 0F 00 00 00 00 00 00 00 00 00 00	success or wait	627709415
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL Access: query and read Type: commit Baseaddress: 2F60000 Size: 57344 Protection: readonly Mapped to pid: own pid	success or wait	627709685
File created	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\VBE Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Attributes: normal Content Overwritten: true	success or wait	627714528
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	627732251
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	627734675
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627735589
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627736859
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627738141
File opened	Path: C:\Documents and Settings\Administrator\Application Data\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627739456
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627740814
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020905-0000-0000-C000-000000000046}\8.3\0\win32 Name: NULL	success or wait	627749691
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.3\0\win32 Name: NULL	success or wait	627764953
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: none Content Overwritten: true	success or wait	627766176
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 64 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 01 00 00	success or wait	627767198
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 4 Value: 50 45 00 00	success or wait	627768293
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 20 Value: 4C 01 05 00 00 1B 77 46 00 00 00 00 00 00 00 00 E0 00 0E 21	success or wait	627768505
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 40 Value: 2E 74 65 78 74 00 00 00 59 7A 97 00 00 10 00 00 00 7C 97 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	627768919
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 40 Value: 2E 64 61 74 61 00 00 00 B4 43 05 00 00 90 97 00 00 AC 04 00 00 80 97 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	627769153
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 40 Value: 2E 63 64 61 74 61 00 00 04 00 00 00 00 E0 9C 00 00 02 00 00 00 2C 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	627769385
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 40 Value: 2E 72 73 72 63 00 00 00 E0 D6 10 00 00 F0 9C 00 00 D8 10 00 00 2E 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	627769613
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 03 00 0E 00	success or wait	627770234
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 8 Value: B6 6A 00 80 98 00 00 80	success or wait	627770554
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 2 Value: 03 00	success or wait	627771153
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 8 Value: E0 6C 00 80 20 01 00 80	success or wait	627771602
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 2 Value: 07 00	success or wait	627772197
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 14 Value: 54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	627772406
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	627773386
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 8 Value: 01 00 00 00 90 14 00 80	success or wait	627773796
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	627774622
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 8 Value: 09 04 00 00 98 48 00 00	success or wait	627774885
File read	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Offset: unknown Length: 16 Value: 20 19 AA 00 A4 AA 03 00 00 00 00 00 00 00 00 00	success or wait	627775472
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Access: query and read Type: commit Baseaddress: 2FB0000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	627775791
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.0\9\win32 Name: NULL	success or wait	627786505
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020905-0000-0000-C000-000000000046}\8.3\0\win32 Name: NULL	success or wait	627790128
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32 Name: NULL	success or wait	627793680
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.3\0\win32 Name: NULL	success or wait	627798066
Window shown	HWND: 90058 CMD: hide	success	627801189
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib Name:	success or wait	627805116
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib Name:	success or wait	627805645
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version Name:	success or wait	627806473
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version Name:	success or wait	627806989
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32 Name: NULL	success or wait	627810190
File created	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0 Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Attributes: normal Content Overwritten: true	success or wait	627811758
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: none Content Overwritten: true	success or wait	627818330
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 64 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00	success or wait	627820105
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 4 Value: 50 45 00 00	success or wait	627822197
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 20 Value: 4C 01 07 00 A1 BD 39 4F 00 00 00 00 00 00 00 00 E0 00 02 21	success or wait	627822418
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 40 Value: 2E 74 65 78 74 00 00 00 B9 0A 66 00 00 10 00 00 00 0C 66 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	627822840
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 40 Value: 2E 72 6F 64 61 74 61 00 E0 10 00 00 00 20 66 00 00 12 00 00 00 10 66 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	627823079
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 40 Value: 2E 72 64 61 74 61 00 00 32 1D 14 00 00 40 66 00 00 1E 14 00 00 22 66 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	627823317
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 40 Value: 2E 64 61 74 61 00 00 00 C4 7F 11 00 00 60 7A 00 00 E6 02 00 00 40 7A 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	627823553
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 40 Value: 2E 72 6F 64 61 74 61 00 A0 04 00 00 00 E0 8B 00 00 06 00 00 00 26 7D 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	627823789
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 40 Value: 2E 72 73 72 63 00 00 00 0C 0D 02 00 00 F0 8B 00 00 0E 02 00 00 2C 7D 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	627824024
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 04 00 00 00 02 00 0A 00	success or wait	627824658
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 8 Value: E0 11 00 80 70 00 00 80	success or wait	627825693
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 2 Value: 08 00	success or wait	627826353
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 8 Value: F2 11 00 80 90 00 00 80	success or wait	627827523
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 2 Value: 07 00	success or wait	627828141
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 14 Value: 54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	627828355
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 04 00 00 00 00 00 02 00	success or wait	627829388
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 8 Value: 01 00 00 00 48 02 00 80	success or wait	627829813
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 04 00 00 00 00 00 01 00	success or wait	627830811
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 8 Value: 1F 04 00 00 B0 08 00 00	success or wait	627831035
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 16 Value: 34 24 8C 00 50 37 00 00 E4 04 00 00 00 00 00 00	success or wait	627831677
Section loaded	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Access: query and read Type: commit Baseaddress: 3000000 Size: 40960 Protection: readonly Mapped to pid: own pid	success or wait	627831960
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: none Content Overwritten: true	object name not found	627833750
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	627834581
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627834906
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627836163
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627837420
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627838684
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627839917
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	627841620
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627841924
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627843133
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627844368
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627846155
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627847442
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	627848740
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627849046
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627850276
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627851512
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627852769
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	627854017
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627854319
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627855526
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627856756
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	627857977
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627858278
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627859483
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	627860719
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	627861021
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	627862199
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: SafeProcessSearchMode	object name not found	627875128
File created	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	627875877
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 4D 53 46 54	success or wait	627881103
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 02 00 01 00	success or wait	627881945
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	627882208
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 09 04 00 00	success or wait	627882804
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	627883063
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 41 00	success or wait	627883654
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 00 00	success or wait	627883965
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 01 00	success or wait	627884223
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 00 00	success or wait	627884816
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 04 00 00 00	success or wait	627885074
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 0B 00 00 00	success or wait	627885908
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	627886506
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	627886766
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	627887358
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: A4 00 00 00	success or wait	627887616
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 0E 06 00 00	success or wait	627888756
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	627889014
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: FF FF FF FF	success or wait	627889608
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: FF FF FF FF	success or wait	627889865
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 20 00 00 00	success or wait	627890460
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 80 00 00 00	success or wait	627890718
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 19 00 00 00	success or wait	627891311
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 13 00 00 00	success or wait	627891568
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 44 Value: 00 00 00 00 64 00 00 00 C8 00 00 00 2C 01 00 00 90 01 00 00 F4 01 00 00 58 02 00 00 BC 02 00 00 20 03 00 00 84 03 00 00 E8 03 00 00	success or wait	627892181
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF C0 06 00 00 4C 04 00 00 0F 00 00 00	success or wait	627892780
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 40 01 00 00 E4 00 00 00 0F 00 00 00	success or wait	627893381
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 24 00 00 00 1C 00 00 00 0F 00 00 00	success or wait	627893980
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 60 00 00 00 40 00 00 00 0F 00 00 00	success or wait	627894578
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 80 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	627895176
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 02 00 00 68 01 00 00 0F 00 00 00	success or wait	627895776
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 02 00 00 FF FF FF FF 0F 00 00 00	success or wait	627896374
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 16 00 00 B0 0E 00 00 0F 00 00 00	success or wait	627896972
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 80 09 00 00 10 06 00 00 0F 00 00 00	success or wait	627897757
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 02 00 00 70 01 00 00 0F 00 00 00	success or wait	627898359
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	627898958
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	627899558
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	627900179
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	627900776
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	627901375
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 1100 Value: 24 21 00 00 FF FF FF FF 00 20 00 00 B0 1F 00 00 0F 00 00 00 B0 DC 22 00 76 00 00 00 80 00 00 00 30 C7 22 00 38 C9 22 00 40 CB 22 00 18 00 00 00 00 50 00 00 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF 01 00 D8 01 04 00 00 00 FF FF FF FF 00 00 00 00 70 6C 22 00 FF FF FF FF	success or wait	627902600
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 128 Value: 38 01 00 00 F0 00 00 00 50 01 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF 90 00 00 00 D8 00 00 00 A8 00 00 00 FF FF FF FF 60 00 00 00 20 01 00 00 18 00 00 00 FF FF FF FF FF FF FF FF 08 01 00 00 FF FF FF FF FF FF FF FF	success or wait	627904638
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 360 Value: 1D 12 42 48 9E 86 7A 47 B4 FC 30 7D 2E 2C 60 66 FE FF FF FF FF FF FF FF 6C DB 7C D2 6D AE CF 11 96 B8 44 45 53 54 00 00 00 00 00 00 FF FF FF FF 60 8E 59 C5 07 B3 D1 11 B2 7D 00 60 08 C3 FB FB 64 00 00 00 FF FF FF FF 6D DB 7C D2 6D AE CF 11 96 B8 44 45 53 54 00 00 C8 00 00 00 FF FF FF FF 6E DB 7C D2	success or wait	627905132
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 64 Value: 00 00 00 00 01 00 00 00 FF FF FF FF 10 00 00 00 C8 00 00 00 03 00 00 00 FF FF FF FF FF FF FF FF F4 01 00 00 01 00 00 00 FF FF FF FF FF FF FF FF 84 03 00 00 01 00 00 00 FF FF FF FF FF FF FF FF	success or wait	627905430
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 228 Value: 00 00 00 01 00 00 00 00 02 00 00 00 01 00 01 03 00 00 00 00 38 01 00 00 02 00 01 03 00 00 00 00 50 01 00 00 03 00 00 01 00 00 00 00 00 00 00 00 04 00 00 01 00 00 00 00 00 00 00 00 05 00 00 01 00 00 00 00 00 00 00 00 06 00 00 01 00 00 00 00 01 00 00 00 07 00 00 01 00 00 00 00 02 00 00 00 08 00 00 01	success or wait	627905852
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 28 Value: 20 01 00 00 00 00 00 00 02 00 00 00 2D 00 73 74 64 6F 6C 65 32 2E 74 6C 62 57 57 57	success or wait	627906125
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 512 Value: FF FF FF FF DC 06 00 00 C8 0D 00 00 FF FF FF FF 4C 06 00 00 FF FF FF FF 00 08 00 00 D8 0B 00 00 FF FF FF FF FF FF FF FF FF FF FF FF E8 0B 00 00 90 0D 00 00 28 0A 00 00 34 04 00 00 FF FF FF FF E4 07 00 00 34 02 00 00 44 0C 00 00 FF FF FF FF FF FF FF FF FF FF FF FF 94 04 00 00 20 0B 00 00 D0 07 00 00	success or wait	627906698
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 3760 Value: FF FF FF FF FF FF FF FF 15 00 B9 EB 53 68 6F 63 6B 77 61 76 65 46 6C 61 73 68 4F 62 6A 65 63 74 73 57 57 57 00 00 00 00 FF FF FF FF 0F 38 D6 B5 49 53 68 6F 63 6B 77 61 76 65 46 6C 61 73 68 57 64 00 00 00 FF FF FF FF 13 38 01 03 49 43 61 6E 48 61 6E 64 6C 65 45 78 63 65 70 74 69 6F 6E 57 C8 00 00 00	success or wait	627909202
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 1552 Value: 0F 00 53 68 6F 63 6B 77 61 76 65 20 46 6C 61 73 68 57 57 57 23 00 45 76 65 6E 74 20 69 6E 74 65 72 66 61 63 65 20 66 6F 72 20 53 68 6F 63 6B 77 61 76 65 20 46 6C 61 73 68 57 57 57 17 00 49 46 6C 61 73 68 46 61 63 74 6F 72 79 20 49 6E 74 65 72 66 61 63 65 57 57 57 1F 00 49 46 6C 61 73 68 4F 62 6A 65	success or wait	627911629
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 368 Value: 1D 00 FF 7F 01 00 00 00 1A 00 FF 7F 00 00 00 00 1A 00 0C 40 0C 00 0C 80 1D 00 FF 7F 25 00 00 00 1A 00 FF 7F 18 00 00 00 1A 00 00 40 18 00 00 80 1A 00 FE 7F 28 00 00 00 1A 00 13 40 17 00 13 80 1D 00 FF 7F 31 00 00 00 1A 00 FF 7F 40 00 00 00 1A 00 10 40 10 00 10 80 1A 00 FE 7F 50 00 00 00 1A 00 03 40	success or wait	627912143
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 60 12 00 00	success or wait	627913713
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627913975
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 30 Value: 00 00 03 00 03 80 00 00 00 00 00 00 34 00 14 04 00 00 00 00 00 00 00 00 00 00 A8 00 00 00	success or wait	627914249
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627919710
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 30 Value: 01 00 03 00 03 80 00 00 00 00 04 00 34 00 14 04 01 00 00 00 00 00 00 00 00 00 C0 00 00 00	success or wait	627919987
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627922061
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 30 Value: 02 00 0B 00 0B 80 00 00 00 00 08 00 34 00 14 04 03 00 00 00 00 00 00 00 00 00 D8 00 00 00	success or wait	627922335
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627924398
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 30 Value: 03 00 18 00 00 80 00 00 00 00 0C 00 44 00 24 04 02 00 01 00 00 00 00 00 00 00 D8 00 00 00	success or wait	627924670
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 12 Value: 0B 00 0B 80 FF FF FF FF 01 00 00 00	success or wait	627924932
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627925191
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 30 Value: 04 00 16 00 03 80 00 00 00 00 10 00 34 00 14 04 05 00 00 00 00 00 00 00 00 00 EC 00 00 00	success or wait	627925462
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627927667
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 30 Value: 05 00 18 00 00 80 00 00 00 00 14 00 44 00 24 04 04 00 01 00 00 00 00 00 00 00 EC 00 00 00	success or wait	627927940
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 12 Value: 16 00 03 80 FF FF FF FF 01 00 00 00	success or wait	627928201
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627928460
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 30 Value: 06 00 16 00 03 80 00 00 00 00 18 00 34 00 14 04 07 00 00 00 00 00 00 00 00 00 00 01 00 00	success or wait	627928733
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627930910
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 12 Value: 16 00 03 80 FF FF FF FF 01 00 00 00	success or wait	627931979
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627932237
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627934803
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 12 Value: 16 00 03 80 FF FF FF FF 01 00 00 00	success or wait	627935337
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627935594
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627938081
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627938869
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627941204
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 12 Value: 0B 00 0B 80 FF FF FF FF 01 00 00 00	success or wait	627941738
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627941995
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627944333
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627945123
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627947498
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627949101
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627950704
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627953185
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627955579
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627957926
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627960444
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627962791
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627965142
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627965937
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627968426
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627970806
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627973143
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627973933
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627976789
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627979277
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627980069
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627982409
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627983201
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627985539
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 12 Value: 0B 00 0B 80 FF FF FF FF 01 00 00 00	success or wait	627986075
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627986334
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627989013
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627989978
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627992324
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627993115
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627995453
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 12 Value: 0B 00 0B 80 FF FF FF FF 01 00 00 00	success or wait	627995986
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627996242
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	627998726
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 12 Value: 0B 00 0B 80 FF FF FF FF 01 00 00 00	success or wait	627999259
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	627999516
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628001869
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628002659
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628005017
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628008192
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628008979
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628393437
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628394238
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628401354
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628417517
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628420185
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628421020
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628424182
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628424975
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628429289
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628430088
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628432429
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628433715
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628437494
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628439261
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628441617
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 12 Value: 0B 00 0B 80 FF FF FF FF 01 00 00 00	success or wait	628442154
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628442413
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628445960
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628448450
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 12 Value: 0B 00 0B 80 FF FF FF FF 01 00 00 00	success or wait	628449527
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628449789
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628452113
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628452901
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628455226
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628456012
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628456799
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628457582
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628460099
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628462420
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 20 00	success or wait	628463209
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 2C 00	success or wait	628465567
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	628521067
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	628541730
File read	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 0 Value: unknown	success or wait	628560712
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 4D 53 46 54	success or wait	628560915
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 02 00 01 00	success or wait	628561199
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	628561427
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 09 04 00 00	success or wait	628561655
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	628561883
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 41 00	success or wait	628562112
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 00 00	success or wait	628562340
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 01 00	success or wait	628562565
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 2 Value: 00 00	success or wait	628562791
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 04 00 00 00	success or wait	628563020
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 0B 00 00 00	success or wait	628563247
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	628563475
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	628563734
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	628563962
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: A4 00 00 00	success or wait	628564189
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 0E 06 00 00	success or wait	628564418
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 00 00 00 00	success or wait	628564644
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: FF FF FF FF	success or wait	628564873
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: FF FF FF FF	success or wait	628565099
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 20 00 00 00	success or wait	628565327
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 80 00 00 00	success or wait	628565555
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 19 00 00 00	success or wait	628565782
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 4 Value: 13 00 00 00	success or wait	628566008
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 44 Value: 00 00 00 00 64 00 00 00 C8 00 00 00 2C 01 00 00 90 01 00 00 F4 01 00 00 58 02 00 00 BC 02 00 00 20 03 00 00 84 03 00 00 E8 03 00 00	success or wait	628566287
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	628568887
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	628569125
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	628569361
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	628569599
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 16 Value: FF FF FF FF 00 00 00 00 FF FF FF FF 0F 00 00 00	success or wait	628569835
File read	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 0 Value: unknown	success or wait	628571196
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	628573854
Key created	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}	success or wait	628575040
Key created	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0	success or wait	628580410
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0 Name: NULL	object name not found	628581658
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0 Name: NULL Type: unicode Data: Shockwave Flash Old data:	success or wait	628582246
Key created	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\FLAGS	success or wait	628583800
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\FLAGS Name: NULL	object name not found	628584947
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\FLAGS Name: NULL Type: unicode Data: 4 Old data:	success or wait	628585510
Key created	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\0	success or wait	628587217
Key created	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\0\win32	success or wait	628589357
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\0\win32 Name: NULL	object name not found	628590544
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\0\win32 Name: NULL Type: unicode Data: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Old data:	success or wait	628591257
Key created	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\HELPDIR	success or wait	628593182
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\HELPDIR Name: NULL	object name not found	628594834
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{4842121D-869E-477A-B4FC-307D2E2C6066}\1.0\HELPDIR Name: NULL Type: unicode Data: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0 Old data:	success or wait	628595482
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000} Name: NULL	success or wait	628597265
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000} Name: NULL	success or wait	628598308
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F} Name: NULL	success or wait	628599350
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: none Content Overwritten: true	success or wait	628600997
File read	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Offset: unknown Length: 64 Value: 4D 53 46 54 02 00 01 00 00 00 00 00 09 04 00 00 00 00 00 00 41 00 00 00 01 00 00 00 04 00 00 00 0B 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A4 00 00 00 0E 06 00 00 00 00 00 00 FF FF FF FF	success or wait	628602903
Section loaded	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\Word8.0\ShockwaveFlashObjects.exd Access: query and read Type: commit Baseaddress: 3010000 Size: 20480 Protection: readonly Mapped to pid: own pid	success or wait	628603543
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: none Content Overwritten: true	success or wait	628604829
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 64 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 01 00 00	success or wait	628605808
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 4 Value: 50 45 00 00	success or wait	628606583
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 20 Value: 4C 01 07 00 A1 BD 39 4F 00 00 00 00 00 00 00 00 E0 00 02 21	success or wait	628606798
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 40 Value: 2E 74 65 78 74 00 00 00 B9 0A 66 00 00 10 00 00 00 0C 66 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	628607202
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 40 Value: 2E 72 6F 64 61 74 61 00 E0 10 00 00 00 20 66 00 00 12 00 00 00 10 66 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	628607435
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 40 Value: 2E 72 64 61 74 61 00 00 32 1D 14 00 00 40 66 00 00 1E 14 00 00 22 66 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	628607664
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 40 Value: 2E 64 61 74 61 00 00 00 C4 7F 11 00 00 60 7A 00 00 E6 02 00 00 40 7A 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	628607892
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 40 Value: 2E 72 6F 64 61 74 61 00 A0 04 00 00 00 E0 8B 00 00 06 00 00 00 26 7D 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	628608121
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 40 Value: 2E 72 73 72 63 00 00 00 0C 0D 02 00 00 F0 8B 00 00 0E 02 00 00 2C 7D 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	628608349
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 04 00 00 00 02 00 0A 00	success or wait	628608958
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 8 Value: E0 11 00 80 70 00 00 80	success or wait	628609199
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 2 Value: 08 00	success or wait	628609786
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 8 Value: F2 11 00 80 90 00 00 80	success or wait	628610179
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 2 Value: 07 00	success or wait	628610764
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 14 Value: 54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	628610969
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 04 00 00 00 00 00 02 00	success or wait	628611937
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 8 Value: 01 00 00 00 48 02 00 80	success or wait	628612344
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 04 00 00 00 00 00 01 00	success or wait	628613118
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 8 Value: 1F 04 00 00 B0 08 00 00	success or wait	628613333
File read	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Offset: unknown Length: 16 Value: 34 24 8C 00 50 37 00 00 E4 04 00 00 00 00 00 00	success or wait	628613910
Section loaded	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Access: query and read Type: commit Baseaddress: 3000000 Size: 40960 Protection: readonly Mapped to pid: own pid	success or wait	628614179
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	628614827
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0 Name: NULL	success or wait	628616090
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\FLAGS Name: NULL	success or wait	628617021
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32 Name: NULL	success or wait	628618379
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000} Name: NULL	success or wait	628619762
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid Name: NULL	success or wait	628621219
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32 Name: NULL	success or wait	628622313
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib Name: NULL	success or wait	628623335
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6C-AE6D-11CF-96B8-444553540000}\TypeLib Name: Version	success or wait	628623894
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000} Name: NULL	success or wait	628625076
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid Name: NULL	success or wait	628625910
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\ProxyStubClsid32 Name: NULL	success or wait	628626998
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib Name: NULL	success or wait	628628017
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D27CDB6D-AE6D-11CF-96B8-444553540000}\TypeLib Name: Version	success or wait	628628561
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F} Name: NULL	success or wait	628629760
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\ProxyStubClsid Name: NULL	success or wait	628630670
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\ProxyStubClsid32 Name: NULL	success or wait	628631750
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib Name: NULL	success or wait	628632762
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{86230738-D762-4C50-A2DE-A753E5B1686F}\TypeLib Name: Version	success or wait	628633309
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32 Name: NULL	success or wait	628637463
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{000204EF-0000-0000-C000-000000000046}\4.0\9\win32 Name: NULL	success or wait	628641098
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020905-0000-0000-C000-000000000046}\8.3\0\win32 Name: NULL	success or wait	628644655
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32 Name: NULL	success or wait	628648190
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}\2.3\0\win32 Name: NULL	success or wait	628651788
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000} Name: Compatibility Flags	success or wait	628676988
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	628677899
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	628678698
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32 Name: InprocServer32	object name not found	628680777
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32 Name: NULL	success or wait	628682728
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000} Name: AppID	object name not found	628685033
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	628686831
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	628687605
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32 Name: InprocServer32	object name not found	628689680
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32 Name: NULL	success or wait	628691660
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000} Name: AppID	object name not found	628693971
Process information queried	PID: 1160 Info Class: SessionInformation	success or wait	628694779
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32 Name: ThreadingModel	success or wait	628696038
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	628697841
Section loaded	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Access: write and read and execute Type: commit Baseaddress: 3020000 Size: 8634368 Protection: execute Mapped to pid: own pid	success or wait	628698766
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	628700946
Section loaded	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx Access: query and write and read and execute Type: image Baseaddress: 10000000 Size: 9596928 Protection: read write Mapped to pid: own pid	success or wait	628701860
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx.2.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	629182835
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\Flash11f.ocx.2.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	629183731
Section loaded	Path: \KnownDlls\WINMM.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	629188022
File opened	Path: C:\WINDOWS\system32\WINMM.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	629188836
Section loaded	Path: C:\WINDOWS\system32\winmm.dll Access: query and write and read and execute Type: image Baseaddress: 76B40000 Size: 184320 Protection: read write Mapped to pid: own pid	success or wait	629189765
Section loaded	Path: \KnownDlls\WININET.dll Access: write and read and execute Type: unknown Baseaddress: 3D930000 Size: 942080 Protection: read write Mapped to pid: own pid	success or wait	629197804
Section loaded	Path: \KnownDlls\Normaliz.dll Access: write and read and execute Type: unknown Baseaddress: 3030000 Size: 36864 Protection: read write Mapped to pid: own pid	conflicting addresses	629205111
Section loaded	Path: \KnownDlls\urlmon.dll Access: write and read and execute Type: unknown Baseaddress: 78130000 Size: 1257472 Protection: read write Mapped to pid: own pid	success or wait	629215355
Section loaded	Path: \KnownDlls\iertutil.dll Access: write and read and execute Type: unknown Baseaddress: 3DFD0000 Size: 2002944 Protection: read write Mapped to pid: own pid	success or wait	629229817
Section loaded	Path: \KnownDlls\CRYPT32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	629241968
File opened	Path: C:\WINDOWS\system32\CRYPT32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	629242776
Section loaded	Path: C:\WINDOWS\system32\crypt32.dll Access: query and write and read and execute Type: image Baseaddress: 77A80000 Size: 610304 Protection: read write Mapped to pid: own pid	success or wait	629243665
Section loaded	Path: \KnownDlls\MSASN1.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	629248823
File opened	Path: C:\WINDOWS\system32\MSASN1.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	629249647
Section loaded	Path: C:\WINDOWS\system32\msasn1.dll Access: query and write and read and execute Type: image Baseaddress: 77B20000 Size: 73728 Protection: read write Mapped to pid: own pid	success or wait	629250560
Section loaded	Path: \KnownDlls\DSOUND.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	629260068
File opened	Path: C:\WINDOWS\system32\DSOUND.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	629261259
Section loaded	Path: C:\WINDOWS\system32\dsound.dll Access: query and write and read and execute Type: image Baseaddress: 73F10000 Size: 376832 Protection: read write Mapped to pid: own pid	success or wait	629262142
Section loaded	Path: \KnownDlls\COMDLG32.dll Access: write and read and execute Type: unknown Baseaddress: 763B0000 Size: 299008 Protection: read write Mapped to pid: own pid	success or wait	629277526
Section loaded	Path: \KnownDlls\WS2_32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	629653020
File opened	Path: C:\WINDOWS\system32\WS2_32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	629653886
Section loaded	Path: C:\WINDOWS\system32\ws2_32.dll Access: query and write and read and execute Type: image Baseaddress: 71AB0000 Size: 94208 Protection: read write Mapped to pid: own pid	success or wait	629654799
Section loaded	Path: \KnownDlls\WS2HELP.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	629660900
File opened	Path: C:\WINDOWS\system32\WS2HELP.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	629661717
Section loaded	Path: C:\WINDOWS\system32\ws2help.dll Access: query and write and read and execute Type: image Baseaddress: 71AA0000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	629662630
Section loaded	Path: \KnownDlls\d3d9.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	629669632
File opened	Path: C:\WINDOWS\system32\d3d9.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	629670787
Section loaded	Path: C:\WINDOWS\system32\d3d9.dll Access: query and write and read and execute Type: image Baseaddress: 4FDD0000 Size: 1728512 Protection: read write Mapped to pid: own pid	success or wait	629671915
Section loaded	Path: \KnownDlls\d3d8thk.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	629675559
File opened	Path: C:\WINDOWS\system32\d3d8thk.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	629676771
Section loaded	Path: C:\WINDOWS\system32\d3d8thk.dll Access: query and write and read and execute Type: image Baseaddress: 6D990000 Size: 24576 Protection: read write Mapped to pid: own pid	success or wait	629677684
Section loaded	Path: \KnownDlls\mscms.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	629693564
File opened	Path: C:\WINDOWS\system32\mscms.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	629694364
Section loaded	Path: C:\WINDOWS\system32\mscms.dll Access: query and write and read and execute Type: image Baseaddress: 73B30000 Size: 86016 Protection: read write Mapped to pid: own pid	success or wait	629695794
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave	success or wait	629717226
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave	success or wait	629718000
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave1	success or wait	629718706
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave1	success or wait	629719454
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave2	object name not found	629720152
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave3	object name not found	629720675
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave4	object name not found	629721382
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave5	object name not found	629722084
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave6	object name not found	629722787
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave7	object name not found	629723708
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave8	object name not found	629724410
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave9	object name not found	629725107
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi	success or wait	629725802
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi	success or wait	629726527
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi1	success or wait	629727215
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi1	success or wait	629727941
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi2	object name not found	629728644
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi3	object name not found	629729346
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi4	object name not found	629730046
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi5	object name not found	629730787
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi6	object name not found	629731539
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi7	object name not found	629732237
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi8	object name not found	629732985
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi9	object name not found	629733732
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux	success or wait	629734429
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux	success or wait	629735149
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux1	success or wait	629735835
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux1	success or wait	629736556
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux2	object name not found	629737779
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux3	object name not found	629738475
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux4	object name not found	629739173
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux5	object name not found	629739873
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux6	object name not found	629740566
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux7	object name not found	629741265
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux8	object name not found	629741963
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux9	object name not found	629742710
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaProperties\PrivateProperties\Joystick\Winmm Name: wheel	success or wait	629743537
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer	success or wait	629744359
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer	success or wait	629745087
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer1	success or wait	629745799
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer1	success or wait	629746526
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer2	object name not found	629747217
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer3	object name not found	629747962
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer4	object name not found	629748663
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer5	object name not found	629749366
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer6	object name not found	629750065
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer7	object name not found	629750762
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer8	object name not found	629751457
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer9	object name not found	629752191
File opened	Path: C:\WINDOWS\system32\urlmon.dll.123.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	629756087
File opened	Path: C:\WINDOWS\system32\urlmon.dll.123.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	629757079
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	629798188
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableImprovedZoneCheck	object name not found	629800630
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN Name: WINWORD.EXE	object name not found	629803310
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN Name: *	object name not found	629803882
File opened	Path: WMIDataDevice Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: normal Content Overwritten: true	success or wait	629809061
File opened	Path: WMIDataDevice Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: normal Content Overwritten: true	success or wait	629811449
Thread created	PID: 1160 TID: 1904 EIP: 7C8106F9 EAX: 77DF848A Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	629814033
Thread resumed	TID: 1904 PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	629814989
File opened	Path: C:\WINDOWS\system32\WININET.dll.123.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	629820365
File opened	Path: C:\WINDOWS\system32\WININET.dll.123.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	629821354
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	629861652
Mutant created	Name: \BaseNamedObjects\DirectSound DllMain mutex (0x00000488)	success or wait	629868311
Mutant created	Name: unknown	success or wait	629870062
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DirectX Name: GlitchInstrumentation	object name not found	629874581
System info queried	Type: ProcessorInformation	success or wait	629875849
Mutant created	Name: \BaseNamedObjects\DDrawWindowListMutex	success or wait	629898416
Mutant created	Name: \BaseNamedObjects\__DDrawExclMode__	success or wait	629898867
Mutant created	Name: \BaseNamedObjects\__DDrawCheckExclMode__	success or wait	629899297
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Direct3D Name: GeometryDriver	object name not found	629905585
Key value replaced with new	Path: HKEY_USERS\Software\Microsoft\Direct3D\MostRecentApplication Name: Name Type: unicode Data: WINWORD.EXE Old data: iexplore.exe	success or wait	629907245
System info queried	Type: ProcessorInformation	success or wait	629935193
Mutant created	Name: \BaseNamedObjects\{1B655094-FE2A-433c-A877-FF9793445069}	success or wait	629939352
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	629949002
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	629949765
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32 Name: InprocServer32	object name not found	629952541
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32 Name: NULL	success or wait	629954512
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000} Name: AppID	object name not found	629956756
Window created	Window Name: IPTR Class Name: IPTR HWND: 400E6	success	629980233
System info queried	Type: ProcessorInformation	success or wait	629981463
Key value queried	Path: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Name: ~MHz	success or wait	629985970
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	629986805
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\ss.sgn Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	629989205
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	629989878
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	629991377
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\ss.cfg Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	629992481
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	629993130
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	629995757
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\ss.sgn Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	629996869
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	629997554
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\mms.cfg Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	629999082
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\mms.cfg Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	629999752
File opened	Path: C:\WINDOWS\system32\mms.cfg Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	630000792
File opened	Path: C:\WINDOWS\system32\mms.cfg Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	630001504
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\oem.cfg Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	630002205
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\oem.cfg Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	630002871
File opened	Path: C:\WINDOWS\system32\oem.cfg Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	630003539
File opened	Path: C:\WINDOWS\system32\oem.cfg Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	630004235
System info queried	Type: ProcessorInformation	success or wait	630015493
System info queried	Type: ProcessorInformation	success or wait	630017136
System info queried	Type: ProcessorInformation	success or wait	630018880
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: AppData	success or wait	630069175
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: AppData Type: unicode Data: C:\Documents and Settings\Administrator\Application Data Old data:	success or wait	630070991
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630071658
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Adobe\Flash Player\AssetCache Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	file is a directory	630072863
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Adobe\Flash Player\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630074789
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Adobe\Flash Player\AssetCache\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630080378
Window created	Window Name: IPTR Class Name: IPTR HWND: 400F0	success	630106012
Section loaded	Path: \KnownDlls\ieframe.dll Access: write and read and execute Type: unknown Baseaddress: 3E1C0000 Size: 11096064 Protection: read write Mapped to pid: own pid	success or wait	630106920
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\IEXPLORE.EXE Name:	success or wait	630119694
File opened	Path: C:\Program Files\Internet Explorer\IEXPLORE.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	630120349
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup Name: IExploreLastModifiedLow	success or wait	630121769
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup Name: IExploreLastModifiedHigh	success or wait	630122524
File opened	Path: C:\WINDOWS\system32\ieframe.dll.123.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	630148500
File opened	Path: C:\WINDOWS\system32\ieframe.dll.123.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	630149422
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	630188988
File opened	Path: C:\WINDOWS\system32\en-US\ieframe.dll.mui Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630192186
Section loaded	Path: C:\WINDOWS\system32\en-us\ieframe.dll.mui Access: query and read Type: commit Baseaddress: 35B0000 Size: 1241088 Protection: write copy Mapped to pid: own pid	success or wait	630193247
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EAB22AC1-30C1-11CF-A7EB-0000C05BAE0B}\TypeLib Name: NULL	success or wait	630199809
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup Name: InstallStarted	object name not found	630200837
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{B722BCCB-4E68-101B-A2BC-00AA00404770}\ProxyStubClsid32 Name: NULL	success or wait	630201818
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{79EAC9C4-BAF9-11CE-8C82-00AA004BA90B}\ProxyStubClsid32 Name: NULL	success or wait	630202804
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{000214E6-0000-0000-C000-000000000046}\ProxyStubClsid32 Name: NULL	success or wait	630203776
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{93F2F68C-1D1B-11D3-A30E-00C04F79ABD1}\ProxyStubClsid32 Name: NULL	success or wait	630204741
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D27CDB6E-AE6D-11CF-96B8-444553540000} Name: Compatibility Flags	success or wait	630214325
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0002E005-0000-0000-C000-000000000046} Name: InsecureQI	object name not found	630215664
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus\1 Name: NULL	success or wait	630219612
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630221896
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630223051
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630226034
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 36E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630226842
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630228381
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 36E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630229183
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630231416
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 36E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630232221
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630233718
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 36E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630234515
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\FlashAuthor.cfg Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	630236169
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\FlashAuthor.cfg Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object name not found	630236898
File opened	Path: C:\WINDOWS\system32\Macromed\Flash\FlashPlayerTrust\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	object name not found	630237602
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#Security\FlashAuthor.cfg Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object path not found	630238403
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#Security\FlashAuthor.cfg Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object path not found	630239377
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#Security\FlashPlayerTrust\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	object path not found	630240248
File opened	Path: C:\WINDOWS\system32 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	630241935
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders Name: SecurityProviders	success or wait	630247891
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders Name: SecurityProviders	success or wait	630248241
Section loaded	Path: \KnownDlls\msapsspc.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	630248828
File opened	Path: C:\WINDOWS\system32\msapsspc.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630249869
Section loaded	Path: C:\WINDOWS\system32\msapsspc.dll Access: query and write and read and execute Type: image Baseaddress: 71E50000 Size: 86016 Protection: read write Mapped to pid: own pid	success or wait	630250648
Section loaded	Path: \KnownDlls\MSVCRT40.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	630254355
File opened	Path: C:\WINDOWS\system32\MSVCRT40.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630255430
Section loaded	Path: C:\WINDOWS\system32\msvcrt40.dll Access: query and write and read and execute Type: image Baseaddress: 78080000 Size: 69632 Protection: read write Mapped to pid: own pid	success or wait	630256230
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	630271004
Section loaded	Path: \KnownDlls\schannel.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	630271927
File opened	Path: C:\WINDOWS\system32\schannel.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630272637
Section loaded	Path: C:\WINDOWS\system32\schannel.dll Access: query and write and read and execute Type: image Baseaddress: 767F0000 Size: 163840 Protection: read write Mapped to pid: own pid	success or wait	630273426
Section loaded	Path: \KnownDlls\NETAPI32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	630278728
File opened	Path: C:\WINDOWS\system32\NETAPI32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630279453
Section loaded	Path: C:\WINDOWS\system32\netapi32.dll Access: query and write and read and execute Type: image Baseaddress: 5B860000 Size: 348160 Protection: read write Mapped to pid: own pid	success or wait	630281560
Section loaded	Path: \KnownDlls\digest.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	630295872
File opened	Path: C:\WINDOWS\system32\digest.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630297450
Section loaded	Path: C:\WINDOWS\system32\digest.dll Access: query and write and read and execute Type: image Baseaddress: 75B00000 Size: 86016 Protection: read write Mapped to pid: own pid	success or wait	630298232
Mutant created	Name: unknown	success or wait	630309010
Section loaded	Path: \KnownDlls\msnsspc.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	630309868
File opened	Path: C:\WINDOWS\system32\msnsspc.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630310953
Section loaded	Path: C:\WINDOWS\system32\msnsspc.dll Access: query and write and read and execute Type: image Baseaddress: 747B0000 Size: 290816 Protection: read write Mapped to pid: own pid	success or wait	630311744
Section loaded	Path: \KnownDlls\MSVCRT40.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	630314754
File opened	Path: C:\WINDOWS\system32\MSVCRT40.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630315470
Section loaded	Path: C:\WINDOWS\system32\msvcrt40.dll Access: query and write and read and execute Type: image Baseaddress: 78080000 Size: 69632 Protection: read write Mapped to pid: own pid	success or wait	630316314
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	630323034
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Name	success or wait	630324069
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Name	success or wait	630324412
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Comment	success or wait	630324771
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Comment	success or wait	630325113
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Capabilities	success or wait	630325448
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: RpcId	success or wait	630325786
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Version	success or wait	630326122
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Type	success or wait	630326456
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: TokenSize	success or wait	630326792
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Name	success or wait	630327638
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Name	success or wait	630327978
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Comment	success or wait	630328315
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Comment	success or wait	630328654
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Capabilities	success or wait	630328992
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: RpcId	success or wait	630329327
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Version	success or wait	630329664
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Type	success or wait	630330001
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: TokenSize	success or wait	630330337
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Name	success or wait	630331184
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Name	success or wait	630331521
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Comment	success or wait	630331853
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Comment	success or wait	630332186
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Capabilities	success or wait	630332521
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: RpcId	success or wait	630332857
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Version	success or wait	630333194
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Type	success or wait	630333525
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: TokenSize	success or wait	630333862
File opened	Path: C:\WINDOWS\system32\schannel.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630335419
Section loaded	Path: C:\WINDOWS\system32\schannel.dll Access: write and read and execute Type: commit Baseaddress: 36E0000 Size: 151552 Protection: execute Mapped to pid: own pid	success or wait	630336535
File opened	Path: C:\WINDOWS\system32\schannel.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630339418
Section loaded	Path: C:\WINDOWS\system32\schannel.dll Access: query and write and read and execute Type: image Baseaddress: 767F0000 Size: 163840 Protection: read write Mapped to pid: own pid	success or wait	630340192
Section loaded	Path: \KnownDlls\NETAPI32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	630344857
File opened	Path: C:\WINDOWS\system32\NETAPI32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630345552
Section loaded	Path: C:\WINDOWS\system32\netapi32.dll Access: query and write and read and execute Type: image Baseaddress: 5B860000 Size: 348160 Protection: read write Mapped to pid: own pid	success or wait	630346336
File opened	Path: C:\Program Files\AutoIt3 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	630356579
System info queried	Type: ProcessorInformation	success or wait	630358231
System info queried	Type: ProcessorInformation	success or wait	630380127
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630391432
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#SharedObjects Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	file is a directory	630392944
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630393754
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630395182
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630398218
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\WT8AYZWL\macromedia.com\support\flashplayer\sys\settings.sol Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	object path not found	630399366
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\#SharedObjects\WT8AYZWL\macromedia.com\support\flashplayer\sys\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	object path not found	630401364
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630404591
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630405806
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630411449
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630412584
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630414879
File read	Path: C:\Documents and Settings\Administrator\Application Data\Macromedia\Flash Player\macromedia.com\support\flashplayer\sys\settings.sol Offset: unknown Length: 16384 Value: 00 BF 00 00 02 12 54 43 53 4F 00 04 00 00 00 00 00 08 73 65 74 74 69 6E 67 73 00 00 00 00 00 07 64 6F 6D 61 69 6E 73 03 00 09 61 64 6F 62 65 2E 63 6F 6D 01 01 00 0E 6D 61 63 72 6F 6D 65 64 69 61 2E 63 6F 6D 01 01 00 0D 77 77 77 2E 61 64 6F 62 65 2E 63 6F 6D 01 01 00 0E 61 64 73 32 2E 6D 73 61 64 73	success or wait	630420102
Thread created	PID: 1160 TID: 292 EIP: 7C8106F9 EAX: 101DFB97 Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	630541640
Thread resumed	TID: 292 PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	630542449
System info queried	Type: ProcessorInformation	success or wait	630547022
System info queried	Type: ProcessorInformation	success or wait	630567176
System info queried	Type: ProcessorInformation	success or wait	630567630
System info queried	Type: ProcessorInformation	success or wait	630568066
System info queried	Type: ProcessorInformation	success or wait	630569993
System info queried	Type: ProcessorInformation	success or wait	630571119
System info queried	Type: ProcessorInformation	success or wait	630573215
System info queried	Type: ProcessorInformation	success or wait	630573618
System info queried	Type: ProcessorInformation	success or wait	630574639
System info queried	Type: ProcessorInformation	success or wait	630575087
System info queried	Type: ProcessorInformation	success or wait	630575630
System info queried	Type: ProcessorInformation	success or wait	630576141
System info queried	Type: ProcessorInformation	success or wait	630576699
System info queried	Type: ProcessorInformation	success or wait	630577378
System info queried	Type: ProcessorInformation	success or wait	630578043
System info queried	Type: ProcessorInformation	success or wait	630578444
System info queried	Type: ProcessorInformation	success or wait	630579065
System info queried	Type: ProcessorInformation	success or wait	630579804
System info queried	Type: ProcessorInformation	success or wait	630580486
System info queried	Type: ProcessorInformation	success or wait	630581099
System info queried	Type: ProcessorInformation	success or wait	630583305
System info queried	Type: ProcessorInformation	success or wait	630584234
System info queried	Type: ProcessorInformation	success or wait	630585199
System info queried	Type: ProcessorInformation	success or wait	630586158
System info queried	Type: ProcessorInformation	success or wait	630586815
System info queried	Type: ProcessorInformation	success or wait	630588222
System info queried	Type: ProcessorInformation	success or wait	630588741
System info queried	Type: ProcessorInformation	success or wait	630589156
System info queried	Type: ProcessorInformation	success or wait	630589572
System info queried	Type: ProcessorInformation	success or wait	630589979
System info queried	Type: ProcessorInformation	success or wait	630590388
System info queried	Type: ProcessorInformation	success or wait	630590859
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630646226
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630647418
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630649128
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630649917
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630651377
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630652169
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630654057
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630654865
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630656287
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630657082
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630658603
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630659721
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630661377
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630662169
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630663600
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630664391
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630666227
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630667017
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630668489
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630669286
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630670774
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630672797
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630674464
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630675255
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630676689
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630677516
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630679363
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630680159
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630682120
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630682916
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630684414
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630685529
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630687192
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630687983
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630689413
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630690263
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630692143
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630692939
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630694376
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630695169
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630696770
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630697899
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630699559
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630700348
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630701777
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630702568
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630704402
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630705196
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630706618
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630707409
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630708899
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630710020
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630711725
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630712519
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630714009
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630714802
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630716639
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630717431
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630718852
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630719643
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630721133
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630722249
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630723907
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630725230
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630726665
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630727758
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630731178
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630731990
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630733418
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630734215
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630735722
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630736843
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630738505
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630739313
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630740746
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630741542
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630743395
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630744193
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630745613
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630746404
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630747981
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630749105
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630750766
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630751557
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630752989
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630753823
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630755664
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630756457
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630757882
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630758675
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630760166
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630761279
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630762983
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630763778
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630765211
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630766004
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630768385
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630769237
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630770666
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630771458
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630772944
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630774064
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630775723
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630776511
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630777938
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630778730
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630780565
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630781360
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630782831
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630784487
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630786248
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630787373
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630789047
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630789837
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	630791268
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630792059
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630794713
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630796951
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630798508
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630799623
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630802070
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630804288
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630806909
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630809114
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630811144
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630812264
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630814708
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630816926
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630819543
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630821756
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630823245
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630824361
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630826847
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630829063
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630831693
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630833945
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630835436
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630836554
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630839140
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630842313
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630845008
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630849385
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630851032
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630852963
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630855975
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630858753
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630861380
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630864996
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630866495
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630867615
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630870115
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630872342
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630874975
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630877195
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630878688
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630879811
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630882297
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630884528
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630887164
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630889383
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630890871
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630891989
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630894458
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630897525
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630900327
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630902543
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630904128
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630905244
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630907734
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630909957
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630912627
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630914847
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630916328
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630917444
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630919882
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630922107
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630924733
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630926994
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630928534
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630929660
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630932168
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630934398
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630937035
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630939780
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630941265
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630942384
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630944837
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630947064
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630949685
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630952013
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630954865
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630955997
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630958452
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630962510
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630965399
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630967620
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630969888
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630971010
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630973466
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630977139
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630979778
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630982534
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630984037
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630985164
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630987612
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630989832
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630992461
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630994672
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	630996183
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	630997325
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	630999835
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631002069
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631004700
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631046636
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631304924
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631307492
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631311694
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631314387
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631316860
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631320246
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631322745
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631327090
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631329746
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631331965
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631334590
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631337078
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631339296
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631341949
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631344281
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631347058
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631349509
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631351730
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631354396
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631356618
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631359380
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631361827
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631364050
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631366686
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631369446
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631372059
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631374501
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631376718
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631379346
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631381557
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631384198
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631386646
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631388863
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631391540
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631393761
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631396360
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631399165
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631401574
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631404218
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631406478
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631409819
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631412816
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631415046
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631417670
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631419781
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631422390
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631424833
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631427103
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631429789
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631432012
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631434617
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631437062
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631439285
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631441954
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631444180
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631446783
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631449252
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631451477
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631454475
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631566705
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631569709
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631679635
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631681929
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631687489
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631690338
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631693170
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631697341
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631699577
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631706632
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631710395
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631716826
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631719318
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631722127
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631724779
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631733425
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631737482
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631739938
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631742364
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631751191
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631753429
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631757662
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631760122
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631769551
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631772359
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631774583
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631784192
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631787705
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631790399
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631806530
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631808915
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631811554
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631831248
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631833492
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631837177
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631855483
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631858166
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631864778
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631867014
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631870660
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631881361
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	631884237
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631887226
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631895884
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631898564
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631902203
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631913963
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631916336
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631919595
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631921815
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631928983
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631931699
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631935425
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631937648
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631945638
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631947869
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631950987
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631953190
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631962241
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631964462
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631967341
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631971934
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631978006
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631980285
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631984501
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631988462
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631994533
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	631998251
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632000932
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632003664
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632008726
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632010946
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632015447
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632017699
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632022796
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632025025
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632027654
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632029894
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632034946
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632037161
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632039791
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632042005
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632047075
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632049297
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632051922
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632054177
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632059746
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632061995
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632064626
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632066894
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632072769
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632075887
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632078544
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632081399
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632086846
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632089879
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632092531
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632096770
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632103230
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632105945
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632109217
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632111508
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632116608
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632118837
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632121471
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632123684
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632129181
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632131420
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632134047
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632136265
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632141328
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632144083
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632146766
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632148979
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632154092
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632156308
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632158980
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632161197
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632166270
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632168493
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632171112
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632173369
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632178432
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632180650
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632183798
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632186572
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632191638
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632193859
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632196521
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632198738
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632203812
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632206036
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632208665
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632210880
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632215993
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632218268
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632220903
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632223111
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632228225
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632231006
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632233642
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632235858
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632241280
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632243506
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632246185
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632248400
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632253465
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632255715
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632258388
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632260606
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632265648
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632267902
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632270527
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632273284
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632278331
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632280544
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632283158
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632285364
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632290496
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632292718
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632295983
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632298204
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632303284
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632305552
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632308183
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632310400
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632315980
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632318203
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632320828
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632323039
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632328078
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632330334
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632332985
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632335199
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632340295
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632342517
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632345165
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632347375
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632353113
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632355340
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632358484
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632360642
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632365757
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632367973
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632370596
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632372859
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632377905
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632380121
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632382741
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632385005
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632390102
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632392315
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632394934
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632397153
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632402741
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632404926
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632407845
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632410111
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632415174
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632417438
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632420070
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632422287
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632427330
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632429590
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632432285
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632434505
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632439551
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632441770
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632444934
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632447148
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632452202
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632454423
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632457042
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632459324
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632464798
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632467024
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632469654
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632471862
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632476955
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632479171
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632481824
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632484047
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632489630
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632491852
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632494480
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632496697
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632501780
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632504049
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632506679
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632508892
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632513937
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632516198
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632518970
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632521373
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632526451
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632528672
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632531826
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632534040
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632539130
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632541353
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632543973
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632546234
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632551276
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632553521
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632556149
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632558405
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632563459
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632565673
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632568287
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632570499
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632579452
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632581683
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632584310
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632586524
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632591630
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632593840
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632596468
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632598684
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632603759
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632605983
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632608617
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632610865
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632616465
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632618741
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632621368
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632623578
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632628648
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632631884
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632636589
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632638825
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632645221
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632647509
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632651453
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632653677
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632659270
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632661491
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632664119
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632666327
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632671368
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632673625
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632676256
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632678474
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632683518
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632686080
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632688771
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632690982
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632696030
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632698308
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632700935
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632703740
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632708781
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632710998
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632713618
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632715849
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632720950
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632723178
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632725800
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632728036
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632733123
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632735345
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632737967
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632740182
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632747107
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632749336
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632753823
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632756302
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632762158
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	632764380
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633148596
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633150889
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633157162
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633159447
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633162952
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633166734
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633171864
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633174635
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633177265
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633179485
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633184544
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633186766
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633189702
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633191926
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633196975
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633199253
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633201883
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633204142
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633209177
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633211391
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633214019
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633216230
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633221871
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633224099
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633226719
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633228934
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633234026
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633236243
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633238862
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633241081
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633246596
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633248822
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633251456
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633253667
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633258708
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633261460
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633264079
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633266289
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633271363
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633273586
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633276256
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633278473
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633283553
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633285778
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633288439
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633290661
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633295768
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633297987
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633300722
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633303497
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633308709
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633310937
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633313561
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633315768
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633320848
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633323118
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633325739
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633327954
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633333040
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633335264
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633337889
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633340099
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633345192
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633347945
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633350570
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633352779
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633358163
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633360590
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633363282
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633365509
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633370559
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633372774
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633375437
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633377651
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633382682
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633384933
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633387557
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633390320
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633395369
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633397583
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633400251
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633402523
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633407616
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633409832
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633412789
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633416481
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633421810
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633424034
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633426662
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633428881
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633434694
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633436943
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633439574
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633441796
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633446904
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633449124
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633451751
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633453969
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633459004
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633461268
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633463895
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633466111
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633471616
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633473845
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633477029
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633479251
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633484422
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633486651
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633489320
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633491536
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633496579
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633498801
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633501432
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633503685
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633508802
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633511022
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633513645
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633515860
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633521449
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633523810
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633526603
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633528820
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633533903
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633536134
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633538763
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633540868
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633545953
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633548186
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633550814
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633553031
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633558174
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633560929
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633563555
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633565781
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633570821
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633573039
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633575693
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633577973
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633583296
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633585544
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633588172
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633590411
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633595455
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633597678
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633600301
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633602513
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633608104
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633610325
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633612953
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633615170
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633620264
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633622487
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633625110
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633627359
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633632448
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633634678
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633637649
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633639867
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633644921
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633647699
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633650394
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633652605
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633657644
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633659866
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633662540
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633664755
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633669795
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633672013
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633674693
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633676915
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633681959
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633684174
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633686854
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633689616
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633695111
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633697339
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633699999
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633702212
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633707297
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633709518
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633712140
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633714406
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633719475
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633721757
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633724380
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633726593
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633732179
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633734406
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633737023
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633739240
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633744274
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633746530
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633749587
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633751805
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633756857
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633759077
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633761748
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633763965
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633769003
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633771276
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633773902
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633776643
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633781677
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633783890
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633786532
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633788748
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633793922
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633796143
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633798761
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633800972
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633806139
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633808574
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633811207
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633813420
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633819015
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633821242
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633823867
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633826082
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633831131
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633833382
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633836015
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633838260
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633843357
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633845575
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633848239
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633850459
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633855500
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633857723
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633861067
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633863460
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633868630
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633870852
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633873481
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633875735
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633880781
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633883007
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633885626
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633887865
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633892956
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633895189
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633897824
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633900047
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633905648
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633907876
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633910508
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633913590
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633919055
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633921280
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633923908
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633926121
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633931161
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633933404
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633936073
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633938296
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633943340
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633945564
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633948804
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633951022
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633956061
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633958281
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633960937
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633963158
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633968196
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633970414
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633973415
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633975678
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633980730
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633982943
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633985602
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633987825
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633993380
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633995594
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	633998216
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634000430
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634005517
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634007789
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634010413
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634012630
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634017671
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634019936
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634022559
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634024817
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634030298
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634033063
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634035697
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634037908
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634042976
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634045200
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634047863
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634050077
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634055122
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634057391
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634060013
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634062266
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634067317
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634069536
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634072162
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634074373
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634080001
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634082224
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634085320
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634087537
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634092658
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634094878
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634097505
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634099713
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634104848
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634107075
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634109696
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634111897
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634116927
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634119695
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634122324
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634124535
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634129614
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634131845
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634134501
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634136710
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634142273
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634144902
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634147570
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634149841
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634154893
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634157112
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634159734
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634162477
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634167525
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634169744
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634172370
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634174580
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634179726
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634181946
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634184572
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634186781
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634191852
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634194075
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634196882
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: write and read and execute Type: commit Baseaddress: 39E0000 Size: 12312576 Protection: execute Mapped to pid: own pid	success or wait	634199294
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32 Name: NULL	success or wait	634204338
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	634210022
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	634210740
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	634211846
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	634212525
Process information queried	PID: 1160 Info Class: SessionInformation	success or wait	634213123
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: ForceNpxEmulation	object name not found	634231650
Mutant created	Name: unknown	success or wait	634234577
File created	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~WRD0002.doc Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	634237873
File created	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Access: read attributes and synchronize and generic write Options: sequential only and synchronous io non alert and non directory file and open no recall Attributes: temporary Content Overwritten: true	success or wait	634249185
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	634252763
File write	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 60 Value: 02 00 09 00 00 03 00 00 00 00 00 00 00 00 00 00 00 00 03 00 00 00 1E 00 05 00 00 00 0B 02 00 00 00 00 05 00 00 00 0C 02 C0 00 C0 00 05 00 00 00 07 01 04 00 00 00 22 D8 00 00 43 0F	success or wait	634255651
File write	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 110654 Value: 20 00 CC 00 00 00 C0 00 C0 00 00 00 00 00 C0 00 C0 00 00 00 00 00 28 00 00 00 C0 00 00 00 40 FF FF FF 01 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634780970
File write	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 14 Value: 04 00 00 00 27 01 FF FF 03 00 00 00 00 00	success or wait	634789015
File write	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 18 Value: 01 00 09 00 00 03 44 D8 00 00 00 00 22 D8 00 00 00 00	success or wait	634789499
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	634791034
Section loaded	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Access: query and read Type: commit Baseaddress: 39F0000 Size: 114688 Protection: readonly Mapped to pid: own pid	success or wait	634792091
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	634793073
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	634795224
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: 01 00 09 00 00 03 44 D8 00 00 00 00 22 D8 00 00 00 00 03 00 00 00 1E 00 05 00 00 00 0B 02 00 00 00 00 05 00 00 00 0C 02 C0 00 C0 00 05 00 00 00 07 01 04 00 00 00 22 D8 00 00 43 0F 20 00 CC 00 00 00 C0 00 C0 00 00 00 00 00 C0 00 C0 00 00 00 00 00 28 00 00 00 C0 00 00 00 40 FF FF FF 01 00 18 00 00 00	success or wait	634796672
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634873487
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634876212
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634878923
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634881630
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634884323
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634887332
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634890310
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634893572
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634896268
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634900977
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634903799
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634906514
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634909260
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634912029
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634914724
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634916764
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634919501
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634923397
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634926112
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634928909
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634931586
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634934820
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634937507
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634940221
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634942894
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 4096 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634945573
File read	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Offset: unknown Length: 136 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634948815
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.MSO\3430B573.wmf Access: read attributes and delete Options: non directory file and open for backup ident and open reparse point Overwritten: false	success or wait	634976602
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~WRD0002.doc Offset: unknown Length: 581 Value: FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	634989114
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	634990890
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	634991572
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32 Name: InprocServer32	object name not found	634993448
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32 Name: NULL	success or wait	634997294
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000} Name: AppID	object name not found	635001006
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID Name: NULL	success or wait	635002298
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0\0\win32 Name: NULL	success or wait	635064595
Window shown	HWND: 90058 CMD: show	error	635066230
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635066842
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	635072231
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635072880
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635073118
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	635073375
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	635073818
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635074059
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	635074297
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635074534
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635074766
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635075618
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Keyname: 9	success or wait	635077731
Key deleted	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	success or wait	635078628
Key deleted	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency	success or wait	635079409
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	635080911
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency	success or wait	635086059
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery	success or wait	635086807
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery\2A9B4	success or wait	635087646
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery\2A9B4 Name: 2A9B4 Type: binary Data: 04 00 00 00 88 04 00 00 44 00 00 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 2E 00 64 00 6F 00 63 00 10 00 00 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 00 00 00 00 01 00 00 00 00 00 00 00 C5 C4 CB 7C AB 7B CD 01 B4 A9 02 00 B4 A9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 Old data:	success or wait	635088903
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Outlook\Security Name: OutlookSecureTempFolder	object name not found	635090178
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag Name: DisableDocumentAssemblies	object name not found	635091538
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	635091991
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	635092476
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	635092883
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: ProInfo	success or wait	635093360
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: NoTTP	object name not found	635101985
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet Name: UseOnlineContent	success or wait	635102335
Message posted	HWND: 50136 Message: DDE_ACK WParam: 524352 LParam: 55447496	success	635130760
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: TOOLS-PATH	object name not found	635167600
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635168778
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635170637
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: Proof	success or wait	635171914
File created	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Attributes: normal Content Overwritten: true	success or wait	635172742
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635176209
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools Location Name: proof	object name not found	635177828
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: CommonFilesDir	success or wait	635178400
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	635180066
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635184891
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635187106
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635189203
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635191331
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635194006
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635196119
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635198213
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635200330
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635202996
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635205210
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635207406
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635209598
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635211830
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635214036
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635216213
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635218383
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635220606
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635222766
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635224892
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635227006
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635229143
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635231249
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635233321
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635235977
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635238166
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635240301
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635242388
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635244938
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635247094
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635249203
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635251334
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635253442
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635255573
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635257836
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635260135
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635262255
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635264429
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635266535
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635268640
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635270754
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635272887
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635275070
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635277147
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635279795
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635281926
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635284034
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635286111
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635288221
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635290348
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635292585
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635294768
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635296971
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635299194
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635301296
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635303372
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635305489
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635307705
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635309936
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635312112
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635314523
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635316754
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635319003
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635321600
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635323719
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635325877
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635327985
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635330061
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635332182
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635334371
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635336518
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635338603
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635340714
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635342852
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635345123
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635347291
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635349490
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635351719
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635353943
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635356114
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635358288
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635360509
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635362707
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635365407
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635367582
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635370258
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635372468
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635374636
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635376802
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635379070
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635381277
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635383450
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635385626
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	635387854
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	635389259
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\GdiPlus.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	635400620
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\GDIPLUS.DLL Access: write and read and execute Type: commit Baseaddress: 39F0000 Size: 1703936 Protection: execute Mapped to pid: own pid	success or wait	635401452
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\GdiPlus.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	635404678
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\GDIPLUS.DLL Access: query and write and read and execute Type: image Baseaddress: 39F0000 Size: 1708032 Protection: read write Mapped to pid: own pid	conflicting addresses	635405492
Section loaded	Path: \KnownDlls\WTSAPI32.DLL Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	635524811
File opened	Path: C:\WINDOWS\system32\WTSAPI32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	635525539
Section loaded	Path: C:\WINDOWS\system32\wtsapi32.dll Access: query and write and read and execute Type: image Baseaddress: 76F50000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	635526316
Section loaded	Path: \KnownDlls\WINSTA.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	635529688
File opened	Path: C:\WINDOWS\system32\WINSTA.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	635530375
Section loaded	Path: C:\WINDOWS\system32\winsta.dll Access: query and write and read and execute Type: image Baseaddress: 76360000 Size: 65536 Protection: read write Mapped to pid: own pid	success or wait	635531138
Thread created	PID: 1160 TID: 1624 EIP: 7C8106F9 EAX: 3B3191B Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	635539392
Thread resumed	TID: 1624 PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	635540193
Mutant created	Name: unknown	success or wait	635544993
Window created	Window Name: IPTR Class Name: IPTR HWND: 70100	success	635569671
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 1624 Hook ID: keyboard	success	635569942
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 1624 Hook ID: mouse	success	635570168
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF Name: Disable Thread Input Manager	object name not found	635571074
Foreground Window Got	HWND: 5012E	success	635599049
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared Name: CUAS	success or wait	635605124
Message posted	TID: 7DC Message: C088 WParam: 0 LParam: 0	success	635607885
Message sent	HWND: 5012E Message: PAINT WParam: 0 LParam: 0	error	635612899
Message sent	HWND: 90058 Message: PAINT WParam: 0 LParam: 0	error	635613191
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	635613483
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635613935
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635614539
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	635615578
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635620660
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	635621228
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635622794
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635623126
Message sent	HWND: 90058 Message: NCPAINT WParam: 1 LParam: 0	error	635624457
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	635640385
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	635640899
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	635641315
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: ProInfo	success or wait	635641796
Window created	Window Name: IPTR Class Name: IPTR HWND: 30126	success	635653232
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	635654981
Message sent	HWND: 5012E Message: NCPAINT WParam: 1 LParam: 0	error	635655700
Thread created	PID: 1160 TID: 496 EIP: 7C8106F9 EAX: 101DFB97 Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	635660017
Thread resumed	TID: 496 PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	635665205
Message posted	HWND: 30126 Message: 401 WParam: 1 LParam: 53076984	success	635669929
Message posted	HWND: 30126 Message: 401 WParam: 1 LParam: 53076984	success	635761453
Message posted	HWND: 30126 Message: 401 WParam: 1 LParam: 53076984	success	643649079
Message posted	HWND: 30126 Message: 401 WParam: 1 LParam: 53076984	success	647413246
Message posted	HWND: 30126 Message: 401 WParam: 1 LParam: 53076984	success	651086188
Message posted	HWND: 30126 Message: 401 WParam: 1 LParam: 53076984	success	654781512
Message posted	HWND: 30126 Message: 401 WParam: 1 LParam: 53076984	success	658472418
Message posted	HWND: 30126 Message: 401 WParam: 1 LParam: 53076984	success	662160312
Message posted	HWND: 30126 Message: 401 WParam: 1 LParam: 53076984	success	665907862
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	669473496
File created	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	669475883
File read	Path: C:\Documents and Settings\Administrator\Desktop\iPhone 5 Battery.doc Offset: unknown Length: 90112 Value: C9 DF 16 87 9B 99 9A 9B 98 9D 9E 9F 6F 6E 92 93 2C 95 96 97 E8 E9 EA EB AC ED EE EF E0 E1 E2 E3 E4 E5 E6 E7 F8 F9 FA FB FC FD FE FF F0 F1 F2 F3 F4 F5 F6 F7 C8 C9 CA CB CC CD CE CF 38 C1 C2 C3 CA DA 7C C9 D8 6D D3 16 FD 65 DF 93 1D F0 86 BB BD A6 F6 A7 5A 46 4D 59 4D 40 0E 4C 41 4F 4C 4C 50 05 44 42	success or wait	669487744
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Offset: unknown Length: 90112 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65	success or wait	669610398
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Access: read data or list directory and execute or traverse and read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	669622252
Section loaded	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Access: query and write and read and execute and extend size Type: image Baseaddress: 76360000 Size: 65536 Protection: read write Mapped to pid: own pid	success or wait	669623045
Message posted	HWND: 30126 Message: 401 WParam: 1 LParam: 53076984	success	669634995
File opened	Path: C:\WINDOWS\system32\Apphelp.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	669640062
Section loaded	Path: C:\WINDOWS\system32\apphelp.dll Access: write and read and execute Type: commit Baseaddress: FF20000 Size: 126976 Protection: execute Mapped to pid: own pid	success or wait	669640876
File opened	Path: C:\WINDOWS\system32\Apphelp.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	669645904
Section loaded	Path: C:\WINDOWS\system32\apphelp.dll Access: query and write and read and execute Type: image Baseaddress: 77B40000 Size: 139264 Protection: read write Mapped to pid: own pid	success or wait	669646669
File opened	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	669656024
Section loaded	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read Type: commit Baseaddress: 24C30000 Size: 1208320 Protection: readonly Mapped to pid: own pid	success or wait	669656803
File opened	Path: C:\WINDOWS\AppPatch\systest.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	object name not found	669658565
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter Name: Installed	success or wait	669660331
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	669660953
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	669661416
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	669665238
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	669666514
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	669669237
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	669670757
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	669675811
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	669677074
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	669678362
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: TransparentEnabled	success or wait	669681566
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: AuthenticodeEnabled	success or wait	669681829
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: Levels	object name not found	669686080
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} Name: ItemData	success or wait	669757228
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} Name: SaferFlags	success or wait	669758420
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} Name: ItemData	success or wait	669760040
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} Name: HashAlg	success or wait	669760454
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} Name: ItemSize	success or wait	669760854
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} Name: SaferFlags	success or wait	669761252
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} Name: ItemData	success or wait	669762781
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} Name: HashAlg	success or wait	669763186
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} Name: ItemSize	success or wait	669763589
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} Name: SaferFlags	success or wait	669763991
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} Name: ItemData	success or wait	669764754
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} Name: HashAlg	success or wait	669765157
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} Name: ItemSize	success or wait	669765557
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} Name: SaferFlags	success or wait	669765961
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} Name: ItemData	success or wait	669767131
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} Name: HashAlg	success or wait	669767535
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} Name: ItemSize	success or wait	669767937
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} Name: SaferFlags	success or wait	669768337
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} Name: ItemData	success or wait	669769231
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} Name: HashAlg	success or wait	670149655
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} Name: ItemSize	success or wait	670150077
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} Name: SaferFlags	success or wait	670150483
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: DefaultLevel	success or wait	670156505
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: PolicyScope	success or wait	670163687
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	670168344
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	670169649
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	670170958
Section loaded	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Access: query and read Type: commit Baseaddress: FF20000 Size: 90112 Protection: readonly Mapped to pid: own pid	success or wait	670173177
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cache	buffer overflow	670174723
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cache	success or wait	670175081
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: LogFileName	object name not found	670177007
System info queried	Type: WatchdogTimerHandler	success or wait	670178648
Process created	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Cmdline: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Createflags: none	success or wait	670178841
Process information queried	PID: 1112 Info Class: BasicInformation	success or wait	670181864
Memory read	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7FFDB008 Length: 4 Value: 00 00 40 00	success or wait	670182064
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	670182356
Memory read	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 400000 Length: 4096 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 11 F8 01 BB 55 99 6F E8 55 99 6F E8 55 99 6F E8 2E 85 63 E8 54 99 6F E8 3A 86 65 E8 5E 99 6F E8 D6 85 61 E8 54 99 6F E8 3A 86 6B E8 57 99 6F E8 AF BA 76 E8 51 99 6F E8 46 91 32 E8 57 99 6F E8 D6 91 32 E8 50 99 6F E8 55 99 6E E8 04 99 6F E8 92 9F 69 E8 54 99 6F E8 BD 86 64 E8 57 99 6F E8 52 69 63 68 55 99 6F E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4C 01 04	success or wait	670183838
Memory read	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 406000 Length: 256 Value: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 58 00 00 80 18 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 65 00 00 00 30 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 04 08 00 00 48 00 00 00 60 60 00 00 00 F0 00 00 00 00 00 00 00 00 00 00 03 00 44 00 4C 00 4C 00 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 D1 D9 B8 42 95 B8 D6 11 95 B8 D6 11 95 B8 D6 11 6F 9B CF 11 97 B8 D6 11 B2 7E AD 11 97 B8 D6	success or wait	670186684
Process information queried	PID: 1112 Info Class: BasicInformation	success or wait	670188070
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 10000 Length: 12DFE4 Allocation Type: unknown Protection: page read and write	success or wait	670189397
Memory written	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 10000 Length: 2116 Value: 3D 00 3A 00 3A 00 3D 00 3A 00 3A 00 5C 00 00 00 3D 00 5A 00 3A 00 3D 00 5A 00 3A 00 5C 00 00 00 41 00 4C 00 4C 00 55 00 53 00 45 00 52 00 53 00 50 00 52 00 4F 00 46 00 49 00 4C 00 45 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 6C 00 6C 00 20 00 55 00 73 00 65 00 72 00 73 00 00 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 41 00 70 00 70 00 6C 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20	success or wait	670191293
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 20000 Length: 12DFE4 Allocation Type: unknown Protection: page read and write	success or wait	670191727
Memory written	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 20000 Length: 1828 Value: 00 10 00 00 24 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 00 08 02 90 02 00 00 00 00 00 00 68 01 6A 01 98 04 00 00 50 00 52 00 04 06 00 00 50 00 52 00 58 06 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 50 00 52 00 AC 06 00 00 1E 00 20 00 00 07 00 00 00 00 02 00 20 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	670193169
Memory written	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7FFDB010 Length: 4 Value: 00 00 02 00	success or wait	670193545
Memory written	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7FFDB1E8 Length: 4 Value: 00 00 00 00	success or wait	670193835
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 30000 Length: 12E250 Allocation Type: unknown Protection: page read and write	success or wait	670194115
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 12E000 Length: 12E24C Allocation Type: unknown Protection: page read and write	success or wait	670194361
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 12E000 Length: 1000 New Protection: page read and write and page guard New Protection: page read and write	success or wait	670194728
Thread created	PID: 1112 TID: 1116 EIP: 7C810705 EAX: 4032AC Imagepath: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	success or wait	670195302
Thread resumed	TID: 1116 PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	success or wait	670709093
Process information queried	PID: 1112 Info Class: BasicInformation	success or wait	670710495
File created	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	671090526
File read	Path: C:\Documents and Settings\Administrator\Desktop\iPhone 5 Battery.doc Offset: unknown Length: 21504 Value: 32 2C F5 05 47 56 E2 18 FA FB FC FD FE FF F0 F1 F2 F3 F4 F5 F6 F7 C8 C9 F4 CB CF CD 30 30 C9 C1 C4 C3 C4 C5 C6 C7 D8 D9 DA DB DC DD DF DF D0 D1 F7 D3 D4 D5 D6 D7 28 29 2A 3B 2C 2D 09 2F 20 21 23 23 24 25 D8 D8 C7 C6 3A 3B 3C 3D 1A 3F 30 31 CD CC CB CA C9 C8 F7 F6 F5 F4 F3 F2 F1 F0 FF FE FD FC FB FA	success or wait	671097579
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc Offset: unknown Length: 21504 Value: D0 CF 11 E0 A1 B1 1A E1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3E 00 03 00 FE FF 09 00 06 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 25 00 00 00 00 00 00 00 00 10 00 00 27 00 00 00 01 00 00 00 FE FF FF FF 00 00 00 00 24 00 00 00 FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF FF	success or wait	671126430
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: read data or list directory and execute or traverse and read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	671132252
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: query and write and read and execute and extend size Type: image Baseaddress: FF20000 Size: 90112 Protection: readonly Mapped to pid: own pid	success or wait	671132995
File opened	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	671134531
Section loaded	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read Type: commit Baseaddress: 24C30000 Size: 1208320 Protection: readonly Mapped to pid: own pid	success or wait	671135294
File opened	Path: C:\WINDOWS\AppPatch\systest.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	object name not found	671136902
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter Name: Installed	success or wait	671137603
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	671138224
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	671138678
File opened	Path: C:\WINDOWS\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	671141683
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	671144866
Process information queried	PID: 1160 Info Class: DeviceMap	success or wait	671146950
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: read data or list directory and execute or traverse and read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	671152999
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: write and read and execute Type: commit Baseaddress: FF30000 Size: 389120 Protection: execute Mapped to pid: own pid	success or wait	671153799
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	671156230
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: query and read Type: commit Baseaddress: FF30000 Size: 389120 Protection: readonly Mapped to pid: own pid	success or wait	671157027
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: read data or list directory and execute or traverse and read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	671162952
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: write and read and execute Type: commit Baseaddress: FF30000 Size: 389120 Protection: execute Mapped to pid: own pid	success or wait	671163754
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	671165472
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: query and read Type: commit Baseaddress: FF30000 Size: 389120 Protection: readonly Mapped to pid: own pid	success or wait	671166265
File opened	Path: C:\WINDOWS\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	671174023
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	671175337
File opened	Path: C:\WINDOWS\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	671181689
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	671182959
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: query and read Type: commit Baseaddress: FF30000 Size: 389120 Protection: readonly Mapped to pid: own pid	success or wait	671186020
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: LogFileName	object name not found	671186939
System info queried	Type: WatchdogTimerHandler	success or wait	671188213
Process created	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Cmdline: cmd.exe /c iPhone 5.doc Createflags: none	success or wait	671188387
Process information queried	PID: 1096 Info Class: BasicInformation	success or wait	671196841
Memory read	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7FFD9008 Length: 4 Value: 00 00 D0 4A	success or wait	671197045
File opened	Path: C:\WINDOWS\system32\cmd.exe.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	671197332
Memory read	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 4AD00000 Length: 4096 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 1D ED D5 EA 59 8C BB B9 59 8C BB B9 59 8C BB B9 9A 83 B4 B9 5F 8C BB B9 59 8C BA B9 80 8C BB B9 9A 83 E6 B9 5E 8C BB B9 E6 83 DB B9 5B 8C BB B9 9A 83 E5 B9 58 8C BB B9 9A 83 E4 B9 6D 8C BB B9 9A 83 E1 B9 58 8C BB B9 52 69 63 68 59 8C BB B9 00 00 00 00 00 00 00 00 50 45 00 00 4C 01 03 00 AF 5B 02 48 00 00 00 00 00 00 00 00 E0 00 0F 01 0B 01 07 0A 00 F8 01 00 00 F6 03 00 00 00 00	success or wait	671198058
Memory read	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 4AD3E000 Length: 256 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 03 00 00 00 30 00 00 80 0B 00 00 00 80 00 00 80 0E 00 00 00 98 00 00 80 10 00 00 00 B0 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 01 00 00 00 C8 00 00 80 02 00 00 00 E0 00 00 80 03 00 00 00 F8 00 00 80 04 00 00 00 10 01 00 80 05 00 00 00 28 01 00 80 06 00 00 00 40 01 00 80 07 00 00 00 58 01 00 80 08 00 00 00 70 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 88 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 80 02 00 80 A0 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 B8 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 00 00 D0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 00 00 E0 01 00 00 00 00 00 00 00 00 00	success or wait	671200966
Process information queried	PID: 1096 Info Class: BasicInformation	success or wait	671207472
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 10000 Length: 12DFE4 Allocation Type: unknown Protection: page read and write	success or wait	671208881
Memory written	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 10000 Length: 2116 Value: 3D 00 3A 00 3A 00 3D 00 3A 00 3A 00 5C 00 00 00 3D 00 5A 00 3A 00 3D 00 5A 00 3A 00 5C 00 00 00 41 00 4C 00 4C 00 55 00 53 00 45 00 52 00 53 00 50 00 52 00 4F 00 46 00 49 00 4C 00 45 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 6C 00 6C 00 20 00 55 00 73 00 65 00 72 00 73 00 00 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 41 00 70 00 70 00 6C 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20	success or wait	671210752
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 20000 Length: 12DFE4 Allocation Type: unknown Protection: page read and write	success or wait	671211118
Memory written	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 20000 Length: 1720 Value: 00 10 00 00 B8 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 00 08 02 90 02 00 00 00 00 00 00 54 01 56 01 98 04 00 00 36 00 38 00 F0 05 00 00 32 00 34 00 28 06 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 36 00 38 00 5C 06 00 00 1E 00 20 00 94 06 00 00 00 00 02 00 B4 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	671212519
Memory written	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7FFD9010 Length: 4 Value: 00 00 02 00	success or wait	671212938
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 30000 Length: 12DFE4 Allocation Type: unknown Protection: page read and write	success or wait	671213162
Memory written	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 30000 Length: 388 Value: 53 00 68 00 69 00 6D 00 45 00 6E 00 67 00 2E 00 64 00 6C 00 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 01 00 00 AB ED 0D AC AA 3F 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	671213837
Memory written	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7FFD91E8 Length: 4 Value: 00 00 03 00	success or wait	671214204
Memory read	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7FFD9010 Length: 4 Value: 00 00 02 00	success or wait	671214471
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 40000 Length: 12E250 Allocation Type: unknown Protection: page read and write	success or wait	671214838
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 40000 Length: 12E24C Allocation Type: unknown Protection: page read and write	success or wait	671215083
Thread created	PID: 1096 TID: 424 EIP: 7C810705 EAX: 4AD05046 Imagepath: C:\WINDOWS\system32\cmd.exe	success or wait	671219055
Thread resumed	TID: 424 PID: 1096 Path: C:\WINDOWS\system32\cmd.exe	success or wait	671467724
Process information queried	PID: 1096 Info Class: BasicInformation	success or wait	671468348

Analysis File: svchost.exe PID: 1832 Parent PID: 624

General

Start time:	15:20:05
Start date:	24/07/2012
Path:	C:\WINDOWS\system32\svchost.exe
Wow64 process (32bit):	false
Commandline:	unknown
Imagebase:	0x1000000
File size:	14336 bytes
MD5 hash:	27C6D03BCDB8CFEB96B716F3D8BE3E18

File Activites

File Path	Access	Options	Content overwritten	Completion	Count	Source Address	Symbol
C:\WINDOWS\system32\	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\ShimEng.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\AppPatch\AcGenral.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	3	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\WINMM.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\MSACM32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\UxTheme.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\IMM32.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	3	7C90E457	KiUserApcDispatcher
\Device\KsecDD	read data or list directory and synchronize	synchronous io alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Manifest	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
pipe\	read attributes and synchronize	synchronous io non alert	false	success or wait	1	1002585	unknown
c:\windows\system32\wiaservc.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C80B729	unknown
c:\windows\system32\CFGMGR32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
c:\windows\system32\setupapi.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
c:\windows\system32\mscms.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
c:\windows\system32\WINSPOOL.DRV	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
c:\windows\system32\WINSTA.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
c:\windows\system32\NETAPI32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\rpcss.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\winlogon.exe	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\xpsp2res.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\CLBCATQ.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\COMRes.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\WINTRUST.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\CRYPT32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\MSASN1.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\actxprxy.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C80B729	unknown
D:\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	no media in device	1	7C80B729	unknown
C:\WINDOWS\system32\sti.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C80B729	unknown
C:\WINDOWS\AppPatch\sysmain.sdb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\AppPatch\systest.sdb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	object name not found	1	7C90E457	KiUserApcDispatcher
\Device\NamedPipe\ShimViewer	write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize	no options	true	object name not found	3	7C90E457	KiUserApcDispatcher
C:\WINDOWS\AppPatch\AcGenral.DLL	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Manifest	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C90E457	KiUserApcDispatcher
\pipe\net\NtControlPipe11	read attributes and synchronize and generic read and generic write	synchronous io non alert and non directory file	true	success or wait	1	1002585	unknown
C:\WINDOWS\Sti_Trace.log	read attributes and synchronize and generic write	synchronous io non alert and non directory file	true	success or wait	2	7C80B729	unknown
\pipe\lsarpc	read attributes and synchronize and generic read and generic write	non directory file	true	success or wait	2	7C80B729	unknown
C:\WINDOWS\Registration\R000000000007.clb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C80B729	unknown
C:\WINDOWS\wiaservc.log	read attributes and synchronize and generic read and generic write	synchronous io non alert and non directory file	true	success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	read attributes and synchronize and generic write	synchronous io non alert and non directory file	true	success or wait	1	7C80B729	unknown

File Path	Offset	Length	Value	Completion	Count	Source Address	Symbol
\net\NtControlPipe11	unknown	4	28 07 00 00	success or wait	1	1002585	unknown
\net\NtControlPipe11	unknown	8	00 00 00 00 00 00 00 00	success or wait	1	1002585	unknown
\lsarpc	0	72	05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	2	7C80B729	unknown
C:\WINDOWS\wiaservc.log	unknown	47	5B 77 69 61 73 65 72 76 63 5D 20 4F 70 65 6E 65 64 20 6C 6F 67 20 61 74 20 37 2F 32 34 2F 32 30 31 32 20 31 35 3A 32 30 3A 30 35 2E 36 38 37	success or wait	1	7C80B729	unknown
C:\WINDOWS\wiaservc.log	unknown	2	0D 0A	success or wait	1	7C80B729	unknown
\lsarpc	0	64	05 00 00 03 10 00 00 00 40 00 00 00 07 00 00 00 28 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 00 02 00 01 00 00 08 00 00	success or wait	1	7C80B729	unknown
\lsarpc	0	136	05 00 00 03 10 00 00 00 88 00 00 00 08 00 00 00 70 00 00 00 00 00 44 00 00 00 00 00 C2 A4 2F 20 9D D0 7D 48 85 4F E9 DC 79 65 C9 AD 01 00 00 00 01 00 00 00 26 00 28 00 00 00 02 00 14 00 00 00 00 00 00 00 13 00 00 00 4E 00 54 00 20 00 41 00 55 00 54 00 48 00 4F 00 52 00 49 00 54 00 59 00 5C 00 53 00	success or wait	1	7C80B729	unknown
\lsarpc	0	44	05 00 00 03 10 00 00 00 2C 00 00 00 09 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 C2 A4 2F 20 9D D0 7D 48 85 4F E9 DC 79 65 C9 AD	success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	unknown	99	3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 53 74 61 72 74 20 27 77 69 61 73 65 72 76 63 2E 64 6C 6C 27 20 44 65 62 75 67 20 2D 20 54 69 6D 65 3A 20 32 30 31 32 2F 30 37 2F 32 34 20 31 35 3A 32 30 3A 30 36 3A 37 38 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 0D 0A	success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	unknown	58	09 2A 3E 20 53 74 69 53 65 72 76 69 63 65 4D 61 69 6E 20 65 6E 74 65 72 65 64 2C 20 54 69 6D 65 3A 20 32 30 31 32 2F 30 37 2F 32 34 20 31 35 3A 32 30 3A 30 36 3A 37 38 0D 0A	success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	unknown	48	09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 53 65 74 74 69 6E 67 20 68 61 6E 64 6C 65 72 20 66 6F 72 20 2A 0D 0A	success or wait	6	7C80B729	unknown
C:\WINDOWS\wiadebug.log	unknown	59	09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 48 61 6E 64 6C 65 72 20 69 73 20 4D 69 63 72 6F 73 6F 66 74 20 4F 66 66 69 63 65 20 57 6F 72 64 0D 0A	success or wait	2	7C80B729	unknown
C:\WINDOWS\wiadebug.log	unknown	46	09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 48 61 6E 64 6C 65 72 20 69 73 20 49 6E 74 65 72 6E 61 6C 0D 0A	success or wait	4	7C80B729	unknown

File Path	Offset	Length	Value	Completion	Count	Source Address	Symbol
\net\NtControlPipe11	unknown	534	26 00 00 00 50 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 73 00 74 00 69 00 73 00 76 00 63 00 00 00 00 00 00 00 00 00 88 96 09 00 35 04 91 7C 3E 04 91 7C 00 00 00 00 00 00 00 00 00 90 FD 7F BB 74 01 00 B0 96 09 00 00 90 FD 7F 00 10 90 7C 00 00 00 00 00 00 01 00 00 90 FD 7F 78 00 00 00 66 45 91 7C	success or wait	1	1002585	unknown
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 22 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	7C80B729	unknown
C:\WINDOWS\Registration\R000000000007.clb	unknown	22512	43 4F 4D 2B 01 00 00 00 01 00 12 00 24 00 00 00 00 01 01 00 63 00 00 00 00 00 00 01 01 00 00 00 00 01 10 00 00 00 00 00 C0 00 00 00 00 00 00 46 0E 00 00 00 30 01 00 00 A0 03 00 00 33 5F 30 00 D0 04 00 00 0C 00 00 00 33 5F 31 00 DC 04 00 00 88 02 00 00 33 5F 32 00 64 07 00 00 3C 00 00 00 33 5F 33 00	success or wait	1	7C80B729	unknown
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 23 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 4E 00 54 00 20 00 41 00 55 00 54 00 48 00 4F 00 52 00 49 00 54 00 59 00 00 00 00 00 01 00 00 00	success or wait	1	7C80B729	unknown
\lsarpc	0	1024	05 00 02 03 10 00 00 00 30 00 00 00 07 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 C2 A4 2F 20 9D D0 7D 48 85 4F E9 DC 79 65 C9 AD 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 4E 00 54 00 20 00 41 00 55 00 54 00 48 00 4F 00 52 00 49 00 54 00 59 00 00 00 00 00 01 00 00 00	success or wait	1	7C80B729	unknown
\lsarpc	0	1024	05 00 02 03 10 00 00 00 9C 00 00 00 08 00 00 00 84 00 00 00 00 00 00 00 00 00 02 00 01 00 00 00 04 00 02 00 20 00 00 00 01 00 00 00 18 00 1A 00 08 00 02 00 0C 00 02 00 0D 00 00 00 00 00 00 00 0C 00 00 00 4E 00 54 00 20 00 41 00 55 00 54 00 48 00 4F 00 52 00 49 00 54 00 59 00 00 00 00 00 01 00 00 00	success or wait	1	7C80B729	unknown
\lsarpc	0	1024	05 00 02 03 10 00 00 00 30 00 00 00 09 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 D2 0B 00 7C D2 0B 00 0D 00 00 00 00 00 00 00 0C 00 00 00 4E 00 54 00 20 00 41 00 55 00 54 00 48 00 4F 00 52 00 49 00 54 00 59 00 00 00 00 00 01 00 00 00	success or wait	1	7C80B729	unknown
\net\NtControlPipe11	unknown	534	unknown	unknown	1	1002585	unknown

File Path	Disposition	Data	Ascii Data	Completion	Count	Source Address	Symbol
C:\WINDOWS\system32	90028	NU LL		success or wait	1	7C90E457	KiUserApcDispatcher
\	110018	80 2E 0F F7 FF FF FF FF 26 00 00 00 01 00 6E 00 65 00 74 00 5C 00 4E 00 74 00 43 00 6F 00 6E 00 74 00 72 00 6F 00 6C 00 50 00 69 00 70 00 65 00 31 00 31 00	........&.....n.e.t.\.N.t.C.o.n.t.r.o.l.P.i.p.e.1.1.	success or wait	1	1002585	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 40 00 00 00 01 00 00 00 28 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 00 02 00 01 00 00 08 00 00	........@.......(.....,.........................................	pending	2	7C80B729	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 64 00 00 00 02 00 00 00 4C 00 00 00 00 00 39 00 00 00 00 00 6C 00 5D 7F 5D 64 BE 49 98 77 D8 9A 08 27 2D 02 01 00 00 00 00 00 02 00 01 00 00 00 04 00 02 00 01 00 00 00 01 01 00 00 00 00 00 05 12 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00	........d.......L.....9.....l.].]d.I.w...'-.........................................................	pending	1	7C80B729	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 6C 00 5D 7F 5D 64 BE 49 98 77 D8 9A 08 27 2D 02	........,...................l.].]d.I.w...'-.	pending	1	7C80B729	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 6A 00 00 00 02 00 00 00 52 00 00 00 00 00 1F 00 00 00 00 00 85 CC 5C B9 88 39 14 4F 8C 2D BB C2 26 D9 87 9A 2A 00 2C 00 00 00 02 00 16 00 00 00 00 00 00 00 15 00 00 00 53 00 65 00 4C 00 6F 00 61 00 64 00 44 00 72 00 69 00 76 00 65 00 72 00 50 00 72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 00	........j.......R.............\..9.O.-..&...*.,.................S.e.L.o.a.d.D.r.i.v.e.r.P.r.i.v.i.l.e.g.e.	pending	1	7C80B729	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 85 CC 5C B9 88 39 14 4F 8C 2D BB C2 26 D9 87 9A	........,.....................\..9.O.-..&...	pending	1	7C80B729	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 40 00 00 00 04 00 00 00 28 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 00 02 00 01 00 00 08 00 00	........@.......(.....,.........................................	pending	1	7C80B729	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 62 00 00 00 05 00 00 00 4A 00 00 00 00 00 1F 00 00 00 00 00 B4 B6 54 9C 15 95 28 44 90 FC 85 74 2E F3 50 A6 22 00 24 00 00 00 02 00 12 00 00 00 00 00 00 00 11 00 00 00 53 00 65 00 55 00 6E 00 64 00 6F 00 63 00 6B 00 50 00 72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 00	........b.......J.............T...(D...t..P.".$.................S.e.U.n.d.o.c.k.P.r.i.v.i.l.e.g.e.	pending	1	7C80B729	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 06 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 B4 B6 54 9C 15 95 28 44 90 FC 85 74 2E F3 50 A6	........,.....................T...(D...t..P.	pending	1	7C80B729	unknown
\net\NtControlPipe11	PipeInformation	unknown		success or wait	1	1002585	unknown
C:\WINDOWS\Sti_Trace.log	PositionInformation	Offset: 0		success or wait	2	7C80B729	unknown
\lsarpc	PipeInformation	unknown		success or wait	2	7C80B729	unknown
\lsarpc	CompletionInformation	unknown		success or wait	2	7C80B729	unknown
C:\WINDOWS\Registration\R000000000007.clb	PositionInformation	Offset: 22512		success or wait	1	7C80B729	unknown
C:\WINDOWS\Registration\R000000000007.clb	PositionInformation	Offset: 0		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiaservc.log	PositionInformation	Offset: 0		success or wait	2	7C80B729	unknown
C:\WINDOWS\wiaservc.log	EndOfFileInformation	unknown		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiaservc.log	AllocationInformation	unknown		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 0		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 99		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 157		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 205		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 264		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 312		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 358		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 406		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 452		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 500		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 559		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 607		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 653		success or wait	1	7C80B729	unknown
C:\WINDOWS\wiadebug.log	PositionInformation	Offset: 701		success or wait	1	7C80B729	unknown

Section Activites

Section loaded by Windows

File Path	Access	Type	Base	Size	Mapped to pid	Protection	Completion	Count
\KnownDlls\kernel32.dll	write and read and execute	unknown	7C800000	1007616	own pid	read write	success or wait	1
unknown	query and write and read and execute and extend size	reserve	7C800000	1007616	own pid	read write	success or wait	1
\NLS\NlsSectionUnicode	read	unknown	1B0000	90112	own pid	readonly	success or wait	1
\NLS\NlsSectionLocale	read	unknown	1D0000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey	query and read	unknown	220000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortTbls	read	unknown	270000	24576	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\KnownDlls\ADVAPI32.dll	write and read and execute	unknown	77DD0000	634880	own pid	read write	success or wait	1
\KnownDlls\RPCRT4.dll	write and read and execute	unknown	77E70000	602112	own pid	read write	success or wait	1
\KnownDlls\Secur32.dll	write and read and execute	unknown	77FE0000	69632	own pid	read write	success or wait	1
\KnownDlls\ShimEng.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\shimeng.dll	query and write and read and execute	image	5CB70000	155648	own pid	read write	success or wait	1
C:\WINDOWS\AppPatch\sysmain.sdb	read	commit	280000	1208320	own pid	readonly	success or wait	1
C:\WINDOWS\AppPatch\acgenral.dll	write and read and execute	commit	3C0000	1855488	own pid	execute	success or wait	1
C:\WINDOWS\AppPatch\acgenral.dll	write and read and execute	commit	3C0000	1855488	own pid	execute	success or wait	1
C:\WINDOWS\AppPatch\acgenral.dll	query and write and read and execute	image	6F880000	1875968	own pid	read write	success or wait	1
\KnownDlls\USER32.dll	write and read and execute	unknown	7E410000	593920	own pid	read write	success or wait	1
\KnownDlls\GDI32.dll	write and read and execute	unknown	77F10000	299008	own pid	read write	success or wait	1
\KnownDlls\WINMM.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\winmm.dll	query and write and read and execute	image	76B40000	184320	own pid	read write	success or wait	1
\KnownDlls\ole32.dll	write and read and execute	unknown	774E0000	1302528	own pid	read write	success or wait	1
\KnownDlls\msvcrt.dll	write and read and execute	unknown	77C10000	360448	own pid	read write	success or wait	1
\KnownDlls\OLEAUT32.dll	write and read and execute	unknown	77120000	569344	own pid	read write	success or wait	1
\KnownDlls\MSACM32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msacm32.dll	query and write and read and execute	image	77BE0000	86016	own pid	read write	success or wait	1
\KnownDlls\VERSION.dll	write and read and execute	unknown	77C00000	32768	own pid	read write	success or wait	1
\KnownDlls\SHELL32.dll	write and read and execute	unknown	7C9C0000	8482816	own pid	read write	success or wait	1
\KnownDlls\SHLWAPI.dll	write and read and execute	unknown	77F60000	483328	own pid	read write	success or wait	1
\KnownDlls\USERENV.dll	write and read and execute	unknown	769C0000	737280	own pid	read write	success or wait	1
\KnownDlls\UxTheme.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\uxtheme.dll	query and write and read and execute	image	5AD70000	229376	own pid	read write	success or wait	1
\NLS\NlsSectionCType	read	unknown	3D0000	12288	own pid	readonly	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	350000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	350000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	query and write and read and execute	image	76390000	118784	own pid	read write	success or wait	1
C:\WINDOWS\system32\shell32.dll	read	commit	630000	8462336	own pid	readonly	success or wait	1
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	write and read and execute	commit	630000	1056768	own pid	execute	success or wait	1
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	query and write and read and execute	image	773D0000	1060864	own pid	read write	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	write and read and execute	commit	380000	4096	own pid	execute	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	query and read	commit	380000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	read	commit	380000	4096	own pid	readonly	success or wait	1
\KnownDlls\comctl32.dll	write and read and execute	unknown	5D090000	630784	own pid	read write	success or wait	1
C:\WINDOWS\system32\comctl32.dll	read	commit	630000	618496	own pid	readonly	success or wait	1
C:\WINDOWS\system32\wiaservc.dll	write and read and execute	commit	670000	335872	own pid	execute	success or wait	1
C:\WINDOWS\system32\wiaservc.dll	query and write and read and execute	image	75AA0000	348160	own pid	read write	success or wait	1
\KnownDlls\CFGMGR32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\cfgmgr32.dll	query and write and read and execute	image	74AE0000	28672	own pid	read write	success or wait	1
\KnownDlls\setupapi.DLL	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\setupapi.dll	query and write and read and execute	image	77920000	995328	own pid	read write	success or wait	1
\KnownDlls\mscms.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\mscms.dll	query and write and read and execute	image	73B30000	86016	own pid	read write	success or wait	1
\KnownDlls\WINSPOOL.DRV	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\winspool.drv	query and write and read and execute	image	73000000	155648	own pid	read write	success or wait	1
\KnownDlls\WINSTA.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\winsta.dll	query and write and read and execute	image	76360000	65536	own pid	read write	success or wait	1
\KnownDlls\NETAPI32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\netapi32.dll	query and write and read and execute	image	5B860000	348160	own pid	read write	success or wait	1
C:\WINDOWS\system32\rpcss.dll	write and read and execute	commit	680000	401408	own pid	execute	success or wait	1
C:\WINDOWS\system32\winlogon.exe	write and read and execute	commit	680000	507904	own pid	execute	success or wait	1
\KnownDlls\xpsp2res.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\xpsp2res.dll	query and write and read and execute	image	680000	2904064	own pid	read write	conflicting addresses	1
\KnownDlls\CLBCATQ.DLL	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\clbcatq.dll	query and write and read and execute	image	76FD0000	520192	own pid	read write	success or wait	1
\KnownDlls\COMRes.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\comres.dll	query and write and read and execute	image	77050000	806912	own pid	read write	success or wait	1
\KnownDlls\WINTRUST.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\wintrust.dll	query and write and read and execute	image	76C30000	188416	own pid	read write	success or wait	1
\KnownDlls\CRYPT32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\crypt32.dll	query and write and read and execute	image	77A80000	610304	own pid	read write	success or wait	1
\KnownDlls\MSASN1.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msasn1.dll	query and write and read and execute	image	77B20000	73728	own pid	read write	success or wait	1
\KnownDlls\IMAGEHLP.dll	write and read and execute	unknown	76C90000	163840	own pid	read write	success or wait	1
C:\WINDOWS\system32\actxprxy.dll	write and read and execute	commit	B20000	98304	own pid	execute	success or wait	1
C:\WINDOWS\system32\actxprxy.dll	query and write and read and execute	image	71D40000	110592	own pid	read write	success or wait	1
C:\WINDOWS\system32\sti.dll	write and read and execute	commit	B60000	69632	own pid	execute	success or wait	1
C:\WINDOWS\system32\sti.dll	query and write and read and execute	image	73BA0000	77824	own pid	read write	success or wait	1

Registry Activites

Key Path	Completion	Count	Source Address	Symbol
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}\LocalServer32	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22}	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22}	success or wait	1	7C80B729	unknown

Key Path	Key Value Name	Completion	Count	Source Address	Symbol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	StillImageMonitor	object name not found	1	7C80B729	unknown

Key Path	Name	Type	Data	Completion	Count	Source Address	Symbol
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	Name	unicode	Microsoft Office Word	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	Desc	unicode	Microsoft Office Word	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	Icon	unicode	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE,1	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	Cmdline	unicode	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE /IMG_WIA	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22}	Name	unicode	Internal	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22}	Desc	unicode	Internal	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22}	Icon	unicode	Internal	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	Name	unicode	Microsoft Office Word	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	Desc	unicode	Microsoft Office Word	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	Icon	unicode	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE,1	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	Cmdline	unicode	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE /IMG_WIA	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22}	Name	unicode	Internal	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22}	Desc	unicode	Internal	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22}	Icon	unicode	Internal	success or wait	1	7C80B729	unknown

Key Path	Name	Type	Old Data	New Data	Completion	Count	Source Address	Symbol
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}\LocalServer32	NULL	unicode		C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE /IMG_WIA	success or wait	2	7C80B729	unknown

Key Path	Name	Completion	Count	Source Address	Symbol
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CWDIllegalInDLLSearch	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server	TSAppCompat	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter	Installed	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	LeakTrack	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	SafeDllSearchMode	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize	DisableMetaFiles	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows	AppInit_DLLs	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaProperties\PrivateProperties\Joystick\Winmm	wheel	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CriticalSectionTimeout	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	RWLockResourceTimeOut	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAllForOle32	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableTypeLib	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAllForOle32	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Multimedia\Audio	SystemFormats	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.imaadpcm	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.imaadpcm	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msadpcm	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msadpcm	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg711	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg711	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msgsm610	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msgsm610	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.trspch	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.trspch	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg723	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg723	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msaudio1	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msaudio1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.sl_anet	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.sl_anet	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.iac2	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.iac2	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.l3acm	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.l3acm	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM	NoPCMConverter	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00	Priority1	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	ChkAccDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions	ProductType	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Personal	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Local Settings	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	RsopDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	RsopLogging	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	RsopLogging	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\ThemeManager	Compositing	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	LameButtonText	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost	imgsvc	success or wait	1	1002563	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost	imgsvc	success or wait	1	1002563	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc	MaxRpcSize	object name not found	1	1002574	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent		success or wait	1	1002585	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\stisvc\Parameters	ServiceDll	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\stisvc\Parameters	ServiceMain	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\WPA\PnP	seed	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	OsLoaderPath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	OsLoaderPath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemPartition	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemPartition	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	SourcePath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	SourcePath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackSourcePath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackSourcePath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackCachePath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackCachePath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	DriverCachePath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	DriverCachePath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	DevicePath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogLevel	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogLevel	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogPath	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Hostname	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Domain	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Debug\wiaservc.dll	DebugFlags	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Debug	DebugFileSizeLimit	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage	DebugStiMonUI	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	MaxSize	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	TruncateOnBoot	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	Level	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	Mode	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	MaximumAllowedAllocationSize	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{A1F4E726-8CF1-11D1-BF92-0060081ED811}	AuthenticationLevel	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{A1F4E726-8CF1-11D1-BF92-0060081ED811}	AccessPermission	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	Com+Enabled	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	MinimumFreeMemPercentageToCreateProcess	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	MinimumFreeMemPercentageToCreateObject	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	Com+Enabled	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1E75357-881A-419E-83E2-BB16DB197C68}\LocalServer32	LocalServer32	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1E75357-881A-419E-83E2-BB16DB197C68}\LocalServer32	NULL	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	MaxSize	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	Level	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	Mode	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	Detail	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	TruncateOnBoot	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	ClearLogOnBoot	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	LogToDebugger	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage	EnableVolumeDevices	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DD522ACC-F821-461A-A407-50B198B896DC}	AppID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{B1B9CBB2-B198-47E2-8260-9FD629A2B2EC}	DllSurrogate	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{B1B9CBB2-B198-47E2-8260-9FD629A2B2EC}	LocalService	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CC271F08-E1DD-49BF-87CC-CD6DCF3F3D9F}\ProxyStubClsid32	NULL	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8DA6310-E19B-11D0-933C-00A0C90DCAA9}\InProcServer32	InprocServer32	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8DA6310-E19B-11D0-933C-00A0C90DCAA9}\InProcServer32	NULL	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8DA6310-E19B-11D0-933C-00A0C90DCAA9}	AppID	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8DA6310-E19B-11D0-933C-00A0C90DCAA9}\InProcServer32	ThreadingModel	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EE93D145-9B4E-480C-8385-1E8119A6F7B2}\ProxyStubClsid32	NULL	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1F4E726-8CF1-11D1-BF92-0060081ED811}\LocalServer32	LocalServer32	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1F4E726-8CF1-11D1-BF92-0060081ED811}\LocalServer32	NULL	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage	DeviceID	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected	DefaultHandler	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected	GUID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{D13E3F25-1688-45A0-9743-759EB35CDF9A}	Name	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{D13E3F25-1688-45A0-9743-759EB35CDF9A}	Desc	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{D13E3F25-1688-45A0-9743-759EB35CDF9A}	Icon	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{D13E3F25-1688-45A0-9743-759EB35CDF9A}	Cmdline	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Disconnected	DefaultHandler	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Disconnected	GUID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton	DefaultHandler	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton	GUID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{D13E3F25-1688-45A0-9743-759EB35CDF9A}	Name	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{D13E3F25-1688-45A0-9743-759EB35CDF9A}	Desc	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{D13E3F25-1688-45A0-9743-759EB35CDF9A}	Icon	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5EB2502A-8CF1-11D1-BF92-0060081ED811}\ProxyStubClsid32	NULL	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{D13E3F25-1688-45A0-9743-759EB35CDF9A}	Cmdline	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\STIProxyEvent	DefaultHandler	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\STIProxyEvent	GUID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32	InprocServer32	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32	NULL	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}	AppID	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32	ThreadingModel	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	MaxSize	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	Level	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging	Mode	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected	GUID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected	GUID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected	GUID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Disconnected	GUID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton	GUID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected	GUID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Disconnected	GUID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton	GUID	success or wait	1	7C80B729	unknown

Mutex Activites

Name	Completion	Count	Source Address	Symbol
\BaseNamedObjects\SHIMLIB_LOG_MUTEX	object name exists	1	7C90E457	KiUserApcDispatcher
unknown	success or wait	8	7C80B729	unknown
\BaseNamedObjects\StiTraceMutexSti_Trace.log	success or wait	1	7C80B729	unknown
\BaseNamedObjects\Global\WiaDebugFileMut	success or wait	1	7C80B729	unknown
\BaseNamedObjects\StiTraceMutexSti_Trace.log	object name exists	1	7C80B729	unknown

Process Activites

PID	Process info class	Completion	Count	Source Address	Symbol
1832	Cookie	success or wait	7	7C90E457	KiUserApcDispatcher
1832	Wow64Information	success or wait	5	7C90E457	KiUserApcDispatcher
1832	ImageInformation	success or wait	1	7C90E457	KiUserApcDispatcher
1832	SessionInformation	success or wait	2	7C90E457	KiUserApcDispatcher
1832	DefaultHardErrorMode	success or wait	1	1002525	unknown
1832	QuotaLimits	success or wait	1	1002574	unknown
1832	VmCounters	success or wait	1	1002574	unknown
1832	DeviceMap	success or wait	2	7C80B729	unknown

Thread Activites

TID	PID	EIP	EAX (Usermode EIP)	Filepath	Completion	Count	Source Address	Symbol
1992	1832	7C8106F9	77DF3539	C:\WINDOWS\system32\svchost.exe	success or wait	1	1002585	unknown
2016	1832	7C8106F9	77E76C7D	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown
1656	1832	7C8106F9	774FE4DF	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown
2004	1832	7C8106F9	75ACC5E7	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown
1792	1832	7C8106F9	77E76C7D	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown
2020	1832	7C8106F9	77E76C7D	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown
2024	1832	7C8106F9	77E76C7D	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown
1548	1832	7C8106F9	77E76C7D	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown

TID	PID	Path	Completion	Count	Source Address	Symbol
1992	1832	C:\WINDOWS\system32\svchost.exe	success or wait	1	1002585	unknown
2016	1832	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown
1656	1832	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown
2004	1832	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown
1792	1832	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown
2020	1832	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown
2024	1832	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown
1548	1832	C:\WINDOWS\system32\svchost.exe	success or wait	1	7C80B729	unknown

TID	Delay	Completion	Count	Source Address	Symbol
2016	0s	success or wait	1	7C80B729	unknown
1656	-60s	success or wait	2	7C80B729	unknown
1656	-60s	unknown	1	7C80B729	unknown

Memory Activites

PID	Filepath	Base	Length	Protection	Completion	Count	Source Address	Symbol
1832	C:\WINDOWS\system32\svchost.exe	90000	7FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	90000	7FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	91000	7F7F4	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	190000	7FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	190000	7FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	1A0000	7F340	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	1A1000	7F168	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	93000	7F420	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	3B0000	7F0C8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	3B0000	7F0CC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	3B2000	7EB64	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	3B3000	7EEA8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	3C0000	7E978	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	3C0000	7E97C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	3C1000	7E658	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	3C3000	7E70C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	3E0000	7F04C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	3E0000	7F050	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	3E1000	7ED2C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	94000	7F788	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	5B0000	7F52C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	5B0000	7F528	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	360000	7F91C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	360000	7F920	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	361000	7F5FC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	363000	7F6B8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	95000	7F5BC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	96000	7F2C4	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	97000	7EF90	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	98000	7EF90	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	99000	7EF58	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	380000	7F1B8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	380000	7F1BC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	381000	7EE98	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	383000	7EF4C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	9A000	7F5AC	page read and write	success or wait	1	1002585	unknown
1832	C:\WINDOWS\system32\svchost.exe	630000	7F87C	page read and write	success or wait	1	1002585	unknown
1832	C:\WINDOWS\system32\svchost.exe	66B000	7F878	page read and write	success or wait	1	1002585	unknown
1832	C:\WINDOWS\system32\svchost.exe	364000	66F154	page read and write	success or wait	1	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	670000	66F394	page read and write	success or wait	1	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	670000	66F398	page read and write	success or wait	1	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	671000	66F074	page read and write	success or wait	1	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	9B000	66FC44	page read and write	success or wait	1	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	9C000	66FBF0	page read and write	success or wait	1	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	A0000	66F234	page read and write	success or wait	1	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	A1000	66F330	page read and write	success or wait	1	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	A2000	66F740	page read and write	success or wait	1	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	A3000	66F6E4	page read and write	success or wait	1	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	365000	66F740	page read and write	success or wait	1	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	950000	66FAD8	page no access	success or wait	1	7C80B729	unknown

PID	Filepath	Base	Length	New Protection	Old Protection	Completion	Count	Source Address	Symbol
1832	C:\WINDOWS\system32\svchost.exe	7C801000	1000	page read and write	page execute read	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	7C801000	1000	page execute read	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77DD1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77DD1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77E71000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77E71000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77FE1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77FE1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	1001000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	1001000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	5CB71000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	5CB71000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	6F881000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	6F881000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77F11000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77F11000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	7E411000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	7E411000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	76B41000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	76B41000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	774E1000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	774E1000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77C11000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77C11000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77121000	1000	page read and write	page execute read	success or wait	6	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77121000	1000	page execute read	page read and write	success or wait	6	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77BE1000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77BE1000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77C01000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77C01000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	7C9C1000	2000	page read and write	page execute read	success or wait	8	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	7C9C1000	2000	page execute read	page read and write	success or wait	8	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77F61000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	77F61000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	769C1000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	769C1000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	5AD71000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	5AD71000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	76391000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	76391000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	773D1000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	773D1000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	5D091000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	5D091000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1832	C:\WINDOWS\system32\svchost.exe	66B000	1000	page read and write and page guard	page read and write	success or wait	1	1002585	unknown
1832	C:\WINDOWS\system32\svchost.exe	75AA1000	1000	page read and write	page execute read	success or wait	8	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	75AA1000	1000	page execute read	page read and write	success or wait	8	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	77921000	1000	page read and write	page execute read	success or wait	6	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	77921000	1000	page execute read	page read and write	success or wait	6	7C80B729	unknown
1832	C:\WINDOWS\system32\svchost.exe	73B31000	1000	page read and write	page execute read	success or wait	5	7C80B729	unknown

Memory Usage Statistics

Time	Private Usage (mb)	Workingset (mb)	Page File Usage (mb)
15:20:05	1	3	1
15:20:06	2	4	2
15:20:20	2	3	2
15:20:21	2	3	2
15:20:24	2	3	2
15:20:31	2	3	2
15:20:33	2	2	2
15:20:34	2	2	2
15:20:35	2	1	2
15:20:37	2	1	2
15:20:39	2	1	2
15:20:40	2	1	2
15:20:41	2	1	2
15:20:42	2	1	2
15:21:06	2	1	2

System Activites

System info class	Completion	Count	Source Address	Symbol
BasicInformation	success or wait	25	7C90E457	KiUserApcDispatcher
RangeStartInformation	success or wait	1	7C90E457	KiUserApcDispatcher
ProcessorInformation	success or wait	8	7C90E457	KiUserApcDispatcher
PerformanceInformation	success or wait	1	1002574	unknown

Timing Activites

Time	Completion	Count	Source Address	Symbol
129876420056250000	success or wait	1	1002574	unknown

Process Token Activites

Status	Privilege	Completion	Count	Source Address	Symbol
on	Load Driver	success or wait	1456	7C80B729	unknown

Object Security Activites

Path	Information Class	Completion	Count	Source Address	Symbol
1832	dacl	success or wait	1	7C80B729	unknown
1992	dacl	success or wait	1	7C80B729	unknown

Chronological Activities

Operation	Data	Completion	Time
Thread delayed	Time: -60 TID: 1656	unknown	1046962756
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CWDIllegalInDLLSearch	object name not found	616880710
System info queried	Type: BasicInformation	success or wait	616882695
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 90000 Length: 7FB14 Allocation Type: unknown Protection: page read and write	success or wait	616882926
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 90000 Length: 7FB18 Allocation Type: unknown Protection: page read and write	success or wait	616883132
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 91000 Length: 7F7F4 Allocation Type: unknown Protection: page read and write	success or wait	616883536
System info queried	Type: BasicInformation	success or wait	616883783
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 190000 Length: 7FB14 Allocation Type: unknown Protection: page read and write	success or wait	616883986
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 190000 Length: 7FB18 Allocation Type: unknown Protection: page read and write	success or wait	616884183
File opened	Path: C:\WINDOWS\system32\ Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	616884917
File control set	Path: C:\WINDOWS\system32 Control Code: 90028 Input Buffer:	success or wait	616885725
Section loaded	Path: \KnownDlls\kernel32.dll Access: write and read and execute Type: unknown Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	616886714
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C801000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616887894
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C801000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616889142
Process information queried	PID: 1832 Info Class: Cookie	success or wait	616890159
System info queried	Type: RangeStartInformation	success or wait	616890404
System info queried	Type: BasicInformation	success or wait	616890586
Section loaded	Path: unknown Access: query and write and read and execute and extend size Type: reserve Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	616890832
System info queried	Type: BasicInformation	success or wait	616891738
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 1A0000 Length: 7F340 Allocation Type: unknown Protection: page read and write	success or wait	616892199
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	616893277
Section loaded	Path: \NLS\NlsSectionUnicode Access: read Type: unknown Baseaddress: 1B0000 Size: 90112 Protection: readonly Mapped to pid: own pid	success or wait	616894831
Section loaded	Path: \NLS\NlsSectionLocale Access: read Type: unknown Baseaddress: 1D0000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	616896190
Section loaded	Path: \NLS\NlsSectionSortkey Access: query and read Type: unknown Baseaddress: 220000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	616897219
Section loaded	Path: \NLS\NlsSectionSortTbls Access: read Type: unknown Baseaddress: 270000 Size: 24576 Protection: readonly Mapped to pid: own pid	success or wait	616897912
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	616899470
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	616899709
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 1A1000 Length: 7F168 Allocation Type: unknown Protection: page read and write	success or wait	616899925
Section loaded	Path: \KnownDlls\ADVAPI32.dll Access: write and read and execute Type: unknown Baseaddress: 77DD0000 Size: 634880 Protection: read write Mapped to pid: own pid	success or wait	616901142
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616902418
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616903018
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616903265
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616903703
Section loaded	Path: \KnownDlls\RPCRT4.dll Access: write and read and execute Type: unknown Baseaddress: 77E70000 Size: 602112 Protection: read write Mapped to pid: own pid	success or wait	616903982
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616905209
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616905876
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616906132
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616906487
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616906742
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616907014
Section loaded	Path: \KnownDlls\Secur32.dll Access: write and read and execute Type: unknown Baseaddress: 77FE0000 Size: 69632 Protection: read write Mapped to pid: own pid	success or wait	616907306
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616908605
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616908955
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616909223
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616909503
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616909769
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616910112
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616910364
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616910612
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616910850
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616911352
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 1001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616911930
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 1001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616913116
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 1001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616913356
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 1001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616913610
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 1001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616913843
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 1001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616914083
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 1001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616914312
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 1001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616914542
Section loaded	Path: \KnownDlls\ShimEng.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	616914915
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 93000 Length: 7F420 Allocation Type: unknown Protection: page read and write	success or wait	616915185
File opened	Path: C:\WINDOWS\system32\ShimEng.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616915662
Section loaded	Path: C:\WINDOWS\system32\shimeng.dll Access: query and write and read and execute Type: image Baseaddress: 5CB70000 Size: 155648 Protection: read write Mapped to pid: own pid	success or wait	616916392
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5CB71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616918246
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5CB71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616918664
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5CB71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616918906
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5CB71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616919144
File opened	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	616920237
Section loaded	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read Type: commit Baseaddress: 280000 Size: 1208320 Protection: readonly Mapped to pid: own pid	success or wait	616920988
File opened	Path: C:\WINDOWS\AppPatch\systest.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	object name not found	616921989
System info queried	Type: ProcessorInformation	success or wait	616922607
Process information queried	PID: 1832 Info Class: Wow64Information	success or wait	616922841
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter Name: Installed	success or wait	616923158
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	616923756
Process information queried	PID: 1832 Info Class: Wow64Information	success or wait	616924316
System info queried	Type: BasicInformation	success or wait	616924496
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 3B0000 Length: 7F0C8 Allocation Type: unknown Protection: page read and write	success or wait	616924705
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 3B0000 Length: 7F0CC Allocation Type: unknown Protection: page read and write	success or wait	616924912
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	616925396
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 3B2000 Length: 7EB64 Allocation Type: unknown Protection: page read and write	success or wait	616926038
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 3B3000 Length: 7EEA8 Allocation Type: unknown Protection: page read and write	success or wait	616927589
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	616928171
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616929441
Section loaded	Path: C:\WINDOWS\AppPatch\acgenral.dll Access: write and read and execute Type: commit Baseaddress: 3C0000 Size: 1855488 Protection: execute Mapped to pid: own pid	success or wait	616930166
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616931877
Section loaded	Path: C:\WINDOWS\AppPatch\acgenral.dll Access: write and read and execute Type: commit Baseaddress: 3C0000 Size: 1855488 Protection: execute Mapped to pid: own pid	success or wait	616932659
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616934060
Section loaded	Path: C:\WINDOWS\AppPatch\acgenral.dll Access: query and write and read and execute Type: image Baseaddress: 6F880000 Size: 1875968 Protection: read write Mapped to pid: own pid	success or wait	616934787
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616936180
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616936573
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616937421
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616937731
Section loaded	Path: \KnownDlls\USER32.dll Access: write and read and execute Type: unknown Baseaddress: 7E410000 Size: 593920 Protection: read write Mapped to pid: own pid	success or wait	616938015
Section loaded	Path: \KnownDlls\GDI32.dll Access: write and read and execute Type: unknown Baseaddress: 77F10000 Size: 299008 Protection: read write Mapped to pid: own pid	success or wait	616939207
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616940473
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616940920
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616941198
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616941478
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616941753
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616942409
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616942730
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616943488
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616943749
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616944050
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616944310
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616944677
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616944991
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616945235
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616945481
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616945729
Section loaded	Path: \KnownDlls\WINMM.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	616946010
File opened	Path: C:\WINDOWS\system32\WINMM.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616946410
Section loaded	Path: C:\WINDOWS\system32\winmm.dll Access: query and write and read and execute Type: image Baseaddress: 76B40000 Size: 184320 Protection: read write Mapped to pid: own pid	success or wait	616947192
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616948927
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616949394
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616949657
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616949912
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616950173
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616950484
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616950745
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616951027
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616951287
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616951579
Section loaded	Path: \KnownDlls\ole32.dll Access: write and read and execute Type: unknown Baseaddress: 774E0000 Size: 1302528 Protection: read write Mapped to pid: own pid	success or wait	616951867
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616953194
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616953608
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616953869
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616954141
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616954401
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616954779
Section loaded	Path: \KnownDlls\msvcrt.dll Access: write and read and execute Type: unknown Baseaddress: 77C10000 Size: 360448 Protection: read write Mapped to pid: own pid	success or wait	616955075
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616956353
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616956820
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616957095
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616957363
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616957617
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616958136
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616958394
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616958659
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616958918
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616959277
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616959533
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616959904
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616960147
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616960577
Section loaded	Path: \KnownDlls\OLEAUT32.dll Access: write and read and execute Type: unknown Baseaddress: 77120000 Size: 569344 Protection: read write Mapped to pid: own pid	success or wait	616960856
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616962065
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616962533
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616962795
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616963064
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616963324
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616963691
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616963949
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616964219
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616964478
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616964742
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616965001
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616965255
Section loaded	Path: \KnownDlls\MSACM32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	616965540
File opened	Path: C:\WINDOWS\system32\MSACM32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616965977
Section loaded	Path: C:\WINDOWS\system32\msacm32.dll Access: query and write and read and execute Type: image Baseaddress: 77BE0000 Size: 86016 Protection: read write Mapped to pid: own pid	success or wait	616966749
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616968786
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616969195
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616969460
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616969719
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616969979
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616970264
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616970524
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616970778
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616971036
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616971290
Section loaded	Path: \KnownDlls\VERSION.dll Access: write and read and execute Type: unknown Baseaddress: 77C00000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	616971579
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616972766
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616973184
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616973446
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616973712
Section loaded	Path: \KnownDlls\SHELL32.dll Access: write and read and execute Type: unknown Baseaddress: 7C9C0000 Size: 8482816 Protection: read write Mapped to pid: own pid	success or wait	616973996
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	616975346
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	616975824
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	616976085
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	616976360
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	616976617
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	616977011
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	616977269
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	616977528
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	616977785
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	616978047
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	616978304
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	616978558
Section loaded	Path: \KnownDlls\SHLWAPI.dll Access: write and read and execute Type: unknown Baseaddress: 77F60000 Size: 483328 Protection: read write Mapped to pid: own pid	success or wait	616978852
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616980675
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616981095
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616981372
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616981654
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616981927
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616982323
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616982598
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616982868
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616983139
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616983520
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	616983776
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	616984349
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	616984607
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	616985131
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616985394
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616985826
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616986073
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616986313
Section loaded	Path: \KnownDlls\USERENV.dll Access: write and read and execute Type: unknown Baseaddress: 769C0000 Size: 737280 Protection: read write Mapped to pid: own pid	success or wait	616986593
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616987823
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616988318
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616988581
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616988887
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616989145
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616989406
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616989665
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616990008
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616990266
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616990525
Section loaded	Path: \KnownDlls\UxTheme.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	616990810
File opened	Path: C:\WINDOWS\system32\UxTheme.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	616991211
Section loaded	Path: C:\WINDOWS\system32\uxtheme.dll Access: query and write and read and execute Type: image Baseaddress: 5AD70000 Size: 229376 Protection: read write Mapped to pid: own pid	success or wait	616991956
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616993676
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616994078
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616994340
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616994714
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616994977
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616995273
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616995531
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616995789
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	616996047
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	616996305
System info queried	Type: BasicInformation	success or wait	616997400
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 3C0000 Length: 7E978 Allocation Type: unknown Protection: page read and write	success or wait	616997637
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 3C0000 Length: 7E97C Allocation Type: unknown Protection: page read and write	success or wait	616997867
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 3C1000 Length: 7E658 Allocation Type: unknown Protection: page read and write	success or wait	616998161
Section loaded	Path: \NLS\NlsSectionCType Access: read Type: unknown Baseaddress: 3D0000 Size: 12288 Protection: readonly Mapped to pid: own pid	success or wait	616999107
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 3C3000 Length: 7E70C Allocation Type: unknown Protection: page read and write	success or wait	617000732
Process information queried	PID: 1832 Info Class: Cookie	success or wait	617001204
Process information queried	PID: 1832 Info Class: Cookie	success or wait	617001426
Mutant created	Name: \BaseNamedObjects\SHIMLIB_LOG_MUTEX	object name exists	617001836
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	617003020
System info queried	Type: BasicInformation	success or wait	617003536
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 3E0000 Length: 7F04C Allocation Type: unknown Protection: page read and write	success or wait	617003764
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 3E0000 Length: 7F050 Allocation Type: unknown Protection: page read and write	success or wait	617003987
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 3E1000 Length: 7ED2C Allocation Type: unknown Protection: page read and write	success or wait	617004340
System info queried	Type: BasicInformation	success or wait	617004971
System info queried	Type: ProcessorInformation	success or wait	617005179
Process information queried	PID: 1832 Info Class: ImageInformation	success or wait	617006210
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 94000 Length: 7F788 Allocation Type: unknown Protection: page read and write	success or wait	617009625
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: LeakTrack	object name not found	617010206
System info queried	Type: BasicInformation	success or wait	617011176
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: SafeDllSearchMode	object name not found	617012140
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617012810
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 350000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	617013549
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617015348
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 350000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	617016075
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617017490
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: query and write and read and execute Type: image Baseaddress: 76390000 Size: 118784 Protection: read write Mapped to pid: own pid	success or wait	617018255
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617019684
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617020138
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617020400
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617020723
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617020984
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617021269
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617021528
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617021795
System info queried	Type: BasicInformation	success or wait	617022349
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize Name: DisableMetaFiles	object name not found	617023754
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Name: AppInit_DLLs	success or wait	617027028
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave	success or wait	617028676
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5B0000 Length: 7F52C Allocation Type: unknown Protection: page read and write	success or wait	617029249
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5B0000 Length: 7F528 Allocation Type: unknown Protection: page read and write	success or wait	617029476
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave	success or wait	617029787
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave1	success or wait	617030702
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave1	success or wait	617031273
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave2	object name not found	617031824
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave3	object name not found	617032370
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave4	object name not found	617032918
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave5	object name not found	617033464
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave6	object name not found	617034006
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave7	object name not found	617034548
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave8	object name not found	617035093
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave9	object name not found	617035638
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi	success or wait	617036178
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi	success or wait	617036739
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi1	success or wait	617037328
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi1	success or wait	617037890
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi2	object name not found	617038440
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi3	object name not found	617038987
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi4	object name not found	617039536
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi5	object name not found	617040082
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi6	object name not found	617040628
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi7	object name not found	617041170
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi8	object name not found	617041715
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi9	object name not found	617042256
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux	success or wait	617042807
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux	success or wait	617043362
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux1	success or wait	617043910
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux1	success or wait	617044470
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux2	object name not found	617045016
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux3	object name not found	617045560
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux4	object name not found	617046115
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux5	object name not found	617046660
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux6	object name not found	617047204
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux7	object name not found	617047759
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux8	object name not found	617048302
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux9	object name not found	617048845
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaProperties\PrivateProperties\Joystick\Winmm Name: wheel	success or wait	617049988
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer	success or wait	617050526
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer	success or wait	617051087
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer1	success or wait	617051676
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer1	success or wait	617052238
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer2	object name not found	617052790
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer3	object name not found	617053337
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer4	object name not found	617053881
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer5	object name not found	617054423
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer6	object name not found	617054988
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer7	object name not found	617055533
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer8	object name not found	617056077
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer9	object name not found	617056625
System info queried	Type: BasicInformation	success or wait	617057560
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 360000 Length: 7F91C Allocation Type: unknown Protection: page read and write	success or wait	617057772
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 360000 Length: 7F920 Allocation Type: unknown Protection: page read and write	success or wait	617057986
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 361000 Length: 7F5FC Allocation Type: unknown Protection: page read and write	success or wait	617058274
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 363000 Length: 7F6B8 Allocation Type: unknown Protection: page read and write	success or wait	617059520
Process information queried	PID: 1832 Info Class: Cookie	success or wait	617060585
Process information queried	PID: 1832 Info Class: Cookie	success or wait	617060786
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 95000 Length: 7F5BC Allocation Type: unknown Protection: page read and write	success or wait	617061331
File opened	Path: \Device\KsecDD Access: read data or list directory and synchronize Options: synchronous io alert Overwritten: false	success or wait	617061664
System info queried	Type: BasicInformation	success or wait	617064570
System info queried	Type: ProcessorInformation	success or wait	617064774
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CriticalSectionTimeout	success or wait	617065157
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: RWLockResourceTimeOut	object name not found	617066288
System info queried	Type: BasicInformation	success or wait	617066777
System info queried	Type: ProcessorInformation	success or wait	617066981
System info queried	Type: BasicInformation	success or wait	617067173
System info queried	Type: ProcessorInformation	success or wait	617067377
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAll	object name not found	617067687
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAllForOle32	object name not found	617067905
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableTypeLib	object name not found	617068119
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAll	object name not found	617068583
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAllForOle32	object name not found	617068798
Key value queried	Path: HKEY_USERS\Software\Microsoft\Multimedia\Audio Name: SystemFormats	success or wait	617070125
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 96000 Length: 7F2C4 Allocation Type: unknown Protection: page read and write	success or wait	617070806
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.imaadpcm	buffer overflow	617071961
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.imaadpcm	success or wait	617072198
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: fdwSupport	success or wait	617072799
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: cFormatTags	success or wait	617073141
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: aFormatTagCache	success or wait	617073481
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: cFilterTags	success or wait	617073816
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msadpcm	buffer overflow	617074560
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msadpcm	success or wait	617074795
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: fdwSupport	success or wait	617075356
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: cFormatTags	success or wait	617075693
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: aFormatTagCache	success or wait	617076102
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: cFilterTags	success or wait	617076440
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg711	buffer overflow	617077179
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg711	success or wait	617077412
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 97000 Length: 7EF90 Allocation Type: unknown Protection: page read and write	success or wait	617077832
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: fdwSupport	success or wait	617078263
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: cFormatTags	success or wait	617078603
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: aFormatTagCache	success or wait	617078943
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: cFilterTags	success or wait	617079278
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msgsm610	buffer overflow	617079999
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msgsm610	success or wait	617080633
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: fdwSupport	success or wait	617081206
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: cFormatTags	success or wait	617081544
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: aFormatTagCache	success or wait	617081880
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: cFilterTags	success or wait	617082214
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.trspch	buffer overflow	617082955
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.trspch	success or wait	617083191
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: fdwSupport	success or wait	617083749
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: cFormatTags	success or wait	617084086
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: aFormatTagCache	success or wait	617084420
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: cFilterTags	success or wait	617084754
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg723	buffer overflow	617085505
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg723	success or wait	617085744
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: fdwSupport	success or wait	617086304
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: cFormatTags	success or wait	617086641
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: aFormatTagCache	success or wait	617086979
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: cFilterTags	success or wait	617087313
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msaudio1	buffer overflow	617088055
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msaudio1	success or wait	617088295
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: fdwSupport	success or wait	617088860
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: cFormatTags	success or wait	617089194
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: aFormatTagCache	success or wait	617089565
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: cFilterTags	success or wait	617089899
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.sl_anet	buffer overflow	617090639
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.sl_anet	success or wait	617090876
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: fdwSupport	success or wait	617091438
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: cFormatTags	success or wait	617091775
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: aFormatTagCache	success or wait	617092110
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: cFilterTags	success or wait	617092442
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.iac2	buffer overflow	617093185
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.iac2	success or wait	617093422
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: fdwSupport	success or wait	617094010
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: cFormatTags	success or wait	617094379
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: aFormatTagCache	success or wait	617094717
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: cFilterTags	success or wait	617095053
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.l3acm	buffer overflow	617095793
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.l3acm	success or wait	617096033
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 98000 Length: 7EF90 Allocation Type: unknown Protection: page read and write	success or wait	617096487
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: fdwSupport	success or wait	617096921
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: cFormatTags	success or wait	617097259
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: aFormatTagCache	success or wait	617097597
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: cFilterTags	success or wait	617097932
Key value queried	Path: HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM Name: NoPCMConverter	object name not found	617100134
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 99000 Length: 7EF58 Allocation Type: unknown Protection: page read and write	success or wait	617100682
Key value queried	Path: HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00 Name: Priority1	object name not found	617103487
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	617105454
File opened	Path: C:\WINDOWS\system32\SHELL32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617106776
Section loaded	Path: C:\WINDOWS\system32\shell32.dll Access: read Type: commit Baseaddress: 630000 Size: 8462336 Protection: readonly Mapped to pid: own pid	success or wait	617107537
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	617108274
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	617109857
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	617149138
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617150128
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: write and read and execute Type: commit Baseaddress: 630000 Size: 1056768 Protection: execute Mapped to pid: own pid	success or wait	617151119
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617153429
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: query and write and read and execute Type: image Baseaddress: 773D0000 Size: 1060864 Protection: read write Mapped to pid: own pid	success or wait	617154435
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617155989
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617156342
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617156618
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617156888
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617157159
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617157496
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617157833
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617158126
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617158399
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617158716
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617158987
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617159252
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617159521
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617159849
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617161547
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: write and read and execute Type: commit Baseaddress: 380000 Size: 4096 Protection: execute Mapped to pid: own pid	success or wait	617162408
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	617164405
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: query and read Type: commit Baseaddress: 380000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	617165203
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617166745
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: read Type: commit Baseaddress: 380000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	617167534
File opened	Path: C:\WINDOWS\WindowsShell.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	617168325
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	617198369
Section loaded	Path: \KnownDlls\comctl32.dll Access: write and read and execute Type: unknown Baseaddress: 5D090000 Size: 630784 Protection: read write Mapped to pid: own pid	success or wait	617202190
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617203486
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617203896
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617204166
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617204449
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617204714
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617205022
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617205284
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617205542
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617205805
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617206172
System info queried	Type: BasicInformation	success or wait	617207052
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 380000 Length: 7F1B8 Allocation Type: unknown Protection: page read and write	success or wait	617207308
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 380000 Length: 7F1BC Allocation Type: unknown Protection: page read and write	success or wait	617207560
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 381000 Length: 7EE98 Allocation Type: unknown Protection: page read and write	success or wait	617207878
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 383000 Length: 7EF4C Allocation Type: unknown Protection: page read and write	success or wait	617208417
File opened	Path: C:\WINDOWS\system32\comctl32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617209670
Section loaded	Path: C:\WINDOWS\system32\comctl32.dll Access: read Type: commit Baseaddress: 630000 Size: 618496 Protection: readonly Mapped to pid: own pid	success or wait	617210465
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	617211288
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	617212276
Process information queried	PID: 1832 Info Class: SessionInformation	success or wait	617217871
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	617219013
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	617221822
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: ChkAccDebugLevel	object name not found	617222441
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions Name: ProductType	success or wait	617223107
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Personal	success or wait	617224128
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Local Settings	success or wait	617224471
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: RsopDebugLevel	object name not found	617225275
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	617225861
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: RsopLogging	object name not found	617226192
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: UserEnvDebugLevel	object name not found	617226879
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: RsopLogging	object name not found	617227206
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	617227792
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: UserEnvDebugLevel	object name not found	617228385
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\ThemeManager Name: Compositing	object name not found	617229390
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: LameButtonText	object name not found	617230495
Process information queried	PID: 1832 Info Class: Cookie	success or wait	617231424
Process information queried	PID: 1832 Info Class: Cookie	success or wait	617231599
Process information queried	PID: 1832 Info Class: DefaultHardErrorMode	success or wait	617232215
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost Name: imgsvc	success or wait	617232608
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost Name: imgsvc	success or wait	617232970
System info queried	Type: BasicInformation	success or wait	617233727
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc Name: MaxRpcSize	object name not found	617234162
System time queried	Time: 129876420056250000	success or wait	617234859
System info queried	Type: PerformanceInformation	success or wait	617235270
Process information queried	PID: 1832 Info Class: QuotaLimits	success or wait	617235669
Process information queried	PID: 1832 Info Class: VmCounters	success or wait	617235878
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ServiceCurrent Name:	success or wait	617236411
File opened	Path: pipe\ Access: read attributes and synchronize Options: synchronous io non alert Overwritten: false	success or wait	617237553
File control set	Path: \ Control Code: 110018 Input Buffer: ........&.....n.e.t.\.N.t.C.o.n.t.r.o.l.P.i.p.e.1.1.	success or wait	617237991
File opened	Path: \pipe\net\NtControlPipe11 Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	617238544
File other op	Path: \net\NtControlPipe11 New path: Disposition: PipeInformation Data : unknown	success or wait	617239179
File write	Path: \net\NtControlPipe11 Offset: unknown Length: 4 Value: 28 07 00 00	success or wait	617239411
Process information queried	PID: 1832 Info Class: Wow64Information	success or wait	617240332
File read	Path: \net\NtControlPipe11 Offset: unknown Length: 534 Value: 26 00 00 00 50 00 00 00 00 00 00 00 14 00 00 00 00 00 00 00 73 00 74 00 69 00 73 00 76 00 63 00 00 00 00 00 00 00 00 00 88 96 09 00 35 04 91 7C 3E 04 91 7C 00 00 00 00 00 00 00 00 00 90 FD 7F BB 74 01 00 B0 96 09 00 00 90 FD 7F 00 10 90 7C 00 00 00 00 00 00 01 00 00 90 FD 7F 78 00 00 00 66 45 91 7C	success or wait	617240531
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 9A000 Length: 7F5AC Allocation Type: unknown Protection: page read and write	success or wait	617256726
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 630000 Length: 7F87C Allocation Type: unknown Protection: page read and write	success or wait	617258516
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 66B000 Length: 7F878 Allocation Type: unknown Protection: page read and write	success or wait	617258726
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 66B000 Length: 1000 New Protection: page read and write and page guard New Protection: page read and write	success or wait	617258997
Thread created	PID: 1832 TID: 1992 EIP: 7C8106F9 EAX: 77DF3539 Imagepath: C:\WINDOWS\system32\svchost.exe	success or wait	617259397
Thread resumed	TID: 1992 PID: 1832 Path: C:\WINDOWS\system32\svchost.exe	success or wait	617260306
File write	Path: \net\NtControlPipe11 Offset: unknown Length: 8 Value: 00 00 00 00 00 00 00 00	success or wait	617260666
File read	Path: \net\NtControlPipe11 Offset: unknown Length: 534 Value: unknown	unknown	617264795
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\stisvc\Parameters Name: ServiceDll	success or wait	617265314
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\stisvc\Parameters Name: ServiceMain	object name not found	617265713
File opened	Path: c:\windows\system32\wiaservc.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617266577
Section loaded	Path: C:\WINDOWS\system32\wiaservc.dll Access: write and read and execute Type: commit Baseaddress: 670000 Size: 335872 Protection: execute Mapped to pid: own pid	success or wait	617267322
File opened	Path: c:\windows\system32\wiaservc.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617269057
Section loaded	Path: C:\WINDOWS\system32\wiaservc.dll Access: query and write and read and execute Type: image Baseaddress: 75AA0000 Size: 348160 Protection: read write Mapped to pid: own pid	success or wait	617269793
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617271264
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617271717
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617271970
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617272255
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617272508
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617272816
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617273071
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617273313
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617273562
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617273816
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617274065
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617274314
Section loaded	Path: \KnownDlls\CFGMGR32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	617274600
File opened	Path: c:\windows\system32\CFGMGR32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617275021
Section loaded	Path: C:\WINDOWS\system32\cfgmgr32.dll Access: query and write and read and execute Type: image Baseaddress: 74AE0000 Size: 28672 Protection: read write Mapped to pid: own pid	success or wait	617275771
Section loaded	Path: \KnownDlls\setupapi.DLL Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	617277469
File opened	Path: c:\windows\system32\setupapi.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617277861
Section loaded	Path: C:\WINDOWS\system32\setupapi.dll Access: query and write and read and execute Type: image Baseaddress: 77920000 Size: 995328 Protection: read write Mapped to pid: own pid	success or wait	617278604
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77921000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617280875
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77921000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617281297
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77921000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617281564
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77921000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617281826
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77921000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617282093
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77921000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617282486
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77921000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617282750
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77921000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617283016
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77921000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617283277
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77921000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617283546
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77921000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617283808
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 77921000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617284069
Section loaded	Path: \KnownDlls\mscms.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	617284494
File opened	Path: c:\windows\system32\mscms.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617284912
Section loaded	Path: C:\WINDOWS\system32\mscms.dll Access: query and write and read and execute Type: image Baseaddress: 73B30000 Size: 86016 Protection: read write Mapped to pid: own pid	success or wait	617285648
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 73B31000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617287453
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 73B31000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617288066
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 73B31000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617288618
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 73B31000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617289208
Section loaded	Path: \KnownDlls\WINSPOOL.DRV Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	617289821
File opened	Path: c:\windows\system32\WINSPOOL.DRV Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617290313
Section loaded	Path: C:\WINDOWS\system32\winspool.drv Access: query and write and read and execute Type: image Baseaddress: 73000000 Size: 155648 Protection: read write Mapped to pid: own pid	success or wait	617291074
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 73B31000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617296497
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617297070
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617297313
Section loaded	Path: \KnownDlls\WINSTA.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	617297600
File opened	Path: c:\windows\system32\WINSTA.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617298018
Section loaded	Path: C:\WINDOWS\system32\winsta.dll Access: query and write and read and execute Type: image Baseaddress: 76360000 Size: 65536 Protection: read write Mapped to pid: own pid	success or wait	617298761
Section loaded	Path: \KnownDlls\NETAPI32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	617301170
File opened	Path: c:\windows\system32\NETAPI32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617301586
Section loaded	Path: C:\WINDOWS\system32\netapi32.dll Access: query and write and read and execute Type: image Baseaddress: 5B860000 Size: 348160 Protection: read write Mapped to pid: own pid	success or wait	617302344
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	617309740
Memory attributes changed	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 75AA1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	617309985
Process information queried	PID: 1832 Info Class: Wow64Information	success or wait	617311996
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	617312332
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\PnP Name: seed	success or wait	617313254
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: OsLoaderPath	success or wait	617313881
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: OsLoaderPath	success or wait	617314237
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemPartition	success or wait	617314851
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemPartition	success or wait	617315206
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: SourcePath	success or wait	617316022
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: SourcePath	success or wait	617316378
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackSourcePath	success or wait	617317005
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackSourcePath	success or wait	617317363
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackCachePath	success or wait	617317987
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackCachePath	success or wait	617318348
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: DriverCachePath	success or wait	617319037
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: DriverCachePath	success or wait	617319392
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: DevicePath	success or wait	617320029
Mutant created	Name: unknown	success or wait	617320589
Mutant created	Name: unknown	success or wait	617320827
Mutant created	Name: unknown	success or wait	617321063
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogLevel	success or wait	617321393
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogLevel	success or wait	617321748
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogPath	object name not found	617322161
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	617323558
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Hostname	success or wait	617324202
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Domain	success or wait	617324860
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 364000 Length: 66F154 Allocation Type: unknown Protection: page read and write	success or wait	617325494
System info queried	Type: BasicInformation	success or wait	617325787
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 670000 Length: 66F394 Allocation Type: unknown Protection: page read and write	success or wait	617326020
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 670000 Length: 66F398 Allocation Type: unknown Protection: page read and write	success or wait	617326251
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 671000 Length: 66F074 Allocation Type: unknown Protection: page read and write	success or wait	617326546
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Debug\wiaservc.dll Name: DebugFlags	success or wait	617329741
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Debug Name: DebugFileSizeLimit	success or wait	617330738
File opened	Path: C:\WINDOWS\system32\rpcss.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617332731
Section loaded	Path: C:\WINDOWS\system32\rpcss.dll Access: write and read and execute Type: commit Baseaddress: 680000 Size: 401408 Protection: execute Mapped to pid: own pid	success or wait	617333479
System info queried	Type: BasicInformation	success or wait	617335387
System info queried	Type: BasicInformation	success or wait	617335597
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 9B000 Length: 66FC44 Allocation Type: unknown Protection: page read and write	success or wait	617335835
System info queried	Type: BasicInformation	success or wait	617336110
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 9C000 Length: 66FBF0 Allocation Type: unknown Protection: page read and write	success or wait	617336363
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage Name: DebugStiMonUI	object name not found	617337601
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: MaxSize	object name not found	617340665
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: TruncateOnBoot	object name not found	617340994
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: Level	object name not found	617341334
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: Mode	object name not found	617341655
File opened	Path: C:\WINDOWS\Sti_Trace.log Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	617342155
File other op	Path: C:\WINDOWS\Sti_Trace.log New path: Disposition: PositionInformation Data : Offset: 0	success or wait	617343567
Mutant created	Name: \BaseNamedObjects\StiTraceMutexSti_Trace.log	success or wait	617343779
File opened	Path: C:\WINDOWS\system32\winlogon.exe Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617344974
Section loaded	Path: C:\WINDOWS\system32\winlogon.exe Access: write and read and execute Type: commit Baseaddress: 680000 Size: 507904 Protection: execute Mapped to pid: own pid	success or wait	617345731
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: A0000 Length: 66F234 Allocation Type: unknown Protection: page read and write	success or wait	617348717
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: MaximumAllowedAllocationSize	object name not found	617350167
Section loaded	Path: \KnownDlls\xpsp2res.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	617350871
File opened	Path: C:\WINDOWS\system32\xpsp2res.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617351269
Section loaded	Path: C:\WINDOWS\system32\xpsp2res.dll Access: query and write and read and execute Type: image Baseaddress: 680000 Size: 2904064 Protection: read write Mapped to pid: own pid	conflicting addresses	617352114
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{A1F4E726-8CF1-11D1-BF92-0060081ED811} Name: AuthenticationLevel	object name not found	617355605
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{A1F4E726-8CF1-11D1-BF92-0060081ED811} Name: AccessPermission	success or wait	617355941
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	617356812
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	617357800
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	617358589
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	617358896
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: A1000 Length: 66F330 Allocation Type: unknown Protection: page read and write	success or wait	617359218
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	617359596
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 22 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	617361063
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	617362039
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........d.......L.....9.....l.].]d.I.w...'-.........................................................	pending	617363495
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,...................l.].]d.I.w...'-.	pending	617364591
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: Com+Enabled	success or wait	617368058
Section loaded	Path: \KnownDlls\CLBCATQ.DLL Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	617368662
File opened	Path: C:\WINDOWS\system32\CLBCATQ.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617369091
Section loaded	Path: C:\WINDOWS\system32\clbcatq.dll Access: query and write and read and execute Type: image Baseaddress: 76FD0000 Size: 520192 Protection: read write Mapped to pid: own pid	success or wait	617369865
Section loaded	Path: \KnownDlls\COMRes.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	617372575
File opened	Path: C:\WINDOWS\system32\COMRes.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	617373022
Section loaded	Path: C:\WINDOWS\system32\comres.dll Access: query and write and read and execute Type: image Baseaddress: 77050000 Size: 806912 Protection: read write Mapped to pid: own pid	success or wait	617373805
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: MinimumFreeMemPercentageToCreateProcess	object name not found	617381128
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: MinimumFreeMemPercentageToCreateObject	object name not found	617381534
Process information queried	PID: 1832 Info Class: Wow64Information	success or wait	617382360
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: Com+Enabled	success or wait	617382733
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	617385543
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: A2000 Length: 66F740 Allocation Type: unknown Protection: page read and write	success or wait	617386618
System info queried	Type: BasicInformation	success or wait	617386927
System info queried	Type: ProcessorInformation	success or wait	617387178
File opened	Path: C:\WINDOWS\Registration\R000000000007.clb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	617387487
File other op	Path: C:\WINDOWS\Registration\R000000000007.clb New path: Disposition: PositionInformation Data : Offset: 22512	success or wait	617388314
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: A3000 Length: 66F6E4 Allocation Type: unknown Protection: page read and write	success or wait	617388651
File other op	Path: C:\WINDOWS\Registration\R000000000007.clb New path: Disposition: PositionInformation Data : Offset: 0	success or wait	617389031
File read	Path: C:\WINDOWS\Registration\R000000000007.clb Offset: unknown Length: 22512 Value: 43 4F 4D 2B 01 00 00 00 01 00 12 00 24 00 00 00 00 01 01 00 63 00 00 00 00 00 00 01 01 00 00 00 00 01 10 00 00 00 00 00 C0 00 00 00 00 00 00 46 0E 00 00 00 30 01 00 00 A0 03 00 00 33 5F 30 00 D0 04 00 00 0C 00 00 00 33 5F 31 00 DC 04 00 00 88 02 00 00 33 5F 32 00 64 07 00 00 3C 00 00 00 33 5F 33 00	success or wait	617389279
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 365000 Length: 66F740 Allocation Type: unknown Protection: page read and write	success or wait	617404689
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	617405347
System info queried	Type: BasicInformation	success or wait	617405922
System info queried	Type: ProcessorInformation	success or wait	617406166
Memory allocated	PID: 1832 Path: C:\WINDOWS\system32\svchost.exe Base: 950000 Length: 66FAD8 Allocation Type: unknown Protection: page no access	success or wait	617406407
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1E75357-881A-419E-83E2-BB16DB197C68}\LocalServer32 Name: LocalServer32	object name not found	617407486
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1E75357-881A-419E-83E2-BB16DB197C68}\LocalServer32 Name: NULL	success or wait	617408264
System info queried	Type: BasicInformation	success or wait	617409883
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	617410415
Thread created	PID: 1832 TID: 2016 EIP: 7C8106F9 EAX: 77E76C7D Imagepath: C:\WINDOWS\system32\svchost.exe	success or wait	617412597
Thread resumed	TID: 2016 PID: 1832 Path: C:\WINDOWS\system32\svchost.exe	success or wait	617413426
Thread delayed	Time: 0 TID: 2016	success or wait	617414022
Thread created	PID: 1832 TID: 1656 EIP: 7C8106F9 EAX: 774FE4DF Imagepath: C:\WINDOWS\system32\svchost.exe	success or wait	617418117
Thread resumed	TID: 1656 PID: 1832 Path: C:\WINDOWS\system32\svchost.exe	success or wait	617419097
Thread delayed	Time: -60 TID: 1656	success or wait	617420406
File opened	Path: C:\WINDOWS\wiaservc.log Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	617424391
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: MaxSize	object name not found	617425654
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: Level	object name not found	617426009
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: Mode	object name not found	617426334
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: Detail	object name not found	617426662
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: TruncateOnBoot	object name not found	617427006
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: ClearLogOnBoot	object name not found	617427333
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: LogToDebugger	object name not found	617427657
File other op	Path: C:\WINDOWS\wiaservc.log New path: Disposition: PositionInformation Data : Offset: 0	success or wait	617428138
File other op	Path: C:\WINDOWS\wiaservc.log New path: Disposition: EndOfFileInformation Data : unknown	success or wait	617428392
File other op	Path: C:\WINDOWS\wiaservc.log New path: Disposition: AllocationInformation Data : unknown	success or wait	617430591
File other op	Path: C:\WINDOWS\wiaservc.log New path: Disposition: PositionInformation Data : Offset: 0	success or wait	617432204
File write	Path: C:\WINDOWS\wiaservc.log Offset: unknown Length: 47 Value: 5B 77 69 61 73 65 72 76 63 5D 20 4F 70 65 6E 65 64 20 6C 6F 67 20 61 74 20 37 2F 32 34 2F 32 30 31 32 20 31 35 3A 32 30 3A 30 35 2E 36 38 37	success or wait	617432491
File write	Path: C:\WINDOWS\wiaservc.log Offset: unknown Length: 2 Value: 0D 0A	success or wait	617433741
Thread created	PID: 1832 TID: 2004 EIP: 7C8106F9 EAX: 75ACC5E7 Imagepath: C:\WINDOWS\system32\svchost.exe	success or wait	617435335
Thread resumed	TID: 2004 PID: 1832 Path: C:\WINDOWS\system32\svchost.exe	success or wait	617436247
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage Name: EnableVolumeDevices	object name not found	617437536
Mutant created	Name: unknown	success or wait	617438431
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	617440033
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	617440795
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	617441111
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	617441462
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 23 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 4E 00 54 00 20 00 41 00 55 00 54 00 48 00 4F 00 52 00 49 00 54 00 59 00 00 00 00 00 01 00 00 00	success or wait	617442082
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	617442995
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........j.......R.............\..9.O.-..&...*.,.................S.e.L.o.a.d.D.r.i.v.e.r.P.r.i.v.i.l.e.g.e.	pending	617444357
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,.....................\..9.O.-..&...	pending	617445217
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	617446088
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........b.......J.............T...(D...t..P.".$.................S.e.U.n.d.o.c.k.P.r.i.v.i.l.e.g.e.	pending	617447437
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,.....................T...(D...t..P.	pending	617448264
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617449044
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617451908
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617488216
Mutant created	Name: unknown	success or wait	617488618
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617489400
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617490306
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617491034
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617491791
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617492542
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617493325
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617494151
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617495456
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617496226
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617496950
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617497709
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617498528
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617499246
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617500030
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617500852
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617501574
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617502350
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617503174
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617503941
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617504739
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617505479
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617506239
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617506986
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617507753
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617508499
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617509242
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617509999
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617510744
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617511511
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617512258
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617512977
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617513731
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617514475
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617515243
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617515983
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617516703
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617517461
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617518204
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617519006
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617519747
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617520463
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617521224
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617521967
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617522683
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617523488
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617524230
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	617524948
Section loaded	Path: \KnownDlls\WINTRUST.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	618110432
File opened	Path: C:\WINDOWS\system32\WINTRUST.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	618110919
Section loaded	Path: C:\WINDOWS\system32\wintrust.dll Access: query and write and read and execute Type: image Baseaddress: 76C30000 Size: 188416 Protection: read write Mapped to pid: own pid	success or wait	618111717
Section loaded	Path: \KnownDlls\CRYPT32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	618114391
File opened	Path: C:\WINDOWS\system32\CRYPT32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	618114842
Section loaded	Path: C:\WINDOWS\system32\crypt32.dll Access: query and write and read and execute Type: image Baseaddress: 77A80000 Size: 610304 Protection: read write Mapped to pid: own pid	success or wait	618115617
Section loaded	Path: \KnownDlls\MSASN1.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	618119036
File opened	Path: C:\WINDOWS\system32\MSASN1.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	618119496
Section loaded	Path: C:\WINDOWS\system32\msasn1.dll Access: query and write and read and execute Type: image Baseaddress: 77B20000 Size: 73728 Protection: read write Mapped to pid: own pid	success or wait	618120281
Section loaded	Path: \KnownDlls\IMAGEHLP.dll Access: write and read and execute Type: unknown Baseaddress: 76C90000 Size: 163840 Protection: read write Mapped to pid: own pid	success or wait	618127038
System info queried	Type: BasicInformation	success or wait	618136276
System info queried	Type: ProcessorInformation	success or wait	618136589
System info queried	Type: BasicInformation	success or wait	618136845
Mutant created	Name: unknown	success or wait	618137972
Mutant created	Name: unknown	success or wait	618138232
Mutant created	Name: unknown	success or wait	618139636
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	618740416
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	618741138
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DD522ACC-F821-461A-A407-50B198B896DC} Name: AppID	success or wait	618742405
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{B1B9CBB2-B198-47E2-8260-9FD629A2B2EC} Name: DllSurrogate	object name not found	618743137
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{B1B9CBB2-B198-47E2-8260-9FD629A2B2EC} Name: LocalService	success or wait	618743494
Process information queried	PID: 1832 Info Class: SessionInformation	success or wait	618744364
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CC271F08-E1DD-49BF-87CC-CD6DCF3F3D9F}\ProxyStubClsid32 Name: NULL	success or wait	618757421
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	618758773
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	618759642
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8DA6310-E19B-11D0-933C-00A0C90DCAA9}\InProcServer32 Name: InprocServer32	object name not found	618760830
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8DA6310-E19B-11D0-933C-00A0C90DCAA9}\InProcServer32 Name: NULL	success or wait	618761592
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8DA6310-E19B-11D0-933C-00A0C90DCAA9} Name: AppID	object name not found	618762419
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B8DA6310-E19B-11D0-933C-00A0C90DCAA9}\InProcServer32 Name: ThreadingModel	success or wait	618763913
File opened	Path: C:\WINDOWS\system32\actxprxy.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	618765054
Section loaded	Path: C:\WINDOWS\system32\actxprxy.dll Access: write and read and execute Type: commit Baseaddress: B20000 Size: 98304 Protection: execute Mapped to pid: own pid	success or wait	618765898
File opened	Path: C:\WINDOWS\system32\actxprxy.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	618767986
Section loaded	Path: C:\WINDOWS\system32\actxprxy.dll Access: query and write and read and execute Type: image Baseaddress: 71D40000 Size: 110592 Protection: read write Mapped to pid: own pid	success or wait	618768918
File write	Path: \lsarpc Offset: 0 Length: 64 Value: 05 00 00 03 10 00 00 00 40 00 00 00 07 00 00 00 28 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 00 02 00 01 00 00 08 00 00	success or wait	618774025
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 02 03 10 00 00 00 30 00 00 00 07 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 C2 A4 2F 20 9D D0 7D 48 85 4F E9 DC 79 65 C9 AD 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 4E 00 54 00 20 00 41 00 55 00 54 00 48 00 4F 00 52 00 49 00 54 00 59 00 00 00 00 00 01 00 00 00	success or wait	618775428
File write	Path: \lsarpc Offset: 0 Length: 136 Value: 05 00 00 03 10 00 00 00 88 00 00 00 08 00 00 00 70 00 00 00 00 00 44 00 00 00 00 00 C2 A4 2F 20 9D D0 7D 48 85 4F E9 DC 79 65 C9 AD 01 00 00 00 01 00 00 00 26 00 28 00 00 00 02 00 14 00 00 00 00 00 00 00 13 00 00 00 4E 00 54 00 20 00 41 00 55 00 54 00 48 00 4F 00 52 00 49 00 54 00 59 00 5C 00 53 00	success or wait	618776625
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 02 03 10 00 00 00 9C 00 00 00 08 00 00 00 84 00 00 00 00 00 00 00 00 00 02 00 01 00 00 00 04 00 02 00 20 00 00 00 01 00 00 00 18 00 1A 00 08 00 02 00 0C 00 02 00 0D 00 00 00 00 00 00 00 0C 00 00 00 4E 00 54 00 20 00 41 00 55 00 54 00 48 00 4F 00 52 00 49 00 54 00 59 00 00 00 00 00 01 00 00 00	success or wait	618777511
File write	Path: \lsarpc Offset: 0 Length: 44 Value: 05 00 00 03 10 00 00 00 2C 00 00 00 09 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 C2 A4 2F 20 9D D0 7D 48 85 4F E9 DC 79 65 C9 AD	success or wait	618778524
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 02 03 10 00 00 00 30 00 00 00 09 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 D2 0B 00 7C D2 0B 00 0D 00 00 00 00 00 00 00 0C 00 00 00 4E 00 54 00 20 00 41 00 55 00 54 00 48 00 4F 00 52 00 49 00 54 00 59 00 00 00 00 00 01 00 00 00	success or wait	618779349
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{EE93D145-9B4E-480C-8385-1E8119A6F7B2}\ProxyStubClsid32 Name: NULL	success or wait	618781971
Process information queried	PID: 1832 Info Class: DeviceMap	success or wait	618784325
File opened	Path: D:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	no media in device	618784700
Process information queried	PID: 1832 Info Class: DeviceMap	success or wait	618791022
Key value deleted	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run Keyname: StillImageMonitor	object name not found	618793993
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	618794707
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	618795417
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1F4E726-8CF1-11D1-BF92-0060081ED811}\LocalServer32 Name: LocalServer32	object name not found	618796498
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A1F4E726-8CF1-11D1-BF92-0060081ED811}\LocalServer32 Name: NULL	success or wait	618797208
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage Name: DeviceID	object name not found	618801273
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected Name: DefaultHandler	object name not found	618801815
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected Name: GUID	success or wait	618802169
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{D13E3F25-1688-45A0-9743-759EB35CDF9A} Name: Name	success or wait	618802684
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{D13E3F25-1688-45A0-9743-759EB35CDF9A} Name: Desc	success or wait	618803215
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{D13E3F25-1688-45A0-9743-759EB35CDF9A} Name: Icon	success or wait	618804481
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{D13E3F25-1688-45A0-9743-759EB35CDF9A} Name: Cmdline	object name not found	618804994
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Disconnected Name: DefaultHandler	object name not found	618805920
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Disconnected Name: GUID	success or wait	618806306
Thread created	PID: 1832 TID: 1792 EIP: 7C8106F9 EAX: 77E76C7D Imagepath: C:\WINDOWS\system32\svchost.exe	success or wait	618807526
Thread resumed	TID: 1792 PID: 1832 Path: C:\WINDOWS\system32\svchost.exe	success or wait	618808335
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton Name: DefaultHandler	object name not found	618808840
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton Name: GUID	success or wait	618809200
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{D13E3F25-1688-45A0-9743-759EB35CDF9A} Name: Name	success or wait	618810731
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{D13E3F25-1688-45A0-9743-759EB35CDF9A} Name: Desc	success or wait	618814653
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{D13E3F25-1688-45A0-9743-759EB35CDF9A} Name: Icon	success or wait	618814988
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{D13E3F25-1688-45A0-9743-759EB35CDF9A} Name: Cmdline	object name not found	618818280
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{5EB2502A-8CF1-11D1-BF92-0060081ED811}\ProxyStubClsid32 Name: NULL	success or wait	618818589
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	618819865
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\STIProxyEvent Name: DefaultHandler	object name not found	618824273
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\STIProxyEvent Name: GUID	success or wait	618824627
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	618827536
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32 Name: InprocServer32	object name not found	618829100
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32 Name: NULL	success or wait	618830014
Mutant created	Name: \BaseNamedObjects\Global\WiaDebugFileMut	success or wait	618831217
File opened	Path: C:\WINDOWS\wiadebug.log Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	618831658
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 0	success or wait	618836484
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145} Name: AppID	object name not found	618837480
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4DB1AD10-3391-11D2-9A33-00C04FA36145}\InProcServer32 Name: ThreadingModel	success or wait	618839220
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 99 Value: 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 53 74 61 72 74 20 27 77 69 61 73 65 72 76 63 2E 64 6C 6C 27 20 44 65 62 75 67 20 2D 20 54 69 6D 65 3A 20 32 30 31 32 2F 30 37 2F 32 34 20 31 35 3A 32 30 3A 30 36 3A 37 38 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 3D 0D 0A	success or wait	618839643
File opened	Path: C:\WINDOWS\system32\sti.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	618846718
Section loaded	Path: C:\WINDOWS\system32\sti.dll Access: write and read and execute Type: commit Baseaddress: B60000 Size: 69632 Protection: execute Mapped to pid: own pid	success or wait	618848753
File opened	Path: C:\WINDOWS\system32\sti.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	618851762
Section loaded	Path: C:\WINDOWS\system32\sti.dll Access: query and write and read and execute Type: image Baseaddress: 73BA0000 Size: 77824 Protection: read write Mapped to pid: own pid	success or wait	618852660
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 99	success or wait	618855832
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 58 Value: 09 2A 3E 20 53 74 69 53 65 72 76 69 63 65 4D 61 69 6E 20 65 6E 74 65 72 65 64 2C 20 54 69 6D 65 3A 20 32 30 31 32 2F 30 37 2F 32 34 20 31 35 3A 32 30 3A 30 36 3A 37 38 0D 0A	success or wait	618856082
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: MaxSize	object name not found	618867231
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: Level	object name not found	618869243
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Logging Name: Mode	object name not found	618869772
File opened	Path: C:\WINDOWS\Sti_Trace.log Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	618870661
File other op	Path: C:\WINDOWS\Sti_Trace.log New path: Disposition: PositionInformation Data : Offset: 0	success or wait	618871693
Mutant created	Name: \BaseNamedObjects\StiTraceMutexSti_Trace.log	object name exists	618872289
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	618874342
Thread created	PID: 1832 TID: 2020 EIP: 7C8106F9 EAX: 77E76C7D Imagepath: C:\WINDOWS\system32\svchost.exe	success or wait	618877888
Thread resumed	TID: 2020 PID: 1832 Path: C:\WINDOWS\system32\svchost.exe	success or wait	618889935
Object set	Path: 1832 Info Class: dacl	success or wait	618891470
Object set	Path: 1992 Info Class: dacl	success or wait	618899702
Thread created	PID: 1832 TID: 2024 EIP: 7C8106F9 EAX: 77E76C7D Imagepath: C:\WINDOWS\system32\svchost.exe	success or wait	619440053
Thread resumed	TID: 2024 PID: 1832 Path: C:\WINDOWS\system32\svchost.exe	success or wait	619441155
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 157	success or wait	619445162
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 48 Value: 09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 53 65 74 74 69 6E 67 20 68 61 6E 64 6C 65 72 20 66 6F 72 20 2A 0D 0A	success or wait	619445473
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 205	success or wait	619449908
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 59 Value: 09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 48 61 6E 64 6C 65 72 20 69 73 20 4D 69 63 72 6F 73 6F 66 74 20 4F 66 66 69 63 65 20 57 6F 72 64 0D 0A	success or wait	619450249
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected Name: GUID	success or wait	619455179
Key created	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	success or wait	619455953
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937} Name: Name Type: unicode Data: Microsoft Office Word Old data:	success or wait	619458554
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937} Name: Desc Type: unicode Data: Microsoft Office Word Old data:	success or wait	619459317
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937} Name: Icon Type: unicode Data: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE,1 Old data:	success or wait	619460413
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937} Name: Cmdline Type: unicode Data: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE /IMG_WIA Old data:	success or wait	619461294
Key created	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	success or wait	619462822
Key created	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}\LocalServer32	success or wait	619467151
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}\LocalServer32 Name: NULL Type: unicode Data: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE /IMG_WIA Old data:	success or wait	619469776
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 264	success or wait	619472885
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 48 Value: 09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 53 65 74 74 69 6E 67 20 68 61 6E 64 6C 65 72 20 66 6F 72 20 2A 0D 0A	success or wait	619473183
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 312	success or wait	619478569
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 46 Value: 09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 48 61 6E 64 6C 65 72 20 69 73 20 49 6E 74 65 72 6E 61 6C 0D 0A	success or wait	619478871
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected Name: GUID	success or wait	619483861
Key created	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22}	success or wait	619484574
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22} Name: Name Type: unicode Data: Internal Old data:	success or wait	619488609
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22} Name: Desc Type: unicode Data: Internal Old data:	success or wait	619489341
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22} Name: Icon Type: unicode Data: Internal Old data:	success or wait	619490338
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 358	success or wait	619491607
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 48 Value: 09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 53 65 74 74 69 6E 67 20 68 61 6E 64 6C 65 72 20 66 6F 72 20 2A 0D 0A	success or wait	619491909
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 406	success or wait	619496296
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 46 Value: 09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 48 61 6E 64 6C 65 72 20 69 73 20 49 6E 74 65 72 6E 61 6C 0D 0A	success or wait	619496602
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 452	success or wait	619502987
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 48 Value: 09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 53 65 74 74 69 6E 67 20 68 61 6E 64 6C 65 72 20 66 6F 72 20 2A 0D 0A	success or wait	619503354
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 500	success or wait	619507690
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 59 Value: 09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 48 61 6E 64 6C 65 72 20 69 73 20 4D 69 63 72 6F 73 6F 66 74 20 4F 66 66 69 63 65 20 57 6F 72 64 0D 0A	success or wait	619507992
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected Name: GUID	success or wait	619513304
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Disconnected Name: GUID	success or wait	619514040
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton Name: GUID	success or wait	619515302
Key created	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}	success or wait	619515992
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937} Name: Name Type: unicode Data: Microsoft Office Word Old data:	success or wait	619517744
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937} Name: Desc Type: unicode Data: Microsoft Office Word Old data:	success or wait	619518484
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937} Name: Icon Type: unicode Data: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE,1 Old data:	success or wait	619520392
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937} Name: Cmdline Type: unicode Data: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE /IMG_WIA Old data:	success or wait	619521201
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FBF703AD-8B1E-40C9-8449-F6BCFEE56937}\LocalServer32 Name: NULL Type: unicode Data: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE /IMG_WIA Old data:	success or wait	619524648
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 559	success or wait	619526189
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 48 Value: 09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 53 65 74 74 69 6E 67 20 68 61 6E 64 6C 65 72 20 66 6F 72 20 2A 0D 0A	success or wait	619526486
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 607	success or wait	619531996
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 46 Value: 09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 48 61 6E 64 6C 65 72 20 69 73 20 49 6E 74 65 72 6E 61 6C 0D 0A	success or wait	619532296
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Connected Name: GUID	success or wait	619537190
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\Disconnected Name: GUID	success or wait	619537933
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton Name: GUID	success or wait	619538669
Key created	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22}	success or wait	619539365
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22} Name: Name Type: unicode Data: Internal Old data:	success or wait	619540418
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22} Name: Desc Type: unicode Data: Internal Old data:	success or wait	619541335
Key value set	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\StillImage\Events\ScanButton\{5F4BAAD0-4D59-4FCD-B213-783CE7A92F22} Name: Icon Type: unicode Data: Internal Old data:	success or wait	619542459
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 653	success or wait	619543770
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 48 Value: 09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 53 65 74 74 69 6E 67 20 68 61 6E 64 6C 65 72 20 66 6F 72 20 2A 0D 0A	success or wait	619544072
File other op	Path: C:\WINDOWS\wiadebug.log New path: Disposition: PositionInformation Data : Offset: 701	success or wait	619548466
File write	Path: C:\WINDOWS\wiadebug.log Offset: unknown Length: 46 Value: 09 52 65 67 69 73 74 65 72 45 76 65 6E 74 43 61 6C 6C 62 61 63 6B 20 3A 20 48 61 6E 64 6C 65 72 20 69 73 20 49 6E 74 65 72 6E 61 6C 0D 0A	success or wait	619548776
Thread created	PID: 1832 TID: 1548 EIP: 7C8106F9 EAX: 77E76C7D Imagepath: C:\WINDOWS\system32\svchost.exe	success or wait	728104702
Thread resumed	TID: 1548 PID: 1832 Path: C:\WINDOWS\system32\svchost.exe	success or wait	728106550
Thread delayed	Time: -60 TID: 1656	success or wait	832191407

Analysis File: ~WORDL.tmp PID: 1112 Parent PID: 1160

General

Start time:	15:20:20
Start date:	24/07/2012
Path:	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp
Wow64 process (32bit):	false
Commandline:	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp
Imagebase:	0x400000
File size:	90112 bytes
MD5 hash:	99C47CE55EF67DAEE72E82608E4F62DD

File Activites

File Opened

File Path	Access	Options	Content overwritten	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1\	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\IMM32.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	3	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	2	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Manifest	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\MSCTF.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	4011A6	CreateWindowExA
C:\WINDOWS\system32\msctfime.ime	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	4	4011A6	CreateWindowExA
C:\WINDOWS\system32\ole32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	4011A6	CreateWindowExA
\Device\KsecDD	read data or list directory and synchronize	synchronous io alert	false	success or wait	1	4011A6	CreateWindowExA
C:\WINDOWS\system32\rundll32.exe	read data or list directory and execute or traverse and read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	3	40187C	CreateProcessW
C:\WINDOWS\system32\Apphelp.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	40187C	CreateProcessW
C:\WINDOWS\system32\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	9	40187C	CreateProcessW
C:\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	11	40187C	CreateProcessW
C:\WINDOWS\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	7	40187C	CreateProcessW
C:\WINDOWS\system32\rundll32.exe.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	40187C	CreateProcessW
C:\WINDOWS\system32\rpcss.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	90909090	unknown
C:\WINDOWS\system32\netapi32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\SETUPAPI.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	40178C	ShellExecuteExW
IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}	read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	2	40178C	ShellExecuteExW
STORAGE#Volume#1&30a96598&0&SignatureF4ACF4ACOffset7E00Length3BFEFCE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}	read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	2	40178C	ShellExecuteExW
C:\Documents and Settings\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	4	40178C	ShellExecuteExW
C:\Documents and Settings\Administrator\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	40178C	ShellExecuteExW
C:\Documents and Settings\Administrator\My Documents\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	6	40178C	ShellExecuteExW
C:\Documents and Settings\All Users\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	40178C	ShellExecuteExW
C:\Documents and Settings\All Users\Documents\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	3	40178C	ShellExecuteExW
C:\WINDOWS\system32\CLBCATQ.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\COMRes.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\urlmon.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	40178C	ShellExecuteExW
C:\WINDOWS\system32\urlmon.dll.123.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\urlmon.dll.123.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\cmd.exe	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	5	40178C	ShellExecuteExW
C:\WINDOWS\system32\cmd.exe.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	40178C	ShellExecuteExW
C:\WINDOWS\WindowsShell.Manifest	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\msctfime.ime	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	4011A6	CreateWindowExA
C:\Documents and Settings\Administrator\Application Data\taskman.dll	read attributes and synchronize and generic read and generic write	sequential only and synchronous io non alert and non directory file	true	success or wait	1	40155A	CreateFileW
C:\WINDOWS\system32\rundll32.exe	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file	true	success or wait	1	4015AF	CreateFileW
C:\WINDOWS\AppPatch\sysmain.sdb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	40187C	CreateProcessW
C:\WINDOWS\AppPatch\systest.sdb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	object name not found	2	40187C	CreateProcessW
\Device\NamedPipe\ShimViewer	write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize	no options	true	object name not found	2	40187C	CreateProcessW
C:\WINDOWS\system32\rundll32.exe	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	40187C	CreateProcessW
\pipe\wkssvc	read attributes and synchronize and generic read and generic write	non directory file and open no recall	true	success or wait	1	40178C	ShellExecuteExW
\pipe\lsarpc	read attributes and synchronize and generic read and generic write	non directory file	true	success or wait	2	40178C	ShellExecuteExW
MountPointManager	read attributes and synchronize	synchronous io non alert and non directory file	true	success or wait	6	40178C	ShellExecuteExW
C:\WINDOWS\Registration\R000000000007.clb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\cmd.exe	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	5	40178C	ShellExecuteExW
C:\WINDOWS\system32\ieframe.dll	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	90909090	unknown

File Created

File Path	Access	Attributes	Options	Completion	Count	Source Address	Symbol
C:\Documents and Settings\Administrator\Application Data\taskman.dll	read attributes and synchronize and generic read and generic write	normal	synchronous io non alert and non directory file	success or wait	1	401429	CreateFileW

File Written

File Path	Offset	Length	Value	Completion	Count	Source Address	Symbol
C:\Documents and Settings\Administrator\Application Data\taskman.dll	unknown	61440	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65	success or wait	1	401471	WriteFile
\wkssvc	0	72	05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	1	40178C	ShellExecuteExW
\lsarpc	0	72	05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	2	40178C	ShellExecuteExW

File Path	Offset	Length	Value	Completion	Count	Source Address	Symbol
\wkssvc	0	1024	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	pending	1	40178C	ShellExecuteExW
\lsarpc	0	1024	05 00 02 03 10 00 00 00 44 00 00 00 01 00 00 00 2C 00 00 00 00 00 00 00 58 4E 15 00 0A 00 00 00 00 00 00 00 0A 00 00 00 57 00 4F 00 52 00 4B 00 47 00 52 00 4F 00 55 00 50 00 00 00 02 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	pending	1	40178C	ShellExecuteExW
\lsarpc	0	1024	05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	pending	1	40178C	ShellExecuteExW
C:\Documents and Settings\Administrator\My Documents\desktop.ini	unknown	84	5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	6	40178C	ShellExecuteExW
C:\Documents and Settings\All Users\Documents\desktop.ini	unknown	62	5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	3	40178C	ShellExecuteExW
C:\WINDOWS\Registration\R000000000007.clb	unknown	22512	43 4F 4D 2B 01 00 00 00 01 00 12 00 24 00 00 00 00 01 01 00 63 00 00 00 00 00 00 01 01 00 00 00 00 01 10 00 00 00 00 00 C0 00 00 00 00 00 00 46 0E 00 00 00 30 01 00 00 A0 03 00 00 33 5F 30 00 D0 04 00 00 0C 00 00 00 33 5F 31 00 DC 04 00 00 88 02 00 00 33 5F 32 00 64 07 00 00 3C 00 00 00 33 5F 33 00	success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\cmd.exe	unknown	64	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D8 00 00 00	success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\cmd.exe	unknown	64	50 45 00 00 4C 01 03 00 AF 5B 02 48 00 00 00 00 00 00 00 00 E0 00 0F 01 0B 01 07 0A 00 F8 01 00 00 F6 03 00 00 00 00 00 46 50 00 00 00 10 00 00 00 F0 01 00 00 00 D0 4A 00 10 00 00 00 02 00 00	success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\cmd.exe	unknown	4	04 00 00 00	success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\cmd.exe	unknown	4	03 00 00 80	success or wait	1	40178C	ShellExecuteExW

File Path	Disposition	Data	Ascii Data	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1	90028	NU LL		success or wait	1	7C90E457	KiUserApcDispatcher
\wkssvc	11C017	05 00 00 03 10 00 00 00 20 00 00 00 01 00 00 00 08 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00	........ .......................	pending	1	40178C	ShellExecuteExW
\lsarpc	11C017	05 00 00 03 10 00 00 00 40 00 00 00 01 00 00 00 28 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 00 02 00 01 00 00 08 00 00	........@.......(.....,.........................................	pending	2	40178C	ShellExecuteExW
\lsarpc	11C017	05 00 00 03 10 00 00 00 6A 00 00 00 02 00 00 00 52 00 00 00 00 00 1F 00 00 00 00 00 D8 EE 13 6B 5E 86 4C 41 B2 29 A5 C3 DE 29 1A 91 2A 00 2C 00 00 00 02 00 16 00 00 00 00 00 00 00 15 00 00 00 53 00 65 00 4C 00 6F 00 61 00 64 00 44 00 72 00 69 00 76 00 65 00 72 00 50 00 72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 00	........j.......R..............k^.LA.)...)..*.,.................S.e.L.o.a.d.D.r.i.v.e.r.P.r.i.v.i.l.e.g.e.	pending	1	40178C	ShellExecuteExW
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 D8 EE 13 6B 5E 86 4C 41 B2 29 A5 C3 DE 29 1A 91	........,......................k^.LA.)...)..	pending	1	40178C	ShellExecuteExW
\lsarpc	11C017	05 00 00 03 10 00 00 00 62 00 00 00 02 00 00 00 4A 00 00 00 00 00 1F 00 00 00 00 00 18 9B 10 D2 4D 49 AC 45 A5 15 83 2D 36 D5 19 60 22 00 24 00 00 00 02 00 12 00 00 00 00 00 00 00 11 00 00 00 53 00 65 00 55 00 6E 00 64 00 6F 00 63 00 6B 00 50 00 72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 00	........b.......J...............MI.E...-6..`".$.................S.e.U.n.d.o.c.k.P.r.i.v.i.l.e.g.e.	pending	1	40178C	ShellExecuteExW
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 18 9B 10 D2 4D 49 AC 45 A5 15 83 2D 36 D5 19 60	........,.......................MI.E...-6..`	pending	1	40178C	ShellExecuteExW
C:\Documents and Settings\Administrator\Application Data\taskman.dll	BasicInformation	Creation Time: 13:00 28-02-2006 Last Access Time: 00:17 25-07-2012 Last Write Time: 15:42 14-04-2008 Change Time: 01:00 01-01-1601 File Attributes: none		success or wait	1	4015DA	SetFileTime
\wkssvc	PipeInformation	unknown		success or wait	1	40178C	ShellExecuteExW
\wkssvc	CompletionInformation	unknown		success or wait	1	40178C	ShellExecuteExW
\lsarpc	PipeInformation	unknown		success or wait	2	40178C	ShellExecuteExW
\lsarpc	CompletionInformation	unknown		success or wait	2	40178C	ShellExecuteExW
C:\WINDOWS\Registration\R000000000007.clb	PositionInformation	Offset: 22512		success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\Registration\R000000000007.clb	PositionInformation	Offset: 0		success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\cmd.exe	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 00:20 25-07-2012 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: none		success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\cmd.exe	PositionInformation	Offset: 216		success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\cmd.exe	PositionInformation	Offset: 288		success or wait	1	40178C	ShellExecuteExW
C:\WINDOWS\system32\cmd.exe	PositionInformation	Offset: 308		success or wait	1	40178C	ShellExecuteExW

Section Activites

Section loaded by Windows

File Path	Access	Type	Base	Size	Mapped to pid	Protection	Completion	Count
\KnownDlls\kernel32.dll	write and read and execute	unknown	7C800000	1007616	own pid	read write	success or wait	1
unknown	query and write and read and execute and extend size	reserve	7C800000	1007616	own pid	read write	success or wait	1
\NLS\NlsSectionUnicode	read	unknown	260000	90112	own pid	readonly	success or wait	1
\NLS\NlsSectionLocale	read	unknown	280000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey	query and read	unknown	2D0000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortTbls	read	unknown	320000	24576	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\KnownDlls\USER32.dll	write and read and execute	unknown	7E410000	593920	own pid	read write	success or wait	1
\KnownDlls\GDI32.dll	write and read and execute	unknown	77F10000	299008	own pid	read write	success or wait	1
\KnownDlls\ADVAPI32.dll	write and read and execute	unknown	77DD0000	634880	own pid	read write	success or wait	1
\KnownDlls\RPCRT4.dll	write and read and execute	unknown	77E70000	602112	own pid	read write	success or wait	1
\KnownDlls\Secur32.dll	write and read and execute	unknown	77FE0000	69632	own pid	read write	success or wait	1
\KnownDlls\SHELL32.dll	write and read and execute	unknown	7C9C0000	8482816	own pid	read write	success or wait	1
\KnownDlls\msvcrt.dll	write and read and execute	unknown	77C10000	360448	own pid	read write	success or wait	1
\KnownDlls\SHLWAPI.dll	write and read and execute	unknown	77F60000	483328	own pid	read write	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	420000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	420000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	query and write and read and execute	image	76390000	118784	own pid	read write	success or wait	1
\NLS\NlsSectionCType	read	unknown	860000	12288	own pid	readonly	success or wait	1
C:\WINDOWS\system32\shell32.dll	read	commit	870000	8462336	own pid	readonly	success or wait	1
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	write and read and execute	commit	870000	1056768	own pid	execute	success or wait	1
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	query and write and read and execute	image	773D0000	1060864	own pid	read write	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	write and read and execute	commit	870000	4096	own pid	execute	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	query and read	commit	870000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	read	commit	870000	4096	own pid	readonly	success or wait	1
\KnownDlls\comctl32.dll	write and read and execute	unknown	5D090000	630784	own pid	read write	success or wait	1
C:\WINDOWS\system32\comctl32.dll	read	commit	890000	618496	own pid	readonly	success or wait	1
C:\WINDOWS\system32\msctf.dll	write and read and execute	commit	890000	299008	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctf.dll	query and write and read and execute	image	74720000	311296	own pid	read write	success or wait	1
\BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-507921405-1960408961-839522115-500	query and write and read	commit	unknown	unknown	unknown	unknown	object name exists	1
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500SFM.DefaultS-1-5-21-507921405-1960408961-839522115-500	query and write and read and execute and extend size	unknown	8A0000	262144	own pid	read write	success or wait	1
\KnownDlls\version.dll	write and read and execute	unknown	77C00000	32768	own pid	read write	success or wait	1
C:\WINDOWS\system32\msctfime.ime	write and read and execute	commit	8E0000	180224	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctfime.ime	query and read	commit	8E0000	180224	own pid	readonly	success or wait	1
C:\WINDOWS\system32\msctfime.ime	write and read and execute	commit	8E0000	180224	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctfime.ime	query and read	commit	8E0000	180224	own pid	readonly	success or wait	1
\BaseNamedObjects\ShimSharedMemory	write	unknown	8E0000	57344	own pid	read write	success or wait	1
C:\WINDOWS\system32\msctfime.ime	write and read and execute	commit	8F0000	180224	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctfime.ime	query and write and read and execute	image	755C0000	188416	own pid	read write	success or wait	1
C:\WINDOWS\system32\ole32.dll	write and read and execute	commit	940000	1290240	own pid	execute	success or wait	1
C:\WINDOWS\system32\ole32.dll	query and write and read and execute	image	774E0000	1302528	own pid	read write	success or wait	1
C:\WINDOWS\system32\rundll32.exe	query and write and read and execute and extend size	image	774E0000	1302528	own pid	read write	success or wait	1
C:\WINDOWS\system32\apphelp.dll	write and read and execute	commit	8F0000	126976	own pid	execute	success or wait	1
C:\WINDOWS\system32\apphelp.dll	query and write and read and execute	image	77B40000	139264	own pid	read write	success or wait	1
C:\WINDOWS\AppPatch\sysmain.sdb	read	commit	940000	1208320	own pid	readonly	success or wait	1
\KnownDlls\VERSION.dll	write and read and execute	unknown	77C00000	32768	own pid	read write	success or wait	1
C:\WINDOWS\system32\rundll32.exe	write and read and execute	commit	8F0000	36864	own pid	execute	success or wait	1
C:\WINDOWS\system32\rundll32.exe	query and read	commit	8F0000	36864	own pid	readonly	success or wait	1
C:\WINDOWS\system32\rundll32.exe	write and read and execute	commit	8F0000	36864	own pid	execute	success or wait	1
C:\WINDOWS\system32\rundll32.exe	query and read	commit	8F0000	36864	own pid	readonly	success or wait	1
C:\WINDOWS\system32\rundll32.exe	query and read	commit	8F0000	36864	own pid	readonly	success or wait	1
C:\WINDOWS\system32\rpcss.dll	write and read and execute	commit	940000	401408	own pid	execute	success or wait	1
\KnownDlls\netapi32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\netapi32.dll	query and write and read and execute	image	5B860000	348160	own pid	read write	success or wait	1
\KnownDlls\SETUPAPI.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\setupapi.dll	query and write and read and execute	image	77920000	995328	own pid	read write	success or wait	1
\KnownDlls\CLBCATQ.DLL	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\clbcatq.dll	query and write and read and execute	image	76FD0000	520192	own pid	read write	success or wait	1
\KnownDlls\COMRes.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\comres.dll	query and write and read and execute	image	77050000	806912	own pid	read write	success or wait	1
\KnownDlls\OLEAUT32.dll	write and read and execute	unknown	77120000	569344	own pid	read write	success or wait	1
C:\WINDOWS\system32\urlmon.dll	write and read and execute	commit	940000	1212416	own pid	execute	success or wait	1
C:\WINDOWS\system32\urlmon.dll	query and write and read and execute	image	78130000	1257472	own pid	read write	success or wait	1
\KnownDlls\iertutil.dll	write and read and execute	unknown	3DFD0000	2002944	own pid	read write	success or wait	1
\BaseNamedObjects\Local\UrlZonesSM_Administrator	query and write and read	commit	unknown	unknown	unknown	unknown	object name exists	1
C:\WINDOWS\system32\cmd.exe	write and read and execute	commit	940000	389120	own pid	execute	success or wait	1
C:\WINDOWS\system32\cmd.exe	query and read	commit	940000	389120	own pid	readonly	success or wait	1
C:\WINDOWS\system32\cmd.exe	write and read and execute	commit	940000	389120	own pid	execute	success or wait	1
C:\WINDOWS\system32\cmd.exe	query and read	commit	940000	389120	own pid	readonly	success or wait	1
C:\WINDOWS\system32\cmd.exe	query and write and read and execute and extend size	image	940000	389120	own pid	readonly	success or wait	1
C:\WINDOWS\AppPatch\sysmain.sdb	read	commit	940000	1208320	own pid	readonly	success or wait	1
C:\WINDOWS\system32\cmd.exe	write and read and execute	commit	A70000	389120	own pid	execute	success or wait	1
C:\WINDOWS\system32\cmd.exe	query and read	commit	A70000	389120	own pid	readonly	success or wait	1
C:\WINDOWS\system32\cmd.exe	write and read and execute	commit	A70000	389120	own pid	execute	success or wait	1
C:\WINDOWS\system32\cmd.exe	query and read	commit	A70000	389120	own pid	readonly	success or wait	1
C:\WINDOWS\system32\cmd.exe	query and read	commit	940000	389120	own pid	readonly	success or wait	1

Registry Activites

Key Value Created

Key Path	Name	Type	Data	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Windows\ShellNoRoam\MUICache	C:\WINDOWS\system32\cmd.exe	unicode	Windows Command Processor	success or wait	1	40178C	ShellExecuteExW

Key Path	Name	Completion	Count	Source Address	Symbol
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CWDIllegalInDLLSearch	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server	TSAppCompat	success or wait	3	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	SafeDllSearchMode	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize	DisableMetaFiles	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows	AppInit_DLLs	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server	TSUserEnabled	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	LeakTrack	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	EnableBalloonTips	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared	CUAS	success or wait	1	4011A6	CreateWindowExA
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	4011A6	CreateWindowExA
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	4011A6	CreateWindowExA
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	4011A6	CreateWindowExA
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	4011A6	CreateWindowExA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF	EnableAnchorContext	object name not found	1	4011A6	CreateWindowExA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM	Ime File	success or wait	1	4011A6	CreateWindowExA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CriticalSectionTimeout	success or wait	1	4011A6	CreateWindowExA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	RWLockResourceTimeOut	object name not found	1	4011A6	CreateWindowExA
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAll	object name not found	1	4011A6	CreateWindowExA
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAllForOle32	object name not found	1	4011A6	CreateWindowExA
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableTypeLib	object name not found	1	4011A6	CreateWindowExA
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAll	object name not found	1	4011A6	CreateWindowExA
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAllForOle32	object name not found	1	4011A6	CreateWindowExA
HKEY_USERS\Software\Microsoft\CTF	Disable Thread Input Manager	object name not found	1	4011A6	CreateWindowExA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared	CUAS	success or wait	1	4011A6	CreateWindowExA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	AppData	success or wait	1	401919	SHGetSpecialFolderPathW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	SafeProcessSearchMode	object name not found	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility	DisableAppCompat	object name not found	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter	Installed	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	AuthenticodeEnabled	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	Levels	object name not found	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}	ItemData	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}	SaferFlags	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}	ItemData	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}	HashAlg	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}	ItemSize	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}	SaferFlags	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}	ItemData	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}	HashAlg	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}	ItemSize	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}	SaferFlags	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}	ItemData	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}	HashAlg	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}	ItemSize	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}	SaferFlags	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}	ItemData	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}	HashAlg	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}	ItemSize	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}	SaferFlags	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}	ItemData	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}	HashAlg	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}	ItemSize	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}	SaferFlags	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	DefaultLevel	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	PolicyScope	success or wait	1	40187C	CreateProcessW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	Cache	buffer overflow	1	40187C	CreateProcessW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	Cache	success or wait	1	40187C	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	LogFileName	object name not found	1	40187C	CreateProcessW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer	MaximizeApps	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer	MaximizeApps	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc	MaxRpcSize	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoNetHood	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoNetHood	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoPropertiesMyComputer	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoPropertiesMyComputer	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoInternetIcon	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoInternetIcon	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoCommonGroups	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoCommonGroups	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoControlPanel	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoControlPanel	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoSetFolders	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoSetFolders	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	AllowFileCLSIDJunctions	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	AllowFileCLSIDJunctions	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	DontShowSuperHidden	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	DontShowSuperHidden	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer	ShellState	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer	ShellState	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	ForceActiveDesktopOn	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	ForceActiveDesktopOn	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoActiveDesktop	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoActiveDesktop	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoWebView	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoWebView	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	ClassicShell	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	ClassicShell	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	SeparateProcess	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	SeparateProcess	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoNetCrawling	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoNetCrawling	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoSimpleStartMenu	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoSimpleStartMenu	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	Hidden	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	ShowCompColor	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	DontPrettyPath	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	ShowInfoTip	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideIcons	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	MapNetDrvBtn	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	WebView	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	Filter	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	ShowSuperHidden	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	SeparateProcess	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	NoNetCrawling	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile	DocObject	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile	BrowseInPlace	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile	IsShortcut	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile	AlwaysShowExt	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile	NeverShowExt	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Personal	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\WPA\PnP	seed	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\Setup	OsLoaderPath	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\Setup	OsLoaderPath	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemPartition	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemPartition	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	SourcePath	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	SourcePath	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackSourcePath	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackSourcePath	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackCachePath	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackCachePath	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	DriverCachePath	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	DriverCachePath	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	DevicePath	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogLevel	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogLevel	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogPath	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Hostname	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Domain	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f}	Data	buffer overflow	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f}	Data	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f}	Generation	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Data	buffer overflow	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Data	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	DocObject	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	BrowseInPlace	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	IsShortcut	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	AlwaysShowExt	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	NeverShowExt	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	UseDesktopIniCache	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	UseDesktopIniCache	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Common Documents	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Desktop	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Common Desktop	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32	LoadWithoutCOM	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	Com+Enabled	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	MinimumFreeMemPercentageToCreateProcess	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	MinimumFreeMemPercentageToCreateObject	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	Com+Enabled	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32	InprocServer32	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}	AppID	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32	ThreadingModel	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	DisableImprovedZoneCheck	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN	~WORDL.tmp	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN	*	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Internet Explorer\IETld	IETldDllVersionLow	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Internet Explorer\IETld	IETldDllVersionHigh	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Internet Explorer\IETld	IETldVersionLow	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Internet Explorer\IETld	IETldVersionHigh	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	CreateUriCacheSize	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	CreateUriCacheSize	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EnablePunycode	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	EnablePunycode	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Internet Explorer\Security	DisableSecuritySettingsCheck	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security	DisableSecuritySettingsCheck	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	Flags	success or wait	2	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	Flags	success or wait	2	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	Flags	success or wait	2	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	Flags	success or wait	2	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	Flags	success or wait	2	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	~WORDL.tmp	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	*	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	SpecialFoldersCacheSize	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SpecialFoldersCacheSize	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Cache	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Cookies	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	1806	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command	command	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command	NULL	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\ShellNoRoam\MUICache	LangID	success or wait	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\ShellNoRoam\MUICache	C:\WINDOWS\system32\cmd.exe	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation	CutList	success or wait	2	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	InheritConsoleHandles	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	InheritConsoleHandles	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	RestrictRun	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	RestrictRun	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	DisallowRun	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	DisallowRun	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoRunasInstallPrompt	object name not found	1	40178C	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoRunasInstallPrompt	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter	Installed	success or wait	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	LogFileName	object name not found	1	40178C	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{11016101-E366-4D22-BC06-4ADA335C892B}	SuppressionPolicy	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba}	SuppressionPolicy	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{450D8FBA-AD25-11D0-98A8-0800361B1103}	SuppressionPolicy	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{645FF040-5081-101B-9F08-00AA002F954E}	SuppressionPolicy	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}	SuppressionPolicy	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder	WantsParseDisplayName	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\ShellFolder	WantsParseDisplayName	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder	WantsParseDisplayName	success or wait	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32	NULL	success or wait	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32	LoadWithoutCOM	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked	{871C5380-42A0-1069-A2EA-08002B30309D}	object name not found	1	90909090	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked	{871C5380-42A0-1069-A2EA-08002B30309D}	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	EnforceShellExtensionSecurity	object name not found	1	90909090	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	EnforceShellExtensionSecurity	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	{871C5380-42A0-1069-A2EA-08002B30309D} {000214E6-0000-0000-C000-000000000046} 0x401	object name not found	1	90909090	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	{871C5380-42A0-1069-A2EA-08002B30309D} {000214E6-0000-0000-C000-000000000046} 0x401	success or wait	1	90909090	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility	DisableAppCompat	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32		success or wait	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\ShellFolder	WantsParseDisplayName	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder	WantsParseDisplayName	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\ShellFolder	WantsParseDisplayName	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\ShellFolder	WantsParseDisplayName	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder	WantsParseDisplayName	object name not found	1	90909090	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize	DisableMetaFiles	object name not found	1	4012C4	ExitProcess

Mutex Activites

Name	Completion	Count	Source Address	Symbol
\BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	4011A6	CreateWindowExA
\BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	4011A6	CreateWindowExA
\BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	4011A6	CreateWindowExA
\BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	4011A6	CreateWindowExA
\BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	4011A6	CreateWindowExA
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500MUTEX.DefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	4011A6	CreateWindowExA
unknown	success or wait	3	40178C	ShellExecuteExW
\BaseNamedObjects\Local\ZonesCounterMutex	object name exists	1	40178C	ShellExecuteExW
\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex	object name exists	2	40178C	ShellExecuteExW
\BaseNamedObjects\Local\ZonesCacheCounterMutex	object name exists	1	40178C	ShellExecuteExW
\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex	object name exists	1	40178C	ShellExecuteExW

Process Activites

Process Created

PID	Filepath	Cmdline	Flags	Completion	Count	Source Address	Symbol
760	C:\WINDOWS\system32\rundll32.exe	rundll32.exe C:\Documents and Settings\Administrator\Application Data\taskman.dll start	none	success or wait	1	40187C	CreateProcessW
868	C:\WINDOWS\system32\cmd.exe	C:\WINDOWS\system32\cmd.exe /c del C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp > nul	none	success or wait	1	40178C	ShellExecuteExW

PID	Process info class	Completion	Count	Source Address	Symbol
1112	Cookie	success or wait	5	7C90E457	KiUserApcDispatcher
1112	ImageInformation	success or wait	1	7C90E457	KiUserApcDispatcher
1112	SessionInformation	success or wait	2	7C90E457	KiUserApcDispatcher
1112	Wow64Information	success or wait	5	4011A6	CreateWindowExA
1112	DefaultHardErrorMode	success or wait	62	4011A6	CreateWindowExA
1112	DeviceMap	success or wait	21	40187C	CreateProcessW
760	BasicInformation	success or wait	2	40187C	CreateProcessW
1112	QuotaLimits	success or wait	1	40178C	ShellExecuteExW
1112	VmCounters	success or wait	1	40178C	ShellExecuteExW
868	BasicInformation	success or wait	2	40178C	ShellExecuteExW

Process Terminated

PID	Filepath	Completion	Count	Source Address	Symbol
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	success or wait	1	4012C4	ExitProcess

Thread Activites

TID	PID	EIP	EAX (Usermode EIP)	Filepath	Completion	Count	Source Address	Symbol
856	760	7C810705	1001BDC	C:\WINDOWS\system32\rundll32.exe	success or wait	1	40187C	CreateProcessW
944	868	7C810705	4AD05046	C:\WINDOWS\system32\cmd.exe	success or wait	1	40178C	ShellExecuteExW

TID	PID	Path	Completion	Count	Source Address	Symbol
856	760	C:\WINDOWS\system32\rundll32.exe	success or wait	1	40187C	CreateProcessW
944	868	C:\WINDOWS\system32\cmd.exe	success or wait	1	40178C	ShellExecuteExW

Memory Activites

PID	Filepath	Base	Length	Value	Completion	Count	Source Address	Symbol
760	C:\WINDOWS\system32\rundll32.exe	7FFDC008	4	00 00 00 01	success or wait	1	40187C	CreateProcessW
760	C:\WINDOWS\system32\rundll32.exe	1000000	4096	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 31 FA 71 F9 75 9B 1F AA 75 9B 1F AA 75 9B 1F AA B6 94 10 AA 74 9B 1F AA 75 9B 1E AA 58 9B 1F AA B6 94 42 AA 7E 9B 1F AA B6 94 41 AA 74 9B 1F AA B6 94 40 AA 73 9B 1F AA B6 94 45 AA 74 9B 1F AA 52 69 63 68 75 9B 1F AA 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4C 01 03 00 D5 52 02 48 00 00 00 00 00 00 00 00 E0 00 0F 01 0B 01 07 0A 00 14 00 00 00 6A 00 00 00 00 00	success or wait	1	40187C	CreateProcessW
760	C:\WINDOWS\system32\rundll32.exe	1004000	256	00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 03 00 00 00 30 00 00 80 06 00 00 00 80 00 00 80 0E 00 00 00 B0 00 00 80 10 00 00 00 C8 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 01 00 00 00 E0 00 00 80 02 00 00 00 F8 00 00 80 03 00 00 00 10 01 00 80 04 00 00 00 28 01 00 80 05 00 00 00 40 01 00 80 06 00 00 00 58 01 00 80 07 00 00 00 70 01 00 80 08 00 00 00 88 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 11 00 00 00 A0 01 00 80 31 00 00 00 B8 01 00 80 32 00 00 00 D0 01 00 80 41 00 00 00 E8 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 64 00 00 00 00 02 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 18 02 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 00 00 30 02 00 00 00 00 00 00 00 00 00	success or wait	1	40187C	CreateProcessW
868	C:\WINDOWS\system32\cmd.exe	7FFDF008	4	00 00 D0 4A	success or wait	1	40178C	ShellExecuteExW
868	C:\WINDOWS\system32\cmd.exe	4AD00000	4096	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 1D ED D5 EA 59 8C BB B9 59 8C BB B9 59 8C BB B9 9A 83 B4 B9 5F 8C BB B9 59 8C BA B9 80 8C BB B9 9A 83 E6 B9 5E 8C BB B9 E6 83 DB B9 5B 8C BB B9 9A 83 E5 B9 58 8C BB B9 9A 83 E4 B9 6D 8C BB B9 9A 83 E1 B9 58 8C BB B9 52 69 63 68 59 8C BB B9 00 00 00 00 00 00 00 00 50 45 00 00 4C 01 03 00 AF 5B 02 48 00 00 00 00 00 00 00 00 E0 00 0F 01 0B 01 07 0A 00 F8 01 00 00 F6 03 00 00 00 00	success or wait	1	40178C	ShellExecuteExW
868	C:\WINDOWS\system32\cmd.exe	4AD3E000	256	00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 03 00 00 00 30 00 00 80 0B 00 00 00 80 00 00 80 0E 00 00 00 98 00 00 80 10 00 00 00 B0 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 01 00 00 00 C8 00 00 80 02 00 00 00 E0 00 00 80 03 00 00 00 F8 00 00 80 04 00 00 00 10 01 00 80 05 00 00 00 28 01 00 80 06 00 00 00 40 01 00 80 07 00 00 00 58 01 00 80 08 00 00 00 70 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 88 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 80 02 00 80 A0 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 B8 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 00 00 D0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 00 00 E0 01 00 00 00 00 00 00 00 00 00	success or wait	1	40178C	ShellExecuteExW

PID	Filepath	Base	Length	Value	Completion	Count	Source Address	Symbol
760	C:\WINDOWS\system32\rundll32.exe	10000	2116	3D 00 3A 00 3A 00 3D 00 3A 00 3A 00 5C 00 00 00 3D 00 5A 00 3A 00 3D 00 5A 00 3A 00 5C 00 00 00 41 00 4C 00 4C 00 55 00 53 00 45 00 52 00 53 00 50 00 52 00 4F 00 46 00 49 00 4C 00 45 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 6C 00 6C 00 20 00 55 00 73 00 65 00 72 00 73 00 00 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 41 00 70 00 70 00 6C 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20	success or wait	1	40187C	CreateProcessW
760	C:\WINDOWS\system32\rundll32.exe	20000	1872	00 10 00 00 50 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 00 08 02 90 02 00 00 00 00 00 00 54 01 56 01 98 04 00 00 40 00 42 00 F0 05 00 00 B2 00 B4 00 34 06 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 40 00 42 00 E8 06 00 00 1E 00 20 00 2C 07 00 00 00 00 02 00 4C 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	40187C	CreateProcessW
760	C:\WINDOWS\system32\rundll32.exe	7FFDC010	4	00 00 02 00	success or wait	1	40187C	CreateProcessW
760	C:\WINDOWS\system32\rundll32.exe	30000	388	53 00 68 00 69 00 6D 00 45 00 6E 00 67 00 2E 00 64 00 6C 00 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 01 00 00 AB ED 0D AC B2 F1 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	40187C	CreateProcessW
760	C:\WINDOWS\system32\rundll32.exe	7FFDC1E8	4	00 00 03 00	success or wait	1	40187C	CreateProcessW
868	C:\WINDOWS\system32\cmd.exe	10000	2116	3D 00 3A 00 3A 00 3D 00 3A 00 3A 00 5C 00 00 00 3D 00 5A 00 3A 00 3D 00 5A 00 3A 00 5C 00 00 00 41 00 4C 00 4C 00 55 00 53 00 45 00 52 00 53 00 50 00 52 00 4F 00 46 00 49 00 4C 00 45 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 6C 00 6C 00 20 00 55 00 73 00 65 00 72 00 73 00 00 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 41 00 70 00 70 00 6C 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20	success or wait	1	40178C	ShellExecuteExW
868	C:\WINDOWS\system32\cmd.exe	20000	1836	00 10 00 00 2C 07 00 00 00 00 00 00 00 00 00 00 FE FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3A 00 08 02 90 02 00 00 00 00 00 00 54 01 56 01 98 04 00 00 36 00 38 00 F0 05 00 00 A6 00 A8 00 28 06 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 36 00 38 00 D0 06 00 00 1E 00 20 00 08 07 00 00 00 00 02 00 28 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	40178C	ShellExecuteExW
868	C:\WINDOWS\system32\cmd.exe	7FFDF010	4	00 00 02 00	success or wait	1	40178C	ShellExecuteExW
868	C:\WINDOWS\system32\cmd.exe	30000	388	53 00 68 00 69 00 6D 00 45 00 6E 00 67 00 2E 00 64 00 6C 00 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 01 00 00 AB ED 0D AC AA 3F 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	40178C	ShellExecuteExW
868	C:\WINDOWS\system32\cmd.exe	7FFDF1E8	4	00 00 03 00	success or wait	1	40178C	ShellExecuteExW

PID	Filepath	Base	Length	Protection	Completion	Count	Source Address	Symbol
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	140000	12FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	140000	12FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	141000	12F7F4	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	240000	12FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	240000	12FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	250000	12F340	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	251000	12F168	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	143000	12EA80	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	850000	12F91C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	850000	12F920	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	851000	12F5FC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	144000	12F62C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	853000	12F6B8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	145000	12E808	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	870000	12F1B8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	870000	12F1BC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	871000	12EE98	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	873000	12EF3C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	146000	12ED0C	page read and write	success or wait	1	4011A6	CreateWindowExA
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	147000	12F268	page read and write	success or wait	1	4011A6	CreateWindowExA
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	148000	12DA28	page read and write	success or wait	1	40187C	CreateProcessW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	149000	12E21C	page read and write	success or wait	1	40187C	CreateProcessW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	8F0000	12E79C	page read and write	success or wait	1	40187C	CreateProcessW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	8F0000	12E798	page read and write	success or wait	1	40187C	CreateProcessW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	14A000	12E6BC	page read and write	success or wait	1	40187C	CreateProcessW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	900000	12E70C	page read and write	success or wait	1	40187C	CreateProcessW
760	C:\WINDOWS\system32\rundll32.exe	10000	12E814	page read and write	success or wait	1	40187C	CreateProcessW
760	C:\WINDOWS\system32\rundll32.exe	20000	12E814	page read and write	success or wait	1	40187C	CreateProcessW
760	C:\WINDOWS\system32\rundll32.exe	30000	12E814	page read and write	success or wait	1	40187C	CreateProcessW
760	C:\WINDOWS\system32\rundll32.exe	40000	12EA80	page read and write	success or wait	1	40187C	CreateProcessW
760	C:\WINDOWS\system32\rundll32.exe	73000	12EA7C	page read and write	success or wait	1	40187C	CreateProcessW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	14C000	12EFE8	page read and write	success or wait	1	90909090	unknown
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	150000	12F05C	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	157000	12E90C	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	158000	12E41C	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	159000	12DE74	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	940000	159720	page read and write	success or wait	9	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	940000	15971C	page read and write	success or wait	9	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	15A000	12CDD8	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	15B000	12E284	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	15C000	12E994	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	15D000	12E90C	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	854000	12E968	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	856000	12EA58	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	900000	12ED00	page no access	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	900000	12ED00	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	163000	12E29C	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	165000	12E064	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	166000	12E2F4	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	168000	12EC54	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	169000	12E7A0	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	16A000	12E7A0	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	16B000	12E7A0	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	16C000	12E7A0	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	16D000	12E820	page read and write	success or wait	1	40178C	ShellExecuteExW
868	C:\WINDOWS\system32\cmd.exe	10000	12DB2C	page read and write	success or wait	1	40178C	ShellExecuteExW
868	C:\WINDOWS\system32\cmd.exe	20000	12DB2C	page read and write	success or wait	1	40178C	ShellExecuteExW
868	C:\WINDOWS\system32\cmd.exe	30000	12DB2C	page read and write	success or wait	1	40178C	ShellExecuteExW
868	C:\WINDOWS\system32\cmd.exe	40000	12DD98	page read and write	success or wait	1	40178C	ShellExecuteExW
868	C:\WINDOWS\system32\cmd.exe	40000	12DD94	page read and write	success or wait	1	40178C	ShellExecuteExW

Memory Protection Changed

PID	Filepath	Base	Length	New Protection	Old Protection	Completion	Count	Source Address	Symbol
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	7C801000	1000	page read and write	page execute read	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	7C801000	1000	page execute read	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	404000	1000	page read and write	page readonly	success or wait	6	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	404000	1000	page readonly	page read and write	success or wait	6	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77F11000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77F11000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	7E411000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	7E411000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77DD1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77DD1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77E71000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77E71000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77FE1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77FE1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	7C9C1000	2000	page read and write	page execute read	success or wait	8	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	7C9C1000	2000	page execute read	page read and write	success or wait	8	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77C11000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77C11000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77F61000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77F61000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	76391000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	76391000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	773D1000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	773D1000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	5D091000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	5D091000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	74721000	1000	page read and write	page execute read	success or wait	5	4011A6	CreateWindowExA
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	74721000	1000	page execute read	page read and write	success or wait	5	4011A6	CreateWindowExA
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77C01000	1000	page read and write	page execute read	success or wait	4	4011A6	CreateWindowExA
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77C01000	1000	page execute read	page read and write	success or wait	4	4011A6	CreateWindowExA
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	755C1000	1000	page read and write	page execute read	success or wait	6	4011A6	CreateWindowExA
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	755C1000	1000	page execute read	page read and write	success or wait	6	4011A6	CreateWindowExA
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	774E1000	1000	page read and write	page execute read	success or wait	7	4011A6	CreateWindowExA
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	774E1000	1000	page execute read	page read and write	success or wait	7	4011A6	CreateWindowExA
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	40140B	1000	page execute and read and write	page execute read	success or wait	2	4030AA	VirtualProtect
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	40140B	1000	page execute read	page execute and read and write	success or wait	2	40317B	VirtualProtect
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77B41000	1000	page read and write	page execute read	success or wait	2	40187C	CreateProcessW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77B41000	1000	page execute read	page read and write	success or wait	2	40187C	CreateProcessW
760	C:\WINDOWS\system32\rundll32.exe	73000	1000	page read and write and page guard	page read and write	success or wait	1	40187C	CreateProcessW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	5B861000	1000	page read and write	page execute read	success or wait	5	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	5B861000	1000	page execute read	page read and write	success or wait	5	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77921000	1000	page read and write	page execute read	success or wait	6	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77921000	1000	page execute read	page read and write	success or wait	6	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	76FD1000	1000	page read and write	page execute read	success or wait	6	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	76FD1000	1000	page execute read	page read and write	success or wait	6	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77051000	1000	page read and write	page execute read	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77051000	1000	page execute read	page read and write	success or wait	1	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77121000	1000	page read and write	page execute read	success or wait	6	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	77121000	1000	page execute read	page read and write	success or wait	6	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	78131000	1000	page read and write	page execute read	success or wait	10	40178C	ShellExecuteExW
1112	C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	78131000	1000	page execute read	page read and write	success or wait	10	40178C	ShellExecuteExW

Memory Usage Statistics

Time	Private Usage (mb)	Workingset (mb)	Page File Usage (mb)
15:20:20	0	2	0
15:20:21	0	2	0
15:20:23	0	2	0
15:20:24	0	2	0
15:20:39	0	2	0
15:20:40	0	2	0
15:20:41	0	1	0

System Activites

System info class	Completion	Count	Source Address	Symbol
BasicInformation	success or wait	17	7C90E457	KiUserApcDispatcher
RangeStartInformation	success or wait	1	7C90E457	KiUserApcDispatcher
ProcessorInformation	success or wait	6	4011A6	CreateWindowExA
WatchdogTimerHandler	success or wait	2	40187C	CreateProcessW
PerformanceInformation	success or wait	1	40178C	ShellExecuteExW

Timing Activites

Time	Completion	Count	Source Address	Symbol
129876420416093750	success or wait	1	40178C	ShellExecuteExW

Windows UI Activites

Window Created

Window name	Class name	HWND	Completion	Count	Source Address	Symbol
c0d0e0f0g1	c0d0e0f0g1	5013A	success	1	4011A6	CreateWindowExA
IPTR	IPTR	5014A	success	1	90909090	unknown

HWND	Completion	Count	Source Address	Symbol
5014A	success	1	40178C	ShellExecuteExW

Window UIs Enumerated

Desktop HWND	Parent HWND	Enum Childrens	TID	Window Handles	Completion	Count	Source Address	Symbol
0	0	false	45C	5013A, 50104, 1, 520054, 5C0059, 530055, 520045, 53005C, 31002D, 35002D, 32002D, 2D0031, 300035, 390037, 310032	success or wait	2	40178C	ShellExecuteExW

HWND	Completion	Count	Source Address	Symbol
1008C	success	1	40178C	ShellExecuteExW

Window UI Shown

HWND	Command	Completion	Count	Source Address	Symbol
5013A	hide	error	1	4011BA	NtUserShowWindow

HWND	Message	LParam	WParam	Completion	Count	Source Address	Symbol
5013A	NCCREATE	0	1243368	success	1	401296	DefWindowProcA
50104	NCCREATE	0	1243356	success	1	4011A6	CreateWindowExA
5013A	NCCALCSIZE	0	1243424	error	1	401296	DefWindowProcA
5013A	WINDOWPOSCHANGING	0	1242884	error	1	401296	DefWindowProcA
5013A	NCCALCSIZE	1	1242840	error	1	401296	DefWindowProcA
5014A	NCCREATE	0	1240280	success	1	90909090	unknown
5014A	NCCALCSIZE	0	1240320	error	1	90909090	unknown
1008C	419	0	0	success	1	4017B6	SHChangeNotify

TID	Message	LParam	WParam	Completion	Count	Source Address	Symbol
7DC	C08C	0	1116	success	1	4012C4	ExitProcess

Module	Thread id	Hook code	Completion	Count	Source Address	Symbol
C:\WINDOWS\system32\MSCTF.dll	1116	keyboard	success	1	4011A6	CreateWindowExA
C:\WINDOWS\system32\MSCTF.dll	1116	mouse	success	1	4011A6	CreateWindowExA

Process Token Activites

Status	Privilege	Completion	Count	Source Address	Symbol
on	Increase Base Priority	success or wait	1	4010B5	DispatchMessageA
on	Load Driver	success or wait	2	40178C	ShellExecuteExW

Chronological Activities

Operation	Data	Completion	Time
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CWDIllegalInDLLSearch	object name not found	670717644
System info queried	Type: BasicInformation	success or wait	670719692
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 140000 Length: 12FB14 Allocation Type: unknown Protection: page read and write	success or wait	670719936
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 140000 Length: 12FB18 Allocation Type: unknown Protection: page read and write	success or wait	670720942
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 141000 Length: 12F7F4 Allocation Type: unknown Protection: page read and write	success or wait	670721477
System info queried	Type: BasicInformation	success or wait	670721850
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 240000 Length: 12FB14 Allocation Type: unknown Protection: page read and write	success or wait	670723683
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 240000 Length: 12FB18 Allocation Type: unknown Protection: page read and write	success or wait	670723886
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	670724918
File control set	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1 Control Code: 90028 Input Buffer:	success or wait	670725770
Section loaded	Path: \KnownDlls\kernel32.dll Access: write and read and execute Type: unknown Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	670726746
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C801000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670728922
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C801000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670730354
Process information queried	PID: 1112 Info Class: Cookie	success or wait	670732168
System info queried	Type: RangeStartInformation	success or wait	670732417
System info queried	Type: BasicInformation	success or wait	670732615
Section loaded	Path: unknown Access: query and write and read and execute and extend size Type: reserve Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	670732873
System info queried	Type: BasicInformation	success or wait	670733935
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 250000 Length: 12F340 Allocation Type: unknown Protection: page read and write	success or wait	670734392
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	670735945
Section loaded	Path: \NLS\NlsSectionUnicode Access: read Type: unknown Baseaddress: 260000 Size: 90112 Protection: readonly Mapped to pid: own pid	success or wait	670736951
Section loaded	Path: \NLS\NlsSectionLocale Access: read Type: unknown Baseaddress: 280000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	670738344
Section loaded	Path: \NLS\NlsSectionSortkey Access: query and read Type: unknown Baseaddress: 2D0000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	670739380
Section loaded	Path: \NLS\NlsSectionSortTbls Access: read Type: unknown Baseaddress: 320000 Size: 24576 Protection: readonly Mapped to pid: own pid	success or wait	670740061
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	670741566
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	670741810
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 251000 Length: 12F168 Allocation Type: unknown Protection: page read and write	success or wait	670742028
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 404000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	670744507
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 404000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	670745143
Section loaded	Path: \KnownDlls\USER32.dll Access: write and read and execute Type: unknown Baseaddress: 7E410000 Size: 593920 Protection: read write Mapped to pid: own pid	success or wait	670745419
Section loaded	Path: \KnownDlls\GDI32.dll Access: write and read and execute Type: unknown Baseaddress: 77F10000 Size: 299008 Protection: read write Mapped to pid: own pid	success or wait	670746700
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670748777
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670749338
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670749598
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670749862
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670750120
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670750767
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670751074
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670752651
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670752905
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670753197
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670753442
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670753799
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 404000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	670754030
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 404000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	670754283
Section loaded	Path: \KnownDlls\ADVAPI32.dll Access: write and read and execute Type: unknown Baseaddress: 77DD0000 Size: 634880 Protection: read write Mapped to pid: own pid	success or wait	670754551
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670756620
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670757181
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670757427
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670757887
Section loaded	Path: \KnownDlls\RPCRT4.dll Access: write and read and execute Type: unknown Baseaddress: 77E70000 Size: 602112 Protection: read write Mapped to pid: own pid	success or wait	670758167
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670760753
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670761556
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670761814
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670762171
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670762426
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670762697
Section loaded	Path: \KnownDlls\Secur32.dll Access: write and read and execute Type: unknown Baseaddress: 77FE0000 Size: 69632 Protection: read write Mapped to pid: own pid	success or wait	670762990
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670765073
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670765546
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670765818
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670766096
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670766365
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670766708
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670766959
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670767211
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670767452
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670767962
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 404000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	670768190
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 404000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	670768417
Section loaded	Path: \KnownDlls\SHELL32.dll Access: write and read and execute Type: unknown Baseaddress: 7C9C0000 Size: 8482816 Protection: read write Mapped to pid: own pid	success or wait	670768685
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	670770974
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	670771570
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	670771819
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	670772203
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	670772448
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	670772948
Section loaded	Path: \KnownDlls\msvcrt.dll Access: write and read and execute Type: unknown Baseaddress: 77C10000 Size: 360448 Protection: read write Mapped to pid: own pid	success or wait	670773522
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670774881
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670776169
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670776430
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670776682
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	670776923
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	670778075
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	670778321
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	670778689
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	670778933
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	670779293
Section loaded	Path: \KnownDlls\SHLWAPI.dll Access: write and read and execute Type: unknown Baseaddress: 77F60000 Size: 483328 Protection: read write Mapped to pid: own pid	success or wait	670779575
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670781621
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670782150
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670782457
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670782720
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670782976
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670783354
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670783608
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670783861
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670784112
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670784484
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	670784721
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	670785419
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	670785664
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	670786299
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 404000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	670786546
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 404000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	670787037
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 404000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	670787268
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 404000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	670787538
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 404000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	670787768
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 404000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	670788020
Process information queried	PID: 1112 Info Class: ImageInformation	success or wait	670788418
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	670789043
System info queried	Type: BasicInformation	success or wait	670796956
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: SafeDllSearchMode	object name not found	670798106
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 143000 Length: 12EA80 Allocation Type: unknown Protection: page read and write	success or wait	670798599
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	670799314
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 420000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	670800077
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	670803207
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 420000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	670803962
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	670805434
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: query and write and read and execute Type: image Baseaddress: 76390000 Size: 118784 Protection: read write Mapped to pid: own pid	success or wait	670806179
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: TransparentEnabled	success or wait	670806759
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670808903
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670810220
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670810490
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670810814
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670811076
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670811363
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670811622
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670811889
System info queried	Type: BasicInformation	success or wait	670813349
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize Name: DisableMetaFiles	object name not found	670814684
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Name: AppInit_DLLs	success or wait	670818499
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	670820876
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSUserEnabled	success or wait	670821414
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: LeakTrack	object name not found	670822283
System info queried	Type: BasicInformation	success or wait	670824320
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 850000 Length: 12F91C Allocation Type: unknown Protection: page read and write	success or wait	670824539
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 850000 Length: 12F920 Allocation Type: unknown Protection: page read and write	success or wait	670824751
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 851000 Length: 12F5FC Allocation Type: unknown Protection: page read and write	success or wait	670825166
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 144000 Length: 12F62C Allocation Type: unknown Protection: page read and write	success or wait	670825843
Section loaded	Path: \NLS\NlsSectionCType Access: read Type: unknown Baseaddress: 860000 Size: 12288 Protection: readonly Mapped to pid: own pid	success or wait	670826707
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 853000 Length: 12F6B8 Allocation Type: unknown Protection: page read and write	success or wait	670828420
Process information queried	PID: 1112 Info Class: Cookie	success or wait	670830344
Process information queried	PID: 1112 Info Class: Cookie	success or wait	670830551
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	670833735
File opened	Path: C:\WINDOWS\system32\SHELL32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	670835108
Section loaded	Path: C:\WINDOWS\system32\shell32.dll Access: read Type: commit Baseaddress: 870000 Size: 8462336 Protection: readonly Mapped to pid: own pid	success or wait	670835881
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	670838112
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	670843283
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	670902433
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	670903435
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: write and read and execute Type: commit Baseaddress: 870000 Size: 1056768 Protection: execute Mapped to pid: own pid	success or wait	670904449
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	670906975
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: query and write and read and execute Type: image Baseaddress: 773D0000 Size: 1060864 Protection: read write Mapped to pid: own pid	success or wait	670908006
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670910593
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670911073
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670911354
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670911625
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670911951
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670912293
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670912634
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670912929
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670913203
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670913522
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670913797
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670914065
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670914336
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670914664
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	670917241
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: write and read and execute Type: commit Baseaddress: 870000 Size: 4096 Protection: execute Mapped to pid: own pid	success or wait	670918069
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	670920910
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: query and read Type: commit Baseaddress: 870000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	670921748
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	670923273
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: read Type: commit Baseaddress: 870000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	670924076
File opened	Path: C:\WINDOWS\WindowsShell.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	670924875
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	670961479
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: EnableBalloonTips	object name not found	670962499
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 145000 Length: 12E808 Allocation Type: unknown Protection: page read and write	success or wait	670963905
Section loaded	Path: \KnownDlls\comctl32.dll Access: write and read and execute Type: unknown Baseaddress: 5D090000 Size: 630784 Protection: read write Mapped to pid: own pid	success or wait	670966548
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670968786
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670969333
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670969606
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670969889
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670970154
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670970464
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670970731
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670970993
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	670971260
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	670971632
System info queried	Type: BasicInformation	success or wait	670973833
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 870000 Length: 12F1B8 Allocation Type: unknown Protection: page read and write	success or wait	670974089
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 870000 Length: 12F1BC Allocation Type: unknown Protection: page read and write	success or wait	670974343
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 871000 Length: 12EE98 Allocation Type: unknown Protection: page read and write	success or wait	670974793
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 873000 Length: 12EF3C Allocation Type: unknown Protection: page read and write	success or wait	670975485
File opened	Path: C:\WINDOWS\system32\comctl32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	670976838
Section loaded	Path: C:\WINDOWS\system32\comctl32.dll Access: read Type: commit Baseaddress: 890000 Size: 618496 Protection: readonly Mapped to pid: own pid	success or wait	670977654
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	670979366
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	670981362
Process information queried	PID: 1112 Info Class: SessionInformation	success or wait	670988565
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	670989651
Window created	Window Name: c0d0e0f0g1 Class Name: c0d0e0f0g1 HWND: 5013A	success	670993430
File opened	Path: C:\WINDOWS\system32\MSCTF.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	670993958
Section loaded	Path: C:\WINDOWS\system32\msctf.dll Access: write and read and execute Type: commit Baseaddress: 890000 Size: 299008 Protection: execute Mapped to pid: own pid	success or wait	670994717
File opened	Path: C:\WINDOWS\system32\MSCTF.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	670997699
Section loaded	Path: C:\WINDOWS\system32\msctf.dll Access: query and write and read and execute Type: image Baseaddress: 74720000 Size: 311296 Protection: read write Mapped to pid: own pid	success or wait	670998454
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671000219
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671001567
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671001830
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671002129
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671002388
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671002753
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671003010
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671003264
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671003518
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671003770
Process information queried	PID: 1112 Info Class: Wow64Information	success or wait	671005482
Section loaded	Path: \BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read Type: commit Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name exists	671006819
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared Name: CUAS	success or wait	671007712
Mutant created	Name: \BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	671008333
Mutant created	Name: \BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	671008615
Mutant created	Name: \BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	671008891
Mutant created	Name: \BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	671009179
Mutant created	Name: \BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	671009449
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	671010189
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	671010617
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	671010974
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	671011330
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF Name: EnableAnchorContext	object name not found	671013338
Mutant created	Name: \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500MUTEX.DefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	671014210
Section loaded	Path: \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500SFM.DefaultS-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read and execute and extend size Type: unknown Baseaddress: 8A0000 Size: 262144 Protection: read write Mapped to pid: own pid	success or wait	671014545
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 1116 Hook ID: keyboard	success	671015590
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 1116 Hook ID: mouse	success	671015812
Message sent	HWND: 5013A Message: NCCREATE WParam: 0 LParam: 1243368	success	671016910
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM Name: Ime File	success or wait	671017585
Section loaded	Path: \KnownDlls\version.dll Access: write and read and execute Type: unknown Baseaddress: 77C00000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	671018208
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671019626
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671021002
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671021303
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671021605
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	671022935
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	671023441
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: write and read and execute Type: commit Baseaddress: 8E0000 Size: 180224 Protection: execute Mapped to pid: own pid	success or wait	671024238
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	671026959
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: query and read Type: commit Baseaddress: 8E0000 Size: 180224 Protection: readonly Mapped to pid: own pid	success or wait	671027749
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	671029061
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 146000 Length: 12ED0C Allocation Type: unknown Protection: page read and write	success or wait	671031626
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	671032063
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	671032541
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: write and read and execute Type: commit Baseaddress: 8E0000 Size: 180224 Protection: execute Mapped to pid: own pid	success or wait	671033341
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	671034936
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: query and read Type: commit Baseaddress: 8E0000 Size: 180224 Protection: readonly Mapped to pid: own pid	success or wait	671035721
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	671037029
Section loaded	Path: \BaseNamedObjects\ShimSharedMemory Access: write Type: unknown Baseaddress: 8E0000 Size: 57344 Protection: read write Mapped to pid: own pid	success or wait	671038329
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	671039499
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: write and read and execute Type: commit Baseaddress: 8F0000 Size: 180224 Protection: execute Mapped to pid: own pid	success or wait	671040286
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	671041857
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: query and write and read and execute Type: image Baseaddress: 755C0000 Size: 188416 Protection: read write Mapped to pid: own pid	success or wait	671042635
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671045185
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671045740
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671046031
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671046333
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671046617
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671046904
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671047190
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671047499
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671047781
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671048072
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671048355
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671048640
File opened	Path: C:\WINDOWS\system32\ole32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	671051142
Section loaded	Path: C:\WINDOWS\system32\ole32.dll Access: write and read and execute Type: commit Baseaddress: 940000 Size: 1290240 Protection: execute Mapped to pid: own pid	success or wait	671051982
File opened	Path: C:\WINDOWS\system32\ole32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	671058839
Section loaded	Path: C:\WINDOWS\system32\ole32.dll Access: query and write and read and execute Type: image Baseaddress: 774E0000 Size: 1302528 Protection: read write Mapped to pid: own pid	success or wait	671060209
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671065155
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671065781
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671066132
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671066485
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671066825
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671067294
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671067635
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671067978
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671068319
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671068710
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671069050
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671069500
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671069839
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671070270
File opened	Path: \Device\KsecDD Access: read data or list directory and synchronize Options: synchronous io alert Overwritten: false	success or wait	671072212
System info queried	Type: BasicInformation	success or wait	671077657
System info queried	Type: ProcessorInformation	success or wait	671077978
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CriticalSectionTimeout	success or wait	671078490
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: RWLockResourceTimeOut	object name not found	671079326
System info queried	Type: BasicInformation	success or wait	671080133
System info queried	Type: ProcessorInformation	success or wait	671080462
System info queried	Type: BasicInformation	success or wait	671080778
System info queried	Type: ProcessorInformation	success or wait	671081106
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAll	object name not found	671081532
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAllForOle32	object name not found	671081874
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableTypeLib	object name not found	671082212
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAll	object name not found	671082915
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAllForOle32	object name not found	671083251
Message sent	HWND: 50104 Message: NCCREATE WParam: 0 LParam: 1243356	success	671084250
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF Name: Disable Thread Input Manager	object name not found	671084802
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared Name: CUAS	success or wait	671085945
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 147000 Length: 12F268 Allocation Type: unknown Protection: page read and write	success or wait	671086539
Message sent	HWND: 5013A Message: NCCALCSIZE WParam: 0 LParam: 1243424	error	671088651
Message sent	HWND: 5013A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1242884	error	671088915
Message sent	HWND: 5013A Message: NCCALCSIZE WParam: 1 LParam: 1242840	error	671089170
Window shown	HWND: 5013A CMD: hide	error	671089809
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: AppData	success or wait	674637561
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: AppData Type: unicode Data: C:\Documents and Settings\Administrator\Application Data Old data:	success or wait	674641144
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 40140B Length: 1000 New Protection: page execute and read and write New Protection: page execute read	success or wait	679596285
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 40140B Length: 1000 New Protection: page execute read New Protection: page execute and read and write	success or wait	679604503
File created	Path: C:\Documents and Settings\Administrator\Application Data\taskman.dll Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	679604825
File write	Path: C:\Documents and Settings\Administrator\Application Data\taskman.dll Offset: unknown Length: 61440 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65	success or wait	679710583
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 40140B Length: 1000 New Protection: page execute and read and write New Protection: page execute read	success or wait	679727530
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 40140B Length: 1000 New Protection: page execute read New Protection: page execute and read and write	success or wait	679727757
File opened	Path: C:\Documents and Settings\Administrator\Application Data\taskman.dll Access: read attributes and synchronize and generic read and generic write Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	679737347
File opened	Path: C:\WINDOWS\system32\rundll32.exe Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	679738500
File other op	Path: C:\Documents and Settings\Administrator\Application Data\taskman.dll New path: Disposition: BasicInformation Data : Creation Time: 13:00 28-02-2006 Last Access Time: 00:17 25-07-2012 Last Write Time: 15:42 14-04-2008 Change Time: 01:00 01-01-1601 File Attributes: none	success or wait	679739902
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: SafeProcessSearchMode	object name not found	679741579
File opened	Path: C:\WINDOWS\system32\rundll32.exe Access: read data or list directory and execute or traverse and read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	679753726
Section loaded	Path: C:\WINDOWS\system32\rundll32.exe Access: query and write and read and execute and extend size Type: image Baseaddress: 774E0000 Size: 1302528 Protection: read write Mapped to pid: own pid	success or wait	679754487
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility Name: DisableAppCompat	object name not found	679757922
File opened	Path: C:\WINDOWS\system32\Apphelp.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	679759412
Section loaded	Path: C:\WINDOWS\system32\apphelp.dll Access: write and read and execute Type: commit Baseaddress: 8F0000 Size: 126976 Protection: execute Mapped to pid: own pid	success or wait	679760167
File opened	Path: C:\WINDOWS\system32\Apphelp.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	679766346
Section loaded	Path: C:\WINDOWS\system32\apphelp.dll Access: query and write and read and execute Type: image Baseaddress: 77B40000 Size: 139264 Protection: read write Mapped to pid: own pid	success or wait	679767100
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679774194
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679774746
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679775013
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679775398
File opened	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	679776162
Section loaded	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read Type: commit Baseaddress: 940000 Size: 1208320 Protection: readonly Mapped to pid: own pid	success or wait	679781772
File opened	Path: C:\WINDOWS\AppPatch\systest.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	object name not found	679782934
System info queried	Type: ProcessorInformation	success or wait	679783507
Process information queried	PID: 1112 Info Class: Wow64Information	success or wait	679783714
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter Name: Installed	success or wait	679784028
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	679787585
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679788041
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	679789378
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679789804
File opened	Path: C:\WINDOWS\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679793947
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679795252
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	679796545
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	679799400
Section loaded	Path: \KnownDlls\VERSION.dll Access: write and read and execute Type: unknown Baseaddress: 77C00000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	679809415
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679810898
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679813522
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679813852
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679814181
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	679817758
File opened	Path: C:\WINDOWS\system32\rundll32.exe Access: read data or list directory and execute or traverse and read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	679818250
Section loaded	Path: C:\WINDOWS\system32\rundll32.exe Access: write and read and execute Type: commit Baseaddress: 8F0000 Size: 36864 Protection: execute Mapped to pid: own pid	success or wait	679819077
File opened	Path: C:\WINDOWS\system32\rundll32.exe Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	679824678
Section loaded	Path: C:\WINDOWS\system32\rundll32.exe Access: query and read Type: commit Baseaddress: 8F0000 Size: 36864 Protection: readonly Mapped to pid: own pid	success or wait	679825496
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	679828956
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 148000 Length: 12DA28 Allocation Type: unknown Protection: page read and write	success or wait	679829640
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	679830152
File opened	Path: C:\WINDOWS\system32\rundll32.exe Access: read data or list directory and execute or traverse and read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	679830639
Section loaded	Path: C:\WINDOWS\system32\rundll32.exe Access: write and read and execute Type: commit Baseaddress: 8F0000 Size: 36864 Protection: execute Mapped to pid: own pid	success or wait	679831461
File opened	Path: C:\WINDOWS\system32\rundll32.exe Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	679836476
Section loaded	Path: C:\WINDOWS\system32\rundll32.exe Access: query and read Type: commit Baseaddress: 8F0000 Size: 36864 Protection: readonly Mapped to pid: own pid	success or wait	679837305
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	679841542
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	679845982
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679846402
File opened	Path: C:\WINDOWS\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679847645
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679851632
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	679852935
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: TransparentEnabled	success or wait	679854280
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: AuthenticodeEnabled	success or wait	679863818
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: Levels	object name not found	679864579
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} Name: ItemData	success or wait	679865789
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} Name: SaferFlags	success or wait	679867028
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} Name: ItemData	success or wait	679870042
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} Name: HashAlg	success or wait	679870462
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} Name: ItemSize	success or wait	679870872
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} Name: SaferFlags	success or wait	679873238
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} Name: ItemData	success or wait	679876008
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} Name: HashAlg	success or wait	679876424
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} Name: ItemSize	success or wait	679876836
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} Name: SaferFlags	success or wait	679877251
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} Name: ItemData	success or wait	679881391
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} Name: HashAlg	success or wait	679881805
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} Name: ItemSize	success or wait	679882211
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} Name: SaferFlags	success or wait	679882615
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 149000 Length: 12E21C Allocation Type: unknown Protection: page read and write	success or wait	679883035
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} Name: ItemData	success or wait	679896760
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} Name: HashAlg	success or wait	679897200
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} Name: ItemSize	success or wait	679897609
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} Name: SaferFlags	success or wait	679898017
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} Name: ItemData	success or wait	679900181
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} Name: HashAlg	success or wait	679929764
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} Name: ItemSize	success or wait	679930180
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} Name: SaferFlags	success or wait	679930590
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: DefaultLevel	success or wait	679943386
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: PolicyScope	success or wait	679947968
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	679951460
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679954655
File opened	Path: C:\WINDOWS\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679955922
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679957214
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	679960866
Section loaded	Path: C:\WINDOWS\system32\rundll32.exe Access: query and read Type: commit Baseaddress: 8F0000 Size: 36864 Protection: readonly Mapped to pid: own pid	success or wait	679961162
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cache	buffer overflow	679965228
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cache	success or wait	679965569
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 8F0000 Length: 12E79C Allocation Type: unknown Protection: page read and write	success or wait	679966149
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 8F0000 Length: 12E798 Allocation Type: unknown Protection: page read and write	success or wait	679966393
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: LogFileName	object name not found	679966972
System info queried	Type: WatchdogTimerHandler	success or wait	679978215
Process created	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Cmdline: rundll32.exe C:\Documents and Settings\Administrator\Application Data\taskman.dll start Createflags: none	success or wait	679978399
Process information queried	PID: 760 Info Class: BasicInformation	success or wait	679984437
Memory read	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7FFDC008 Length: 4 Value: 00 00 00 01	success or wait	679984640
File opened	Path: C:\WINDOWS\system32\rundll32.exe.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	679984925
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 14A000 Length: 12E6BC Allocation Type: unknown Protection: page read and write	success or wait	679985648
Memory read	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 1000000 Length: 4096 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 31 FA 71 F9 75 9B 1F AA 75 9B 1F AA 75 9B 1F AA B6 94 10 AA 74 9B 1F AA 75 9B 1E AA 58 9B 1F AA B6 94 42 AA 7E 9B 1F AA B6 94 41 AA 74 9B 1F AA B6 94 40 AA 73 9B 1F AA B6 94 45 AA 74 9B 1F AA 52 69 63 68 75 9B 1F AA 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4C 01 03 00 D5 52 02 48 00 00 00 00 00 00 00 00 E0 00 0F 01 0B 01 07 0A 00 14 00 00 00 6A 00 00 00 00 00	success or wait	679986049
Memory read	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 1004000 Length: 256 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 03 00 00 00 30 00 00 80 06 00 00 00 80 00 00 80 0E 00 00 00 B0 00 00 80 10 00 00 00 C8 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 01 00 00 00 E0 00 00 80 02 00 00 00 F8 00 00 80 03 00 00 00 10 01 00 80 04 00 00 00 28 01 00 80 05 00 00 00 40 01 00 80 06 00 00 00 58 01 00 80 07 00 00 00 70 01 00 80 08 00 00 00 88 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 11 00 00 00 A0 01 00 80 31 00 00 00 B8 01 00 80 32 00 00 00 D0 01 00 80 41 00 00 00 E8 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 64 00 00 00 00 02 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 18 02 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 00 00 30 02 00 00 00 00 00 00 00 00 00	success or wait	679989197
Process information queried	PID: 760 Info Class: BasicInformation	success or wait	679993842
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 900000 Length: 12E70C Allocation Type: unknown Protection: page read and write	success or wait	679994083
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10000 Length: 12E814 Allocation Type: unknown Protection: page read and write	success or wait	679994513
Memory written	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10000 Length: 2116 Value: 3D 00 3A 00 3A 00 3D 00 3A 00 3A 00 5C 00 00 00 3D 00 5A 00 3A 00 3D 00 5A 00 3A 00 5C 00 00 00 41 00 4C 00 4C 00 55 00 53 00 45 00 52 00 53 00 50 00 52 00 4F 00 46 00 49 00 4C 00 45 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 6C 00 6C 00 20 00 55 00 73 00 65 00 72 00 73 00 00 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 41 00 70 00 70 00 6C 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20	success or wait	679996921
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 20000 Length: 12E814 Allocation Type: unknown Protection: page read and write	success or wait	679997580
Memory written	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 20000 Length: 1872 Value: 00 10 00 00 50 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3C 00 08 02 90 02 00 00 00 00 00 00 54 01 56 01 98 04 00 00 40 00 42 00 F0 05 00 00 B2 00 B4 00 34 06 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 40 00 42 00 E8 06 00 00 1E 00 20 00 2C 07 00 00 00 00 02 00 4C 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	680001145
Memory written	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7FFDC010 Length: 4 Value: 00 00 02 00	success or wait	680001526
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 30000 Length: 12E814 Allocation Type: unknown Protection: page read and write	success or wait	680002935
Memory written	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 30000 Length: 388 Value: 53 00 68 00 69 00 6D 00 45 00 6E 00 67 00 2E 00 64 00 6C 00 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 01 00 00 AB ED 0D AC B2 F1 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	680003641
Memory written	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7FFDC1E8 Length: 4 Value: 00 00 03 00	success or wait	680006399
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 40000 Length: 12EA80 Allocation Type: unknown Protection: page read and write	success or wait	680006686
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 73000 Length: 12EA7C Allocation Type: unknown Protection: page read and write	success or wait	680006941
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 73000 Length: 1000 New Protection: page read and write and page guard New Protection: page read and write	success or wait	680010536
Thread created	PID: 760 TID: 856 EIP: 7C810705 EAX: 1001BDC Imagepath: C:\WINDOWS\system32\rundll32.exe	success or wait	680011016
Thread resumed	TID: 856 PID: 760 Path: C:\WINDOWS\system32\rundll32.exe	success or wait	745937535
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	745945419
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	745945901
Privilege adjusted	Privilege: Increase Base Priority On or off: on	success or wait	745952019
File opened	Path: C:\WINDOWS\system32\rpcss.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	745955274
Section loaded	Path: C:\WINDOWS\system32\rpcss.dll Access: write and read and execute Type: commit Baseaddress: 940000 Size: 401408 Protection: execute Mapped to pid: own pid	success or wait	745956064
System info queried	Type: BasicInformation	success or wait	745959402
System info queried	Type: BasicInformation	success or wait	745959622
System info queried	Type: BasicInformation	success or wait	745959855
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 14C000 Length: 12EFE8 Allocation Type: unknown Protection: page read and write	success or wait	745977315
Window created	Window Name: IPTR Class Name: IPTR HWND: 5014A	success	745998922
Message sent	HWND: 5014A Message: NCCREATE WParam: 0 LParam: 1240280	success	745999525
Message sent	HWND: 5014A Message: NCCALCSIZE WParam: 0 LParam: 1240320	error	745999908
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer Name: MaximizeApps	object name not found	746000626
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer Name: MaximizeApps	object name not found	746001125
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 150000 Length: 12F05C Allocation Type: unknown Protection: page read and write	success or wait	746002918
Section loaded	Path: \KnownDlls\netapi32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	746003763
File opened	Path: C:\WINDOWS\system32\netapi32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746005238
Section loaded	Path: C:\WINDOWS\system32\netapi32.dll Access: query and write and read and execute Type: image Baseaddress: 5B860000 Size: 348160 Protection: read write Mapped to pid: own pid	success or wait	746006029
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5B861000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746008342
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5B861000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746008774
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5B861000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746009068
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5B861000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746009462
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5B861000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746009736
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5B861000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746010401
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5B861000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746010673
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5B861000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746011002
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5B861000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746011272
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 5B861000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746011800
System info queried	Type: BasicInformation	success or wait	746014758
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc Name: MaxRpcSize	object name not found	746015156
System time queried	Time: 129876420416093750	success or wait	746015924
System info queried	Type: PerformanceInformation	success or wait	746016385
Process information queried	PID: 1112 Info Class: QuotaLimits	success or wait	746016813
Process information queried	PID: 1112 Info Class: VmCounters	success or wait	746017063
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	746017926
File opened	Path: \pipe\wkssvc Access: read attributes and synchronize and generic read and generic write Options: non directory file and open no recall Attributes: none Content Overwritten: true	success or wait	746019004
File other op	Path: \wkssvc New path: Disposition: PipeInformation Data : unknown	success or wait	746019528
File other op	Path: \wkssvc New path: Disposition: CompletionInformation Data : unknown	success or wait	746019819
File write	Path: \wkssvc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	746020179
File read	Path: \wkssvc Offset: 0 Length: 1024 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	pending	746020485
File control set	Path: \wkssvc Control Code: 11C017 Input Buffer: ........ .......................	pending	746022192
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746029442
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746029809
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoNetHood	object name not found	746030970
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoNetHood	object name not found	746031623
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoPropertiesMyComputer	object name not found	746032296
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoPropertiesMyComputer	object name not found	746032928
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoInternetIcon	object name not found	746033592
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoInternetIcon	object name not found	746034225
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoCommonGroups	object name not found	746035259
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoCommonGroups	object name not found	746035895
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoControlPanel	object name not found	746036680
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoControlPanel	object name not found	746037424
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoSetFolders	object name not found	746038201
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoSetFolders	object name not found	746038945
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Name: NULL	success or wait	746040453
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	746042161
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746042745
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: AllowFileCLSIDJunctions	object name not found	746043450
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: AllowFileCLSIDJunctions	object name not found	746044146
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe Name: NULL	success or wait	746046006
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: DontShowSuperHidden	object name not found	746048501
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: DontShowSuperHidden	object name not found	746049201
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer Name: ShellState	success or wait	746049970
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer Name: ShellState	success or wait	746050363
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: ForceActiveDesktopOn	object name not found	746051114
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: ForceActiveDesktopOn	object name not found	746051841
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoActiveDesktop	object name not found	746052602
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoActiveDesktop	object name not found	746053323
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoWebView	object name not found	746054163
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoWebView	object name not found	746054883
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: ClassicShell	object name not found	746055480
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: ClassicShell	object name not found	746056860
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: SeparateProcess	object name not found	746057657
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: SeparateProcess	object name not found	746058376
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoNetCrawling	object name not found	746059128
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoNetCrawling	object name not found	746059843
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoSimpleStartMenu	object name not found	746060598
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoSimpleStartMenu	object name not found	746061315
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: Hidden	success or wait	746062059
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: ShowCompColor	success or wait	746062441
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	746062818
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: DontPrettyPath	success or wait	746063194
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: ShowInfoTip	success or wait	746063569
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideIcons	success or wait	746063946
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: MapNetDrvBtn	success or wait	746064322
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: WebView	success or wait	746064734
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: Filter	success or wait	746065110
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: ShowSuperHidden	success or wait	746065486
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: SeparateProcess	success or wait	746065930
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: NoNetCrawling	success or wait	746066308
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile Name: DocObject	object name not found	746068271
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile Name: BrowseInPlace	object name not found	746069000
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile Name: IsShortcut	object name not found	746070456
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile Name: AlwaysShowExt	object name not found	746071199
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile Name: NeverShowExt	object name not found	746071904
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 157000 Length: 12E90C Allocation Type: unknown Protection: page read and write	success or wait	746073011
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Personal	success or wait	746074025
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Personal Type: unicode Data: C:\Documents and Settings\Administrator\My Documents Old data:	success or wait	746075690
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746076165
Section loaded	Path: \KnownDlls\SETUPAPI.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	746076698
File opened	Path: C:\WINDOWS\system32\SETUPAPI.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746077447
Section loaded	Path: C:\WINDOWS\system32\setupapi.dll Access: query and write and read and execute Type: image Baseaddress: 77920000 Size: 995328 Protection: read write Mapped to pid: own pid	success or wait	746078311
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77921000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746080103
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77921000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746081435
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77921000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746081805
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77921000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746082427
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77921000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746082793
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77921000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746083296
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77921000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746083658
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77921000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746084028
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77921000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746084389
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77921000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746084758
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77921000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746085158
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77921000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746085518
Process information queried	PID: 1112 Info Class: Wow64Information	success or wait	746087879
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	746088334
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\PnP Name: seed	success or wait	746089259
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: OsLoaderPath	success or wait	746090130
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: OsLoaderPath	success or wait	746090619
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemPartition	success or wait	746091487
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemPartition	success or wait	746091977
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: SourcePath	success or wait	746092923
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: SourcePath	success or wait	746093408
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackSourcePath	success or wait	746094320
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackSourcePath	success or wait	746094870
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackCachePath	success or wait	746095788
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackCachePath	success or wait	746096272
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: DriverCachePath	success or wait	746097215
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: DriverCachePath	success or wait	746097707
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: DevicePath	success or wait	746098601
Mutant created	Name: unknown	success or wait	746099981
Mutant created	Name: unknown	success or wait	746100327
Mutant created	Name: unknown	success or wait	746100669
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogLevel	success or wait	746101180
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogLevel	success or wait	746101665
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogPath	object name not found	746102203
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	746103335
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Hostname	success or wait	746104268
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Domain	success or wait	746105157
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	746106435
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	746107044
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	746107456
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	746107936
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 02 03 10 00 00 00 44 00 00 00 01 00 00 00 2C 00 00 00 00 00 00 00 58 4E 15 00 0A 00 00 00 00 00 00 00 0A 00 00 00 57 00 4F 00 52 00 4B 00 47 00 52 00 4F 00 55 00 50 00 00 00 02 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	pending	746108361
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	746110056
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........j.......R..............k^.LA.)...)..*.,.................S.e.L.o.a.d.D.r.i.v.e.r.P.r.i.v.i.l.e.g.e.	pending	746111410
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,......................k^.LA.)...)..	pending	746112610
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	746114656
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	746115269
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	746115677
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	746116156
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	pending	746116628
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	746118544
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........b.......J...............MI.E...-6..`".$.................S.e.U.n.d.o.c.k.P.r.i.v.i.l.e.g.e.	pending	746120069
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,.......................MI.E...-6..`	pending	746121155
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	746123001
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	746131155
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 158000 Length: 12E41C Allocation Type: unknown Protection: page read and write	success or wait	746137884
File opened	Path: IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746138911
File opened	Path: IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746141543
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	746145176
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f} Name: Data	buffer overflow	746150143
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 159000 Length: 12DE74 Allocation Type: unknown Protection: page read and write	success or wait	746150591
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f} Name: Data	success or wait	746150997
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f} Name: Generation	success or wait	746152557
File opened	Path: STORAGE#Volume#1&30a96598&0&SignatureF4ACF4ACOffset7E00Length3BFEFCE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746153303
File opened	Path: STORAGE#Volume#1&30a96598&0&SignatureF4ACF4ACOffset7E00Length3BFEFCE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746155044
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	746157293
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Data	buffer overflow	746161496
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Data	success or wait	746161930
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	746163449
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	746164171
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	746168547
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: BaseClass Type: unicode Data: Drive Old data:	success or wait	746173455
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	746174053
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	746178613
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{811e0202-1746-11df-8a4d-806d6172696f} Name: BaseClass Type: unicode Data: Drive Old data:	success or wait	746183808
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746184330
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746184669
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746185574
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	746186463
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746187161
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: DocObject	object name not found	746190702
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: BrowseInPlace	object name not found	746191544
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: IsShortcut	object name not found	746193237
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: AlwaysShowExt	success or wait	746194066
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: NeverShowExt	object name not found	746194897
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746195975
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746197451
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746198918
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746199333
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746199814
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: UseDesktopIniCache	object name not found	746200319
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: UseDesktopIniCache	object name not found	746201181
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746202173
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 159720 Allocation Type: unknown Protection: page read and write	success or wait	746203159
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 15971C Allocation Type: unknown Protection: page read and write	success or wait	746203490
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	746203811
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746206227
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 159720 Allocation Type: unknown Protection: page read and write	success or wait	746207216
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 15971C Allocation Type: unknown Protection: page read and write	success or wait	746207544
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	746207864
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746209328
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746209668
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746210115
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 15A000 Length: 12CDD8 Allocation Type: unknown Protection: page read and write	success or wait	746210492
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746210933
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 159720 Allocation Type: unknown Protection: page read and write	success or wait	746211908
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 15971C Allocation Type: unknown Protection: page read and write	success or wait	746212235
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	746212555
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746213852
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 159720 Allocation Type: unknown Protection: page read and write	success or wait	746214834
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 15971C Allocation Type: unknown Protection: page read and write	success or wait	746215164
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	746215485
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746216964
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746217306
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746217752
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746218154
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 159720 Allocation Type: unknown Protection: page read and write	success or wait	746219111
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 15971C Allocation Type: unknown Protection: page read and write	success or wait	746219422
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	746219727
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746220886
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746221226
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746221668
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746222060
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 159720 Allocation Type: unknown Protection: page read and write	success or wait	746223007
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 15971C Allocation Type: unknown Protection: page read and write	success or wait	746223271
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	746223707
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Common Documents	success or wait	746225709
Key value replaced with same	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Common Documents Type: unicode Data: C:\Documents and Settings\All Users\Documents Old data:	success or wait	746227227
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746227701
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746228525
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	746229385
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746230076
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746231474
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 15B000 Length: 12E284 Allocation Type: unknown Protection: page read and write	success or wait	746232888
File opened	Path: C:\Documents and Settings\All Users\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746233302
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746234749
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746235088
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746235535
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746235948
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 159720 Allocation Type: unknown Protection: page read and write	success or wait	746236897
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 15971C Allocation Type: unknown Protection: page read and write	success or wait	746237224
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	746237596
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746239347
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746239694
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746240145
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746240553
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 159720 Allocation Type: unknown Protection: page read and write	success or wait	746241504
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 15971C Allocation Type: unknown Protection: page read and write	success or wait	746241826
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	746242140
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746243402
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746243743
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746244189
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746244580
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 159720 Allocation Type: unknown Protection: page read and write	success or wait	746245515
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 940000 Length: 15971C Allocation Type: unknown Protection: page read and write	success or wait	746245842
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	746246143
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Desktop	success or wait	746247920
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Desktop Type: unicode Data: C:\Documents and Settings\Administrator\Desktop Old data:	success or wait	746249557
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746250026
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746250328
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	746251187
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746251871
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746253264
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746254709
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Common Desktop	success or wait	746256706
Key value replaced with same	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Common Desktop Type: unicode Data: C:\Documents and Settings\All Users\Desktop Old data:	success or wait	746258159
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746258631
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746258931
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	746259859
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746260543
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746261907
File opened	Path: C:\Documents and Settings\All Users\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746263327
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32 Name: NULL	success or wait	746265522
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32 Name: LoadWithoutCOM	object name not found	746266178
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe Name: NULL	success or wait	746268029
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp Name: NULL	success or wait	746269039
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat Name: NULL	success or wait	746269930
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer Name: NULL	success or wait	746270794
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm Name: NULL	success or wait	746272202
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd Name: NULL	success or wait	746273064
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com Name: NULL	success or wait	746273921
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl Name: NULL	success or wait	746274781
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt Name: NULL	success or wait	746275642
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: Com+Enabled	success or wait	746276510
Section loaded	Path: \KnownDlls\CLBCATQ.DLL Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	746277176
File opened	Path: C:\WINDOWS\system32\CLBCATQ.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746277915
Section loaded	Path: C:\WINDOWS\system32\clbcatq.dll Access: query and write and read and execute Type: image Baseaddress: 76FD0000 Size: 520192 Protection: read write Mapped to pid: own pid	success or wait	746278731
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746280555
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746281912
Section loaded	Path: \KnownDlls\COMRes.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	746282281
File opened	Path: C:\WINDOWS\system32\COMRes.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746283041
Section loaded	Path: C:\WINDOWS\system32\comres.dll Access: query and write and read and execute Type: image Baseaddress: 77050000 Size: 806912 Protection: read write Mapped to pid: own pid	success or wait	746283879
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77051000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746286369
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77051000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746286790
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746287123
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746287533
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746287854
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746288253
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746288572
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746288888
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746289208
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746289533
Section loaded	Path: \KnownDlls\OLEAUT32.dll Access: write and read and execute Type: unknown Baseaddress: 77120000 Size: 569344 Protection: read write Mapped to pid: own pid	success or wait	746289896
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746291012
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746292350
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746292696
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746293056
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746293399
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746293850
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746294191
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746294542
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746294883
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746295240
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746295580
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746295914
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746296260
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746296573
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: MinimumFreeMemPercentageToCreateProcess	object name not found	746300842
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: MinimumFreeMemPercentageToCreateObject	object name not found	746301280
Process information queried	PID: 1112 Info Class: Wow64Information	success or wait	746302171
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: Com+Enabled	success or wait	746302566
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	746304918
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 15C000 Length: 12E994 Allocation Type: unknown Protection: page read and write	success or wait	746306565
System info queried	Type: BasicInformation	success or wait	746307976
System info queried	Type: ProcessorInformation	success or wait	746308259
File opened	Path: C:\WINDOWS\Registration\R000000000007.clb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	746308603
File other op	Path: C:\WINDOWS\Registration\R000000000007.clb New path: Disposition: PositionInformation Data : Offset: 22512	success or wait	746309526
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 15D000 Length: 12E90C Allocation Type: unknown Protection: page read and write	success or wait	746309883
File other op	Path: C:\WINDOWS\Registration\R000000000007.clb New path: Disposition: PositionInformation Data : Offset: 0	success or wait	746310308
File read	Path: C:\WINDOWS\Registration\R000000000007.clb Offset: unknown Length: 22512 Value: 43 4F 4D 2B 01 00 00 00 01 00 12 00 24 00 00 00 00 01 01 00 63 00 00 00 00 00 00 01 01 00 00 00 00 01 10 00 00 00 00 00 C0 00 00 00 00 00 00 46 0E 00 00 00 30 01 00 00 A0 03 00 00 33 5F 30 00 D0 04 00 00 0C 00 00 00 33 5F 31 00 DC 04 00 00 88 02 00 00 33 5F 32 00 64 07 00 00 3C 00 00 00 33 5F 33 00	success or wait	746310586
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 854000 Length: 12E968 Allocation Type: unknown Protection: page read and write	success or wait	746328464
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 856000 Length: 12EA58 Allocation Type: unknown Protection: page read and write	success or wait	746328938
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	746329473
System info queried	Type: BasicInformation	success or wait	746330107
System info queried	Type: ProcessorInformation	success or wait	746330379
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 900000 Length: 12ED00 Allocation Type: unknown Protection: page no access	success or wait	746330648
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 900000 Length: 12ED00 Allocation Type: unknown Protection: page read and write	success or wait	746330937
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32 Name: InprocServer32	object name not found	746333675
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32 Name: NULL	success or wait	746339172
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4} Name: AppID	object name not found	746341432
Process information queried	PID: 1112 Info Class: SessionInformation	success or wait	746342421
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32 Name: ThreadingModel	success or wait	746344425
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 163000 Length: 12E29C Allocation Type: unknown Protection: page read and write	success or wait	746345351
File opened	Path: C:\WINDOWS\system32\urlmon.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746346644
Section loaded	Path: C:\WINDOWS\system32\urlmon.dll Access: write and read and execute Type: commit Baseaddress: 940000 Size: 1212416 Protection: execute Mapped to pid: own pid	success or wait	746347491
File opened	Path: C:\WINDOWS\system32\urlmon.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746350041
Section loaded	Path: C:\WINDOWS\system32\urlmon.dll Access: query and write and read and execute Type: image Baseaddress: 78130000 Size: 1257472 Protection: read write Mapped to pid: own pid	success or wait	746350885
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746355115
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746355665
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746356023
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746356375
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746356729
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746357108
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746357461
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746357808
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746358156
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746358523
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746358873
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746359349
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746360234
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746361039
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746361388
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746361761
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746362110
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746362674
Section loaded	Path: \KnownDlls\iertutil.dll Access: write and read and execute Type: unknown Baseaddress: 3DFD0000 Size: 2002944 Protection: read write Mapped to pid: own pid	success or wait	746363067
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	746371559
Memory attributes changed	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 78131000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	746371909
File opened	Path: C:\WINDOWS\system32\urlmon.dll.123.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	746380226
File opened	Path: C:\WINDOWS\system32\urlmon.dll.123.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	746381236
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	746561047
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableImprovedZoneCheck	object name not found	746565931
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN Name: ~WORDL.tmp	object name not found	746580297
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN Name: *	object name not found	746580873
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 165000 Length: 12E064 Allocation Type: unknown Protection: page read and write	success or wait	746582033
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7b8a2d94-0ac9-11d1-896c-00c04Fb6bfc4}\InprocServer32 Name: NULL	success or wait	746582990
Mutant created	Name: \BaseNamedObjects\Local\ZonesCounterMutex	object name exists	746583995
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\IETld Name: IETldDllVersionLow	success or wait	746591028
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\IETld Name: IETldDllVersionHigh	success or wait	746591789
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746592273
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746592694
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746593172
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746593582
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\IETld Name: IETldVersionLow	success or wait	746594606
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\IETld Name: IETldVersionHigh	success or wait	746595170
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 166000 Length: 12E2F4 Allocation Type: unknown Protection: page read and write	success or wait	746598787
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: CreateUriCacheSize	object name not found	746599329
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: CreateUriCacheSize	object name not found	746599839
Process information queried	PID: 1112 Info Class: Wow64Information	success or wait	746600195
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnablePunycode	object name not found	746602472
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnablePunycode	success or wait	746602926
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\Security Name: DisableSecuritySettingsCheck	object name not found	746604587
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security Name: DisableSecuritySettingsCheck	object name not found	746605250
Section loaded	Path: \BaseNamedObjects\Local\UrlZonesSM_Administrator Access: query and write and read Type: commit Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name exists	746606731
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 168000 Length: 12EC54 Allocation Type: unknown Protection: page read and write	success or wait	746607334
Mutant created	Name: \BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex	object name exists	746607669
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	746608055
Mutant created	Name: \BaseNamedObjects\Local\ZonesCacheCounterMutex	object name exists	746610269
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Name: Flags	success or wait	746610858
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Name: Flags	success or wait	746611967
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: ProxyBypass Type: dword Data: 1 Old data:	success or wait	746612670
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: IntranetName Type: dword Data: 1 Old data:	success or wait	746612964
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: UNCAsIntranet Type: dword Data: 1 Old data:	success or wait	746613255
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: AutoDetect Type: dword Data: 1 Old data:	success or wait	746613543
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 169000 Length: 12E7A0 Allocation Type: unknown Protection: page read and write	success or wait	746614443
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Name: Flags	success or wait	746615190
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Name: Flags	success or wait	746616301
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 16A000 Length: 12E7A0 Allocation Type: unknown Protection: page read and write	success or wait	746617623
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Name: Flags	success or wait	746618255
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN Name: ~WORDL.tmp	object name not found	746619473
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN Name: *	object name not found	746619897
Mutant created	Name: \BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex	object name exists	746620326
Mutant created	Name: \BaseNamedObjects\Local\ZonesLockedCacheCounterMutex	object name exists	746620786
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Name: Flags	success or wait	746621374
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Name: Flags	success or wait	746622474
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: ProxyBypass Type: dword Data: 1 Old data:	success or wait	746623098
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: IntranetName Type: dword Data: 1 Old data:	success or wait	746623388
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: UNCAsIntranet Type: dword Data: 1 Old data:	success or wait	746623678
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: AutoDetect Type: dword Data: 1 Old data:	success or wait	746623964
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 16B000 Length: 12E7A0 Allocation Type: unknown Protection: page read and write	success or wait	746624862
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Name: Flags	success or wait	746625496
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Name: Flags	success or wait	746626597
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 16C000 Length: 12E7A0 Allocation Type: unknown Protection: page read and write	success or wait	746627398
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Name: Flags	success or wait	746628017
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746630395
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: SpecialFoldersCacheSize	object name not found	746630855
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: SpecialFoldersCacheSize	object name not found	746631274
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Cache	success or wait	746632479
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cache Type: unicode Data: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files Old data:	success or wait	746634597
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Cookies	success or wait	746635754
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cookies Type: unicode Data: C:\Documents and Settings\Administrator\Cookies Old data:	success or wait	746637426
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746637903
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746638344
File opened	Path: C:\WINDOWS\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746639657
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746641004
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746642431
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746642690
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746643082
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746643355
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746643766
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746644042
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746644532
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Name: 1806	success or wait	746645181
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: TransparentEnabled	success or wait	746646310
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe Name: NULL	success or wait	746647741
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command Name: NULL	success or wait	746650147
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command Name: command	object name not found	746651427
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command Name: NULL	success or wait	746653617
Foreground Window Got	HWND: 1008C	success	746654427
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746654729
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746655111
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\ShellNoRoam\MUICache Name: LangID	success or wait	746658081
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\ShellNoRoam\MUICache Name: C:\WINDOWS\system32\cmd.exe	object name not found	746658553
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746659187
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746659578
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746659854
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746660845
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: write and read and execute Type: commit Baseaddress: 940000 Size: 389120 Protection: execute Mapped to pid: own pid	success or wait	746661628
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	746664081
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: query and read Type: commit Baseaddress: 940000 Size: 389120 Protection: readonly Mapped to pid: own pid	success or wait	746664885
Process information queried	PID: 1112 Info Class: DefaultHardErrorMode	success or wait	746666201
Memory allocated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Base: 16D000 Length: 12E820 Allocation Type: unknown Protection: page read and write	success or wait	746670052
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746671024
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: write and read and execute Type: commit Baseaddress: 940000 Size: 389120 Protection: execute Mapped to pid: own pid	success or wait	746671813
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	746673409
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: query and read Type: commit Baseaddress: 940000 Size: 389120 Protection: readonly Mapped to pid: own pid	success or wait	746674178
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation Name: CutList	success or wait	746678183
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileAssociation Name: CutList	success or wait	746678882
Key value set	Path: HKEY_USERS\Software\Microsoft\Windows\ShellNoRoam\MUICache Name: C:\WINDOWS\system32\cmd.exe Type: unicode Data: Windows Command Processor Old data:	success or wait	746679638
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	746687250
File other op	Path: C:\WINDOWS\system32\cmd.exe New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 00:20 25-07-2012 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: none	success or wait	746688014
File read	Path: C:\WINDOWS\system32\cmd.exe Offset: unknown Length: 64 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D8 00 00 00	success or wait	746688721
File other op	Path: C:\WINDOWS\system32\cmd.exe New path: Disposition: PositionInformation Data : Offset: 216	success or wait	746689329
File read	Path: C:\WINDOWS\system32\cmd.exe Offset: unknown Length: 64 Value: 50 45 00 00 4C 01 03 00 AF 5B 02 48 00 00 00 00 00 00 00 00 E0 00 0F 01 0B 01 07 0A 00 F8 01 00 00 F6 03 00 00 00 00 00 46 50 00 00 00 10 00 00 00 F0 01 00 00 00 D0 4A 00 10 00 00 00 02 00 00	success or wait	746689524
File other op	Path: C:\WINDOWS\system32\cmd.exe New path: Disposition: PositionInformation Data : Offset: 288	success or wait	746689782
File read	Path: C:\WINDOWS\system32\cmd.exe Offset: unknown Length: 4 Value: 04 00 00 00	success or wait	746689973
File other op	Path: C:\WINDOWS\system32\cmd.exe New path: Disposition: PositionInformation Data : Offset: 308	success or wait	746690193
File read	Path: C:\WINDOWS\system32\cmd.exe Offset: unknown Length: 4 Value: 03 00 00 80	success or wait	746690384
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: InheritConsoleHandles	object name not found	746691143
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: InheritConsoleHandles	object name not found	746691851
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: RestrictRun	object name not found	746692513
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: RestrictRun	object name not found	746693131
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: DisallowRun	object name not found	746693786
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: DisallowRun	object name not found	746694402
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoRunasInstallPrompt	object name not found	746695093
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoRunasInstallPrompt	object name not found	746695727
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746696314
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: query and write and read and execute and extend size Type: image Baseaddress: 940000 Size: 389120 Protection: readonly Mapped to pid: own pid	success or wait	746697058
File opened	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	746698646
Section loaded	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read Type: commit Baseaddress: 940000 Size: 1208320 Protection: readonly Mapped to pid: own pid	success or wait	746699431
File opened	Path: C:\WINDOWS\AppPatch\systest.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	object name not found	746701098
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter Name: Installed	success or wait	746701810
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	746702450
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746703446
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746705240
File opened	Path: C:\WINDOWS\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746706486
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746707795
Process information queried	PID: 1112 Info Class: DeviceMap	success or wait	746709380
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746714772
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: write and read and execute Type: commit Baseaddress: A70000 Size: 389120 Protection: execute Mapped to pid: own pid	success or wait	746715589
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	746717283
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: query and read Type: commit Baseaddress: A70000 Size: 389120 Protection: readonly Mapped to pid: own pid	success or wait	746718111
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	746723189
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: write and read and execute Type: commit Baseaddress: A70000 Size: 389120 Protection: execute Mapped to pid: own pid	success or wait	746724003
File opened	Path: C:\WINDOWS\system32\cmd.exe Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	746725662
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: query and read Type: commit Baseaddress: A70000 Size: 389120 Protection: readonly Mapped to pid: own pid	success or wait	746726465
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746730813
File opened	Path: C:\WINDOWS\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746732114
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746733418
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746737684
File opened	Path: C:\WINDOWS\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746738941
File opened	Path: C:\WINDOWS\system32\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	746740243
Section loaded	Path: C:\WINDOWS\system32\cmd.exe Access: query and read Type: commit Baseaddress: 940000 Size: 389120 Protection: readonly Mapped to pid: own pid	success or wait	746741899
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: LogFileName	object name not found	746742843
System info queried	Type: WatchdogTimerHandler	success or wait	746744154
Process created	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Cmdline: C:\WINDOWS\system32\cmd.exe /c del C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp > nul Createflags: none	success or wait	746744342
Process information queried	PID: 868 Info Class: BasicInformation	success or wait	746746470
Memory read	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7FFDF008 Length: 4 Value: 00 00 D0 4A	success or wait	746746680
File opened	Path: C:\WINDOWS\system32\cmd.exe.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	746746975
Memory read	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 4AD00000 Length: 4096 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 D8 00 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 1D ED D5 EA 59 8C BB B9 59 8C BB B9 59 8C BB B9 9A 83 B4 B9 5F 8C BB B9 59 8C BA B9 80 8C BB B9 9A 83 E6 B9 5E 8C BB B9 E6 83 DB B9 5B 8C BB B9 9A 83 E5 B9 58 8C BB B9 9A 83 E4 B9 6D 8C BB B9 9A 83 E1 B9 58 8C BB B9 52 69 63 68 59 8C BB B9 00 00 00 00 00 00 00 00 50 45 00 00 4C 01 03 00 AF 5B 02 48 00 00 00 00 00 00 00 00 E0 00 0F 01 0B 01 07 0A 00 F8 01 00 00 F6 03 00 00 00 00	success or wait	746748008
Memory read	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 4AD3E000 Length: 256 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 03 00 00 00 30 00 00 80 0B 00 00 00 80 00 00 80 0E 00 00 00 98 00 00 80 10 00 00 00 B0 00 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 00 01 00 00 00 C8 00 00 80 02 00 00 00 E0 00 00 80 03 00 00 00 F8 00 00 80 04 00 00 00 10 01 00 80 05 00 00 00 28 01 00 80 06 00 00 00 40 01 00 80 07 00 00 00 58 01 00 80 08 00 00 00 70 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 88 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 80 02 00 80 A0 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00 00 00 B8 01 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 00 00 D0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 09 04 00 00 E0 01 00 00 00 00 00 00 00 00 00	success or wait	746750704
Process information queried	PID: 868 Info Class: BasicInformation	success or wait	746751188
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 10000 Length: 12DB2C Allocation Type: unknown Protection: page read and write	success or wait	746751882
Memory written	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 10000 Length: 2116 Value: 3D 00 3A 00 3A 00 3D 00 3A 00 3A 00 5C 00 00 00 3D 00 5A 00 3A 00 3D 00 5A 00 3A 00 5C 00 00 00 41 00 4C 00 4C 00 55 00 53 00 45 00 52 00 53 00 50 00 52 00 4F 00 46 00 49 00 4C 00 45 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 6C 00 6C 00 20 00 55 00 73 00 65 00 72 00 73 00 00 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 41 00 70 00 70 00 6C 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20	success or wait	746753572
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 20000 Length: 12DB2C Allocation Type: unknown Protection: page read and write	success or wait	746753950
Memory written	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 20000 Length: 1836 Value: 00 10 00 00 2C 07 00 00 00 00 00 00 00 00 00 00 FE FF FF FF 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3A 00 08 02 90 02 00 00 00 00 00 00 54 01 56 01 98 04 00 00 36 00 38 00 F0 05 00 00 A6 00 A8 00 28 06 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 36 00 38 00 D0 06 00 00 1E 00 20 00 08 07 00 00 00 00 02 00 28 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	746755320
Memory written	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7FFDF010 Length: 4 Value: 00 00 02 00	success or wait	746755704
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 30000 Length: 12DB2C Allocation Type: unknown Protection: page read and write	success or wait	746755938
Memory written	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 30000 Length: 388 Value: 53 00 68 00 69 00 6D 00 45 00 6E 00 67 00 2E 00 64 00 6C 00 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 84 01 00 00 AB ED 0D AC AA 3F 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 11 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	746756520
Memory written	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7FFDF1E8 Length: 4 Value: 00 00 03 00	success or wait	746756920
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 40000 Length: 12DD98 Allocation Type: unknown Protection: page read and write	success or wait	746757273
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 40000 Length: 12DD94 Allocation Type: unknown Protection: page read and write	success or wait	746757529
Thread created	PID: 868 TID: 944 EIP: 7C810705 EAX: 4AD05046 Imagepath: C:\WINDOWS\system32\cmd.exe	success or wait	746758013
Thread resumed	TID: 944 PID: 868 Path: C:\WINDOWS\system32\cmd.exe	success or wait	747125464
Window destroyed	HWND: 5014A	success	747128295
Windows enumerated	Desktop: 0 Parent: 0 Enum Children: false TID: 45C HWNDs: 5013A, 50104, 1, 520054, 5C0059, 530055, 520045, 53005C, 31002D, 35002D, 32002D, 2D0031, 300035, 390037, 310032	success or wait	747128616
Windows enumerated	Desktop: 0 Parent: 0 Enum Children: false TID: 45C HWNDs: 5013A, 50104, 1, 520054, 5C0059, 530055, 520045, 53005C, 31002D, 35002D, 32002D, 2D0031, 300035, 390037, 310032	success or wait	747129043
Message sent	HWND: 1008C Message: 419 WParam: 0 LParam: 0	success	747138606
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{11016101-E366-4D22-BC06-4ADA335C892B} Name: SuppressionPolicy	object name not found	747140971
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{1f4de370-d627-11d1-ba4f-00a0c91eedba} Name: SuppressionPolicy	object name not found	747141699
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{450D8FBA-AD25-11D0-98A8-0800361B1103} Name: SuppressionPolicy	object name not found	747142413
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{645FF040-5081-101B-9F08-00AA002F954E} Name: SuppressionPolicy	object name not found	747143122
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Desktop\NameSpace\{e17d4fc0-5564-11d1-83f2-00a0c90dc849} Name: SuppressionPolicy	object name not found	747143822
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\ShellFolder Name: WantsParseDisplayName	object name not found	747146318
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\ShellFolder Name: WantsParseDisplayName	object name not found	747148121
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\ShellFolder Name: WantsParseDisplayName	success or wait	747149806
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Name: NULL	success or wait	747150815
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Name: LoadWithoutCOM	object name not found	747151474
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked Name: {871C5380-42A0-1069-A2EA-08002B30309D}	object name not found	747154069
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Blocked Name: {871C5380-42A0-1069-A2EA-08002B30309D}	object name not found	747154998
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: EnforceShellExtensionSecurity	object name not found	747155522
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: EnforceShellExtensionSecurity	object name not found	747156201
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached Name: {871C5380-42A0-1069-A2EA-08002B30309D} {000214E6-0000-0000-C000-000000000046} 0x401	object name not found	747157282
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached Name: {871C5380-42A0-1069-A2EA-08002B30309D} {000214E6-0000-0000-C000-000000000046} 0x401	success or wait	747158188
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility Name: DisableAppCompat	object name not found	747158704
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Name:	success or wait	747159249
File opened	Path: C:\WINDOWS\system32\ieframe.dll Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	747160029
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\ShellFolder Name: WantsParseDisplayName	object name not found	747162890
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f4de370-d627-11d1-ba4f-00a0c91eedba}\ShellFolder Name: WantsParseDisplayName	object name not found	747164578
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{450D8FBA-AD25-11D0-98A8-0800361B1103}\ShellFolder Name: WantsParseDisplayName	object name not found	747166929
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\ShellFolder Name: WantsParseDisplayName	object name not found	747168558
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e17d4fc0-5564-11d1-83f2-00a0c90dc849}\ShellFolder Name: WantsParseDisplayName	object name not found	747170243
Process terminated	PID: 1112 Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	success or wait	747170804
Message posted	TID: 7DC Message: C08C WParam: 0 LParam: 1116	success	747179212
Process information queried	PID: 1112 Info Class: Cookie	success or wait	747184736
Process information queried	PID: 1112 Info Class: Cookie	success or wait	747184946
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize Name: DisableMetaFiles	object name not found	747186852

Analysis File: cmd.exe PID: 1096 Parent PID: 1160

General

Start time:	15:20:20
Start date:	24/07/2012
Path:	C:\WINDOWS\system32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /c iPhone 5.doc
Imagebase:	0x4ad00000
File size:	389120 bytes
MD5 hash:	6D778E0F95447E6546553EEEA709D03C

File Activites

File Path	Access	Options	Content overwritten	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1\	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	7	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\ShimEng.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\AppPatch\AcGenral.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	3	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\WINMM.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\MSACM32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\UxTheme.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\IMM32.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	3	7C90E457	KiUserApcDispatcher
\Device\KsecDD	read data or list directory and synchronize	synchronous io alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Manifest	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	8	4AD043B0	FindFirstFileW
C:\DOCUME~1\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	4	4AD043B0	FindFirstFileW
C:\DOCUME~1\ADMINI~1\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	4	4AD043B0	FindFirstFileW
C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc	read data or list directory and execute or traverse and read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	1	4AD031C5	CreateProcessW
C:\WINDOWS\system32\Apphelp.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	4AD031C5	CreateProcessW
C:\WINDOWS\system32\rpcss.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C817077	unknown
C:\WINDOWS\system32\MSCTF.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C817077	unknown
C:\WINDOWS\system32\netapi32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	4AD13114	ShellExecuteExW
C:\WINDOWS\system32\SETUPAPI.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	4AD13114	ShellExecuteExW
IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}	read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	2	4AD13114	ShellExecuteExW
STORAGE#Volume#1&30a96598&0&SignatureF4ACF4ACOffset7E00Length3BFEFCE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}	read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	2	4AD13114	ShellExecuteExW
C:\Documents and Settings\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	4	4AD13114	ShellExecuteExW
C:\Documents and Settings\Administrator\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	4AD13114	ShellExecuteExW
C:\Documents and Settings\Administrator\My Documents\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	6	4AD13114	ShellExecuteExW
C:\Documents and Settings\All Users\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	4AD13114	ShellExecuteExW
C:\Documents and Settings\All Users\Documents\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	3	4AD13114	ShellExecuteExW
C:\WINDOWS\system32\msi.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	read data or list directory and execute or traverse and read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	1	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\OFFICE11\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	4AD13114	ShellExecuteExW
C:\WINDOWS\AppPatch\sysmain.sdb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	7C90E457	KiUserApcDispatcher
C:\WINDOWS\AppPatch\systest.sdb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	object name not found	2	7C90E457	KiUserApcDispatcher
\Device\NamedPipe\ShimViewer	write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize	no options	true	object name not found	4	7C90E457	KiUserApcDispatcher
C:\WINDOWS\AppPatch\AcGenral.DLL	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Manifest	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C90E457	KiUserApcDispatcher
\pipe\wkssvc	read attributes and synchronize and generic read and generic write	non directory file and open no recall	true	success or wait	1	4AD13114	ShellExecuteExW
\pipe\lsarpc	read attributes and synchronize and generic read and generic write	non directory file	true	success or wait	2	4AD13114	ShellExecuteExW
MountPointManager	read attributes and synchronize	synchronous io non alert and non directory file	true	success or wait	6	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	read attributes and write attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	4AD13114	ShellExecuteExW

File Path	Offset	Length	Value	Completion	Count	Source Address	Symbol
\wkssvc	0	72	05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	1	4AD13114	ShellExecuteExW
\lsarpc	0	72	05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	2	4AD13114	ShellExecuteExW

File Path	Offset	Length	Value	Completion	Count	Source Address	Symbol
\wkssvc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 73 18 00 00 0D 00 5C 50 49 50 45 5C 77 6B 73 73 76 63 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	4AD13114	ShellExecuteExW
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 25 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	4AD13114	ShellExecuteExW
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 26 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	4AD13114	ShellExecuteExW
C:\Documents and Settings\Administrator\My Documents\desktop.ini	unknown	84	5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	6	4AD13114	ShellExecuteExW
C:\Documents and Settings\All Users\Documents\desktop.ini	unknown	62	5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	3	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	unknown	64	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 01 00 00	success or wait	1	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	unknown	64	50 45 00 00 4C 01 05 00 40 2A 5F 46 00 00 00 00 00 00 00 00 E0 00 0F 01 0B 01 07 0A 00 60 AA 00 00 24 12 00 00 14 02 00 F0 19 00 00 00 10 00 00 00 90 A9 00 00 00 00 30 00 10 00 00 00 02 00 00	success or wait	1	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	unknown	4	04 00 00 00	success or wait	1	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	unknown	4	02 00 40 00	success or wait	1	4AD13114	ShellExecuteExW

File Path	Disposition	Data	Ascii Data	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1	90028	NU LL		success or wait	1	7C90E457	KiUserApcDispatcher
\wkssvc	11C017	05 00 00 03 10 00 00 00 20 00 00 00 01 00 00 00 08 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00	........ .......................	pending	1	4AD13114	ShellExecuteExW
\lsarpc	11C017	05 00 00 03 10 00 00 00 40 00 00 00 01 00 00 00 28 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 00 02 00 01 00 00 08 00 00	........@.......(.....,.........................................	pending	2	4AD13114	ShellExecuteExW
\lsarpc	11C017	05 00 00 03 10 00 00 00 6A 00 00 00 02 00 00 00 52 00 00 00 00 00 1F 00 00 00 00 00 0C DE 09 1F EC 4C 78 44 98 7B F6 0B 41 20 0F 2F 2A 00 2C 00 00 00 02 00 16 00 00 00 00 00 00 00 15 00 00 00 53 00 65 00 4C 00 6F 00 61 00 64 00 44 00 72 00 69 00 76 00 65 00 72 00 50 00 72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 00	........j.......R................LxD.{..A ./*.,.................S.e.L.o.a.d.D.r.i.v.e.r.P.r.i.v.i.l.e.g.e.	pending	1	4AD13114	ShellExecuteExW
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 0C DE 09 1F EC 4C 78 44 98 7B F6 0B 41 20 0F 2F	........,........................LxD.{..A ./	pending	1	4AD13114	ShellExecuteExW
\lsarpc	11C017	05 00 00 03 10 00 00 00 62 00 00 00 02 00 00 00 4A 00 00 00 00 00 1F 00 00 00 00 00 8D A8 68 E5 43 CB F2 4C B0 E5 CE 96 0B 05 67 CB 22 00 24 00 00 00 02 00 12 00 00 00 00 00 00 00 11 00 00 00 53 00 65 00 55 00 6E 00 64 00 6F 00 63 00 6B 00 50 00 72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 00	........b.......J.............h.C..L......g.".$.................S.e.U.n.d.o.c.k.P.r.i.v.i.l.e.g.e.	pending	1	4AD13114	ShellExecuteExW
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 8D A8 68 E5 43 CB F2 4C B0 E5 CE 96 0B 05 67 CB	........,.....................h.C..L......g.	pending	1	4AD13114	ShellExecuteExW
\wkssvc	PipeInformation	unknown		success or wait	1	4AD13114	ShellExecuteExW
\wkssvc	CompletionInformation	unknown		success or wait	1	4AD13114	ShellExecuteExW
\lsarpc	PipeInformation	unknown		success or wait	2	4AD13114	ShellExecuteExW
\lsarpc	CompletionInformation	unknown		success or wait	2	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 00:20 25-07-2012 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: none		success or wait	1	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	PositionInformation	Offset: 336		success or wait	1	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	PositionInformation	Offset: 408		success or wait	1	4AD13114	ShellExecuteExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	PositionInformation	Offset: 428		success or wait	1	4AD13114	ShellExecuteExW

Section Activites

Section loaded by Windows

File Path	Access	Type	Base	Size	Mapped to pid	Protection	Completion	Count
\KnownDlls\kernel32.dll	write and read and execute	unknown	7C800000	1007616	own pid	read write	success or wait	1
unknown	query and write and read and execute and extend size	reserve	7C800000	1007616	own pid	read write	success or wait	1
\NLS\NlsSectionUnicode	read	unknown	270000	90112	own pid	readonly	success or wait	1
\NLS\NlsSectionLocale	read	unknown	290000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey	query and read	unknown	2E0000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortTbls	read	unknown	330000	24576	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\KnownDlls\msvcrt.dll	write and read and execute	unknown	77C10000	360448	own pid	read write	success or wait	1
\KnownDlls\USER32.dll	write and read and execute	unknown	7E410000	593920	own pid	read write	success or wait	1
\KnownDlls\GDI32.dll	write and read and execute	unknown	77F10000	299008	own pid	read write	success or wait	1
\KnownDlls\ShimEng.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\shimeng.dll	query and write and read and execute	image	5CB70000	155648	own pid	read write	success or wait	1
C:\WINDOWS\AppPatch\sysmain.sdb	read	commit	340000	1208320	own pid	readonly	success or wait	1
C:\WINDOWS\AppPatch\acgenral.dll	write and read and execute	commit	480000	1855488	own pid	execute	success or wait	1
C:\WINDOWS\AppPatch\acgenral.dll	write and read and execute	commit	480000	1855488	own pid	execute	success or wait	1
C:\WINDOWS\AppPatch\acgenral.dll	query and write and read and execute	image	6F880000	1875968	own pid	read write	success or wait	1
\KnownDlls\ADVAPI32.dll	write and read and execute	unknown	77DD0000	634880	own pid	read write	success or wait	1
\KnownDlls\RPCRT4.dll	write and read and execute	unknown	77E70000	602112	own pid	read write	success or wait	1
\KnownDlls\Secur32.dll	write and read and execute	unknown	77FE0000	69632	own pid	read write	success or wait	1
\KnownDlls\WINMM.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\winmm.dll	query and write and read and execute	image	76B40000	184320	own pid	read write	success or wait	1
\KnownDlls\ole32.dll	write and read and execute	unknown	774E0000	1302528	own pid	read write	success or wait	1
\KnownDlls\OLEAUT32.dll	write and read and execute	unknown	77120000	569344	own pid	read write	success or wait	1
\KnownDlls\MSACM32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msacm32.dll	query and write and read and execute	image	77BE0000	86016	own pid	read write	success or wait	1
\KnownDlls\VERSION.dll	write and read and execute	unknown	77C00000	32768	own pid	read write	success or wait	1
\KnownDlls\SHELL32.dll	write and read and execute	unknown	7C9C0000	8482816	own pid	read write	success or wait	1
\KnownDlls\SHLWAPI.dll	write and read and execute	unknown	77F60000	483328	own pid	read write	success or wait	1
\KnownDlls\USERENV.dll	write and read and execute	unknown	769C0000	737280	own pid	read write	success or wait	1
\KnownDlls\UxTheme.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\uxtheme.dll	query and write and read and execute	image	5AD70000	229376	own pid	read write	success or wait	1
\NLS\NlsSectionCType	read	unknown	490000	12288	own pid	readonly	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	410000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	410000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	query and write and read and execute	image	76390000	118784	own pid	read write	success or wait	1
C:\WINDOWS\system32\shell32.dll	read	commit	970000	8462336	own pid	readonly	success or wait	1
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	write and read and execute	commit	970000	1056768	own pid	execute	success or wait	1
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	query and write and read and execute	image	773D0000	1060864	own pid	read write	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	write and read and execute	commit	440000	4096	own pid	execute	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	query and read	commit	440000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	read	commit	440000	4096	own pid	readonly	success or wait	1
\KnownDlls\comctl32.dll	write and read and execute	unknown	5D090000	630784	own pid	read write	success or wait	1
C:\WINDOWS\system32\comctl32.dll	read	commit	970000	618496	own pid	readonly	success or wait	1
C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc	query and write and read and execute and extend size	image	unknown	unknown	unknown	unknown	invalid image not mz	1
\BaseNamedObjects\ShimSharedMemory	write	unknown	980000	57344	own pid	read write	success or wait	1
C:\WINDOWS\system32\apphelp.dll	write and read and execute	commit	990000	126976	own pid	execute	success or wait	1
C:\WINDOWS\system32\apphelp.dll	query and write and read and execute	image	77B40000	139264	own pid	read write	success or wait	1
C:\WINDOWS\AppPatch\sysmain.sdb	read	commit	990000	1208320	own pid	readonly	success or wait	1
C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc	query and read	commit	990000	24576	own pid	readonly	success or wait	1
C:\WINDOWS\system32\rpcss.dll	write and read and execute	commit	9A0000	401408	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctf.dll	write and read and execute	commit	9A0000	299008	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctf.dll	query and write and read and execute	image	74720000	311296	own pid	read write	success or wait	1
\BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-507921405-1960408961-839522115-500	query and write and read	commit	unknown	unknown	unknown	unknown	object name exists	1
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500SFM.DefaultS-1-5-21-507921405-1960408961-839522115-500	query and write and read and execute and extend size	unknown	9B0000	262144	own pid	read write	success or wait	1
\KnownDlls\netapi32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\netapi32.dll	query and write and read and execute	image	5B860000	348160	own pid	read write	success or wait	1
\KnownDlls\SETUPAPI.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\setupapi.dll	query and write and read and execute	image	77920000	995328	own pid	read write	success or wait	1
\KnownDlls\msi.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msi.dll	query and write and read and execute	image	7D1E0000	2867200	own pid	read write	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	query and write and read and execute and extend size	image	7D1E0000	2867200	own pid	read write	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	query and read	commit	9F0000	12312576	own pid	readonly	success or wait	1

Registry Activites

Key Value Modified

Key Path	Name	Type	Old Data	New Data	Completion	Count	Source Address	Symbol
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	WORDFiles	dword	1089994759	1089994760	success or wait	1	4AD13114	ShellExecuteExW

Key Value Queried

Key Path	Name	Completion	Count	Source Address	Symbol
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CWDIllegalInDLLSearch	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server	TSAppCompat	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter	Installed	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	SafeDllSearchMode	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize	DisableMetaFiles	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows	AppInit_DLLs	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	LeakTrack	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaProperties\PrivateProperties\Joystick\Winmm	wheel	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CriticalSectionTimeout	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	RWLockResourceTimeOut	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAllForOle32	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableTypeLib	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAllForOle32	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Multimedia\Audio	SystemFormats	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.imaadpcm	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.imaadpcm	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msadpcm	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msadpcm	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg711	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg711	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msgsm610	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msgsm610	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.trspch	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.trspch	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg723	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg723	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msaudio1	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msaudio1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.sl_anet	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.sl_anet	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.iac2	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.iac2	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.l3acm	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.l3acm	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM	NoPCMConverter	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00	Priority1	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	EnableBalloonTips	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	ChkAccDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions	ProductType	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Personal	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Local Settings	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	RsopDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	RsopLogging	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	RsopLogging	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\ThemeManager	Compositing	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	LameButtonText	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	DisableUNCCheck	object name not found	1	4AD04A2A	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	EnableExtensions	success or wait	1	4AD04A4F	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	DelayedExpansion	object name not found	1	4AD04A88	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	DefaultColor	success or wait	1	4AD04AAD	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	CompletionChar	success or wait	1	4AD04AE5	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	PathCompletionChar	success or wait	1	4AD04B37	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	AutoRun	success or wait	1	4AD04BB8	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	DisableUNCCheck	object name not found	1	4AD04A2A	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	EnableExtensions	success or wait	1	4AD04A4F	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	DelayedExpansion	object name not found	1	4AD04A88	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	DefaultColor	success or wait	1	4AD04AAD	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	CompletionChar	success or wait	1	4AD04AE5	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	PathCompletionChar	object name not found	1	4AD04B37	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	AutoRun	object name not found	1	4AD04BB8	RegQueryValueExW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	00000409	success or wait	1	4AD056A7	setlocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups	1	success or wait	1	4AD056A7	setlocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility	DisableAppCompat	object name not found	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter	Installed	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	AuthenticodeEnabled	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	Levels	object name not found	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}	ItemData	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33}	SaferFlags	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}	ItemData	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}	HashAlg	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}	ItemSize	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328}	SaferFlags	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}	ItemData	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}	HashAlg	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}	ItemSize	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91}	SaferFlags	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}	ItemData	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}	HashAlg	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}	ItemSize	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f}	SaferFlags	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}	ItemData	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}	HashAlg	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}	ItemSize	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d}	SaferFlags	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}	ItemData	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}	HashAlg	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}	ItemSize	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc}	SaferFlags	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	DefaultLevel	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	PolicyScope	success or wait	1	4AD031C5	CreateProcessW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	Cache	buffer overflow	1	4AD031C5	CreateProcessW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders	Cache	success or wait	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	LogFileName	object name not found	1	4AD031C5	CreateProcessW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared	CUAS	success or wait	1	7C817077	unknown
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	7C817077	unknown
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	7C817077	unknown
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	7C817077	unknown
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	7C817077	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF	EnableAnchorContext	object name not found	1	7C817077	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer	MaximizeApps	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer	MaximizeApps	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc	MaxRpcSize	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoNetHood	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoNetHood	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoPropertiesMyComputer	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoPropertiesMyComputer	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoInternetIcon	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoInternetIcon	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoCommonGroups	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoCommonGroups	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoControlPanel	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoControlPanel	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoSetFolders	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoSetFolders	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	AllowFileCLSIDJunctions	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	AllowFileCLSIDJunctions	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc	Progid	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc	Application	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	DontShowSuperHidden	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	DontShowSuperHidden	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer	ShellState	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer	ShellState	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	ForceActiveDesktopOn	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	ForceActiveDesktopOn	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoActiveDesktop	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoActiveDesktop	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoWebView	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoWebView	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	ClassicShell	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	ClassicShell	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	SeparateProcess	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	SeparateProcess	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoNetCrawling	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoNetCrawling	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoSimpleStartMenu	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoSimpleStartMenu	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	Hidden	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	ShowCompColor	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	DontPrettyPath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	ShowInfoTip	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideIcons	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	MapNetDrvBtn	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	WebView	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	Filter	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	ShowSuperHidden	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	SeparateProcess	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	NoNetCrawling	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc	PerceivedType	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8	DocObject	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc	DocObject	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8	BrowseInPlace	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc	BrowseInPlace	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\CLSID	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8	IsShortcut	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc	IsShortcut	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8	AlwaysShowExt	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc	AlwaysShowExt	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8	NeverShowExt	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc	NeverShowExt	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Personal	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\WPA\PnP	seed	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\Setup	OsLoaderPath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\Setup	OsLoaderPath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemPartition	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemPartition	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	SourcePath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	SourcePath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackSourcePath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackSourcePath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackCachePath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackCachePath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	DriverCachePath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	DriverCachePath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	DevicePath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogLevel	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogLevel	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogPath	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Hostname	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Domain	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f}	Data	buffer overflow	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f}	Data	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f}	Generation	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Data	buffer overflow	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Data	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	DocObject	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	BrowseInPlace	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	IsShortcut	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	AlwaysShowExt	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	NeverShowExt	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	UseDesktopIniCache	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	UseDesktopIniCache	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Common Documents	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Desktop	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Common Desktop	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32	LoadWithoutCOM	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hlp	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hta	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.inf	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ins	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.isp	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.its	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.JSE	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mdb	NULL	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msc	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msi	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msp	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pif	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.prf	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.reg	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.scf	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.scr	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sct	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.shb	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.shs	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.url	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.VBE	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vbs	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wsc	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WSF	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WSH	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc	Progid	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc	Application	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8	EditFlags	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	ExecutableTypes	buffer too small	2	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	ExecutableTypes	success or wait	2	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc	Progid	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc	Application	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\command	NULL	success or wait	3	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\command	command	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt	{90110409-6000-11D3-8CFE-0150048383C9}	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer	Debug	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer	DisableUserInstalls	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	WORDFiles	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	WORDFiles	buffer overflow	2	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	WORDFiles	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A453DD12EE71CEF49A4EB2A8684FB83A	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5861C19D5F3D8C8439408F306F31034A	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\311714883E93F274A838DDB012991F9D	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72E940125B15C02498F17C8F91EADC14	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16EFE5D0815A2D11A92E0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41AE703BF87339947BDCC4715F97EFED	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProductFiles	buffer overflow	2	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProductFiles	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10	9040110900063D11C8EF10054038389C	buffer overflow	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA	9040110900063D11C8EF10054038389C	buffer overflow	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C	9040110900063D11C8EF10054038389C	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	WORDFiles	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\ddeexec	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\ddeexec	NoActivateHandler	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\ddeexec\Application	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\ddeexec\Topic	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe	UseShortName	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell	NULL	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open	FriendlyAppName	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\Winword.exe\shell	NULL	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\Winword.exe\shell\edit	FriendlyAppName	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	Flags	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	State	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	UserPreference	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	CentralProfile	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	ProfileImagePath	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	ProfileLoadTimeLow	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	ProfileLoadTimeHigh	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\ShellNoRoam\MUICache	LangID	success or wait	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\ShellNoRoam\MUICache	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	InheritConsoleHandles	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	InheritConsoleHandles	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	RestrictRun	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	RestrictRun	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	DisallowRun	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	DisallowRun	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe	AppendPath	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe	PATH	success or wait	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoRunasInstallPrompt	object name not found	1	4AD13114	ShellExecuteExW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoRunasInstallPrompt	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe	RunAsOnNonAdminInstall	object name not found	1	4AD13114	ShellExecuteExW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	LogFileName	object name not found	1	4AD13114	ShellExecuteExW

Mutex Activites

Name	Completion	Count	Source Address	Symbol
\BaseNamedObjects\SHIMLIB_LOG_MUTEX	object name exists	1	7C90E457	KiUserApcDispatcher
\BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	7C817077	unknown
\BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	7C817077	unknown
\BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	7C817077	unknown
\BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	7C817077	unknown
\BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	7C817077	unknown
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500MUTEX.DefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	7C817077	unknown
unknown	success or wait	3	4AD13114	ShellExecuteExW

Process Activites

Process Created

PID	Filepath	Cmdline	Flags	Completion	Count	Source Address	Symbol
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE /n /dde	none	success or wait	1	4AD13114	ShellExecuteExW

PID	Process info class	Completion	Count	Source Address	Symbol
1096	Cookie	success or wait	5	7C90E457	KiUserApcDispatcher
1096	Wow64Information	success or wait	7	7C90E457	KiUserApcDispatcher
1096	ImageInformation	success or wait	1	7C90E457	KiUserApcDispatcher
1096	SessionInformation	success or wait	1	7C90E457	KiUserApcDispatcher
1096	DefaultHardErrorMode	success or wait	74	4AD01AF9	SetErrorMode
1096	DeviceMap	success or wait	21	4AD02A92	GetDriveTypeW
1096	QuotaLimits	success or wait	2	4AD13114	ShellExecuteExW
1096	VmCounters	success or wait	2	4AD13114	ShellExecuteExW
900	BasicInformation	success or wait	2	4AD13114	ShellExecuteExW
900	BasicInformation	success or wait	1	4AD13114	ShellExecuteExW

Thread Activites

TID	PID	EIP	EAX (Usermode EIP)	Filepath	Completion	Count	Source Address	Symbol
1492	900	7C810705	300019F0	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	4AD13114	ShellExecuteExW

TID	PID	Path	Completion	Count	Source Address	Symbol
1492	900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	4AD13114	ShellExecuteExW

Memory Activites

PID	Filepath	Base	Length	Value	Completion	Count	Source Address	Symbol
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7FFDE008	4	00 00 00 30	success or wait	1	4AD13114	ShellExecuteExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30000000	4096	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 01 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 8D A8 32 9F C9 C9 5C CC C9 C9 5C CC C9 C9 5C CC 21 D6 58 CC CB C9 5C CC 21 D6 57 CC C8 C9 5C CC 4A D5 52 CC CC C9 5C CC CC C5 53 CC CD C9 5C CC CC C5 03 CC CD C9 5C CC C9 C9 5C CC C8 C9 5C CC DA C1 03 CC C3 C9 5C CC 47 C1 03 CC C8 C9 5C CC 33 EA 45 CC CB C9 5C CC FA EB 79 CC CB C9 5C CC 3A CE 01 CC CB C9 5C CC 21 D6 56 CC C0 C9 5C CC 13 EA 40 CC CB C9 5C CC DA C1 01 CC C0 C9 5C	success or wait	1	4AD13114	ShellExecuteExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30B82000	256	00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 01 00 00 00 48 00 00 80 03 00 00 00 08 03 00 80 0C 00 00 00 10 07 00 80 0E 00 00 00 D0 09 00 80 10 00 00 00 68 0A 00 80 18 00 00 00 80 0A 00 80 E6 03 00 00 98 0A 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 00 80 00 00 00 E0 0A 00 80 81 00 00 00 F8 0A 00 80 82 00 00 00 10 0B 00 80 83 00 00 00 28 0B 00 80 84 00 00 00 40 0B 00 80 85 00 00 00 58 0B 00 80 86 00 00 00 70 0B 00 80 87 00 00 00 88 0B 00 80 88 00 00 00 A0 0B 00 80 89 00 00 00 B8 0B 00 80 8A 00 00 00 D0 0B 00 80 8B 00 00 00 E8 0B 00 80 8C 00 00 00 00 0C 00 80 8D 00 00 00 18 0C 00 80 8E 00 00 00 30 0C 00 80 8F 00 00 00 48 0C 00 80 90 00 00 00 60 0C 00 80 91 00 00 00 78 0C 00 80 92 00 00 00 90 0C 00 80 93 00 00 00 A8 0C 00 80 94 00 00 00 C0 0C 00	success or wait	1	4AD13114	ShellExecuteExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30B82A80	24	00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 98 28 00 80	success or wait	1	4AD13114	ShellExecuteExW

PID	Filepath	Base	Length	Value	Completion	Count	Source Address	Symbol
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	10000	2296	3D 00 3A 00 3A 00 3D 00 3A 00 3A 00 5C 00 00 00 3D 00 43 00 3A 00 3D 00 43 00 3A 00 5C 00 44 00 4F 00 43 00 55 00 4D 00 45 00 7E 00 31 00 5C 00 41 00 44 00 4D 00 49 00 4E 00 49 00 7E 00 31 00 5C 00 4C 00 4F 00 43 00 41 00 4C 00 53 00 7E 00 31 00 00 00 3D 00 5A 00 3A 00 3D 00 5A 00 3A 00 5C 00 00 00 41 00 4C 00 4C 00 55 00 53 00 45 00 52 00 53 00 50 00 52 00 4F 00 46 00 49 00 4C 00 45 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 6C 00 6C 00 20 00 55 00 73 00 65 00 72 00 73 00 00 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53	success or wait	1	4AD13114	ShellExecuteExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	20000	2044	00 10 00 00 FC 07 00 00 00 00 00 00 00 00 00 00 02 00 31 00 00 00 00 00 03 00 00 00 07 00 00 00 0B 00 00 00 3A 00 08 02 90 02 00 00 00 00 00 00 DA 01 DC 01 98 04 00 00 6C 00 6E 00 74 06 00 00 82 00 84 00 E4 06 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 6C 00 6E 00 68 07 00 00 1E 00 20 00 D8 07 00 00 00 00 02 00 F8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	4AD13114	ShellExecuteExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7FFDE010	4	00 00 02 00	success or wait	1	4AD13114	ShellExecuteExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7FFDE1E8	4	00 00 00 00	success or wait	1	4AD13114	ShellExecuteExW

Memory Allocated

PID	Filepath	Base	Length	Protection	Completion	Count	Source Address	Symbol
1096	C:\WINDOWS\system32\cmd.exe	150000	13FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	150000	13FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	151000	13F7F4	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	250000	13FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	250000	13FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	260000	13F340	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	261000	13F168	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	153000	13F420	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	470000	13F0C8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	470000	13F0CC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	472000	13EB64	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	473000	13EEA8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	480000	13E978	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	480000	13E97C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	481000	13E658	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	483000	13E6FC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	4A0000	13F04C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	4A0000	13F050	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	4A1000	13ED2C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	30000	13F91C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	30000	13F920	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	31000	13F5FC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	33000	13F6B8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	154000	13F02C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	155000	13F718	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	8F0000	13F52C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	8F0000	13F528	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	156000	13F56C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	157000	13EF90	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	158000	13F188	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	159000	13EFB0	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	440000	13F1B8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	440000	13F1BC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	441000	13EE98	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	443000	13EF3C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	970000	13FE10	page read and write	success or wait	1	4AD04578	VirtualAlloc
1096	C:\WINDOWS\system32\cmd.exe	15A000	13BB90	page read and write	success or wait	1	7C817077	unknown
1096	C:\WINDOWS\system32\cmd.exe	15F000	13BB90	page read and write	success or wait	1	7C817077	unknown
1096	C:\WINDOWS\system32\cmd.exe	34000	13F7D0	page read and write	success or wait	1	4AD056A7	setlocale
1096	C:\WINDOWS\system32\cmd.exe	990000	13ED78	page read and write	success or wait	1	4AD031C5	CreateProcessW
1096	C:\WINDOWS\system32\cmd.exe	990000	13ED74	page read and write	success or wait	1	4AD031C5	CreateProcessW
1096	C:\WINDOWS\system32\cmd.exe	164000	13F81C	page read and write	success or wait	1	4AD13114	ShellExecuteExW
1096	C:\WINDOWS\system32\cmd.exe	16B000	13E658	page read and write	success or wait	1	4AD13114	ShellExecuteExW
1096	C:\WINDOWS\system32\cmd.exe	16C000	13EE64	page read and write	success or wait	1	4AD13114	ShellExecuteExW
1096	C:\WINDOWS\system32\cmd.exe	16D000	13E9F4	page read and write	success or wait	1	4AD13114	ShellExecuteExW
1096	C:\WINDOWS\system32\cmd.exe	9F0000	16D068	page read and write	success or wait	9	4AD13114	ShellExecuteExW
1096	C:\WINDOWS\system32\cmd.exe	9F0000	16D064	page read and write	success or wait	9	4AD13114	ShellExecuteExW
1096	C:\WINDOWS\system32\cmd.exe	16E000	13F688	page read and write	success or wait	1	4AD13114	ShellExecuteExW
1096	C:\WINDOWS\system32\cmd.exe	16F000	13EFC4	page read and write	success or wait	1	4AD13114	ShellExecuteExW
1096	C:\WINDOWS\system32\cmd.exe	170000	13F6B4	page read and write	success or wait	1	4AD13114	ShellExecuteExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	10000	13E2EC	page read and write	success or wait	1	4AD13114	ShellExecuteExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	20000	13E2EC	page read and write	success or wait	1	4AD13114	ShellExecuteExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30000	13E558	page read and write	success or wait	1	4AD13114	ShellExecuteExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	12E000	13E554	page read and write	success or wait	1	4AD13114	ShellExecuteExW

PID	Filepath	Base	Length	New Protection	Old Protection	Completion	Count	Source Address	Symbol
1096	C:\WINDOWS\system32\cmd.exe	7C801000	1000	page read and write	page execute read	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	7C801000	1000	page execute read	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	4AD01000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	4AD01000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77C11000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77C11000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77F11000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77F11000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	7E411000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	7E411000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	5CB71000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	5CB71000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	6F881000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	6F881000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77DD1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77DD1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77E71000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77E71000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77FE1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77FE1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	76B41000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	76B41000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	774E1000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	774E1000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77121000	1000	page read and write	page execute read	success or wait	6	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77121000	1000	page execute read	page read and write	success or wait	6	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77BE1000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77BE1000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77C01000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77C01000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	7C9C1000	2000	page read and write	page execute read	success or wait	8	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	7C9C1000	2000	page execute read	page read and write	success or wait	8	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77F61000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77F61000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	769C1000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	769C1000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	5AD71000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	5AD71000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	76391000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	76391000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	773D1000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	773D1000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	5D091000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	5D091000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
1096	C:\WINDOWS\system32\cmd.exe	77B41000	1000	page read and write	page execute read	success or wait	2	4AD031C5	CreateProcessW
1096	C:\WINDOWS\system32\cmd.exe	77B41000	1000	page execute read	page read and write	success or wait	2	4AD031C5	CreateProcessW
1096	C:\WINDOWS\system32\cmd.exe	74721000	1000	page read and write	page execute read	success or wait	5	7C817077	unknown
1096	C:\WINDOWS\system32\cmd.exe	74721000	1000	page execute read	page read and write	success or wait	5	7C817077	unknown
1096	C:\WINDOWS\system32\cmd.exe	5B861000	1000	page read and write	page execute read	success or wait	5	4AD13114	ShellExecuteExW
1096	C:\WINDOWS\system32\cmd.exe	5B861000	1000	page execute read	page read and write	success or wait	5	4AD13114	ShellExecuteExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	12E000	1000	page read and write and page guard	page read and write	success or wait	1	4AD13114	ShellExecuteExW

Memory Usage Statistics

Time	Private Usage (mb)	Workingset (mb)	Page File Usage (mb)
15:20:21	1	3	1
15:20:23	1	3	1
15:20:24	2	4	2
15:20:42	2	4	2
15:20:43	2	4	2
15:20:44	2	4	2

System Activites

System info class	Completion	Count	Source Address	Symbol
BasicInformation	success or wait	19	7C90E457	KiUserApcDispatcher
RangeStartInformation	success or wait	1	7C90E457	KiUserApcDispatcher
ProcessorInformation	success or wait	6	7C90E457	KiUserApcDispatcher
PerformanceInformation	success or wait	2	4AD13114	ShellExecuteExW
WatchdogTimerHandler	success or wait	1	4AD13114	ShellExecuteExW

Timing Activites

Time	Completion	Count	Source Address	Symbol
129876420231718750	success or wait	1	4AD13114	ShellExecuteExW

Windows UI Activites

Window name	Class name	HWND	Completion	Count	Source Address	Symbol
IPTR	IPTR	40154	success	1	7C817077	unknown
WorkerW	WorkerW	A014E	success	1	4AD13114	ShellExecuteExW
WorkerW	WorkerW	A013E	success	1	4AD13114	ShellExecuteExW

HWND	Completion	Count	Source Address	Symbol
A014E	success	1	4AD13114	ShellExecuteExW
A013E	success	1	4AD13114	ShellExecuteExW
40154	success	1	4AD13114	ShellExecuteExW

Window UIs Enumerated

Enum Childrens	TID	Window Handles	Completion	Count	Source Address	Symbol
false	1A8	A014E, 1, 530049, 520054, 5C0059, 530055, 520045, 53005C, 31002D, 35002D, 32002D, 2D0031, 300035, 390037, 310032	success or wait	2	4AD13114	ShellExecuteExW
false	1A8	A013E, 1, 530049, 520054, 5C0059, 530055, 520045, 53005C, 31002D, 35002D, 32002D, 2D0031, 300035, 390037, 310032	success or wait	2	4AD13114	ShellExecuteExW
false	1A8	1, 1, 530049, 520054, 5C0059, 530055, 520045, 53005C, 31002D, 35002D, 32002D, 2D0031, 300035, 390037, 310032	success or wait	2	4AD13114	ShellExecuteExW

HWND	Completion	Count	Source Address	Symbol
1008C	success	1	4AD13114	ShellExecuteExW

HWND	Message	LParam	WParam	Completion	Count	Source Address	Symbol
600F8	DDE_EXECUTE	655678	9371660	success	1	4AD13114	ShellExecuteExW
600F8	DDE_TERMINATE	655678	0	success	1	4AD13114	ShellExecuteExW
40154	NCCREATE	0	1307800	success	1	7C817077	unknown
40154	NCCALCSIZE	0	1307840	error	1	7C817077	unknown
10014	DDE_FIRST	655694	3221864481	error	1	4AD13114	ShellExecuteExW
10014	DDE_FIRST	655678	3221864481	error	1	4AD13114	ShellExecuteExW

Module	Thread id	Hook code	Completion	Count	Source Address	Symbol
C:\WINDOWS\system32\MSCTF.dll	424	keyboard	success	1	7C817077	unknown
C:\WINDOWS\system32\MSCTF.dll	424	mouse	success	1	7C817077	unknown
C:\WINDOWS\system32\MSCTF.dll	424	keyboard	success	1	4AD13114	ShellExecuteExW
C:\WINDOWS\system32\MSCTF.dll	424	mouse	success	1	4AD13114	ShellExecuteExW
C:\WINDOWS\system32\MSCTF.dll	424	keyboard	success	1	4AD13114	ShellExecuteExW
C:\WINDOWS\system32\MSCTF.dll	424	mouse	success	1	4AD13114	ShellExecuteExW

Process Token Activites

Status	Privilege	Completion	Count	Source Address	Symbol
on	Load Driver	success or wait	2	4AD13114	ShellExecuteExW

Chronological Activities

Operation	Data	Completion	Time
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CWDIllegalInDLLSearch	object name not found	671803967
System info queried	Type: BasicInformation	success or wait	671805593
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 150000 Length: 13FB14 Allocation Type: unknown Protection: page read and write	success or wait	671805826
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 150000 Length: 13FB18 Allocation Type: unknown Protection: page read and write	success or wait	671806162
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 151000 Length: 13F7F4 Allocation Type: unknown Protection: page read and write	success or wait	671806744
System info queried	Type: BasicInformation	success or wait	671807125
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 250000 Length: 13FB14 Allocation Type: unknown Protection: page read and write	success or wait	671807324
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 250000 Length: 13FB18 Allocation Type: unknown Protection: page read and write	success or wait	671807521
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	671808468
File control set	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1 Control Code: 90028 Input Buffer:	success or wait	671809391
Section loaded	Path: \KnownDlls\kernel32.dll Access: write and read and execute Type: unknown Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	671810423
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C801000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	671811727
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C801000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	671813135
Process information queried	PID: 1096 Info Class: Cookie	success or wait	671814171
System info queried	Type: RangeStartInformation	success or wait	671814423
System info queried	Type: BasicInformation	success or wait	671814607
Section loaded	Path: unknown Access: query and write and read and execute and extend size Type: reserve Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	671814855
System info queried	Type: BasicInformation	success or wait	671815880
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 260000 Length: 13F340 Allocation Type: unknown Protection: page read and write	success or wait	671816343
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	671817563
Section loaded	Path: \NLS\NlsSectionUnicode Access: read Type: unknown Baseaddress: 270000 Size: 90112 Protection: readonly Mapped to pid: own pid	success or wait	671818601
Section loaded	Path: \NLS\NlsSectionLocale Access: read Type: unknown Baseaddress: 290000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	671819979
Section loaded	Path: \NLS\NlsSectionSortkey Access: query and read Type: unknown Baseaddress: 2E0000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	671821032
Section loaded	Path: \NLS\NlsSectionSortTbls Access: read Type: unknown Baseaddress: 330000 Size: 24576 Protection: readonly Mapped to pid: own pid	success or wait	671821732
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	671823257
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	671823502
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 261000 Length: 13F168 Allocation Type: unknown Protection: page read and write	success or wait	671823719
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 4AD01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672110909
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 4AD01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672111712
Section loaded	Path: \KnownDlls\msvcrt.dll Access: write and read and execute Type: unknown Baseaddress: 77C10000 Size: 360448 Protection: read write Mapped to pid: own pid	success or wait	672113756
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672117755
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672118973
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672119229
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672119826
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 4AD01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672120062
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 4AD01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672120590
Section loaded	Path: \KnownDlls\USER32.dll Access: write and read and execute Type: unknown Baseaddress: 7E410000 Size: 593920 Protection: read write Mapped to pid: own pid	success or wait	672121635
Section loaded	Path: \KnownDlls\GDI32.dll Access: write and read and execute Type: unknown Baseaddress: 77F10000 Size: 299008 Protection: read write Mapped to pid: own pid	success or wait	672123288
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672126168
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672126720
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672126985
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672127261
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672127520
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672128181
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672128489
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672129355
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672129604
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672129894
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672130139
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672130500
Section loaded	Path: \KnownDlls\ShimEng.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	672130947
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 153000 Length: 13F420 Allocation Type: unknown Protection: page read and write	success or wait	672131163
File opened	Path: C:\WINDOWS\system32\ShimEng.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672131785
Section loaded	Path: C:\WINDOWS\system32\shimeng.dll Access: query and write and read and execute Type: image Baseaddress: 5CB70000 Size: 155648 Protection: read write Mapped to pid: own pid	success or wait	672133100
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: TransparentEnabled	success or wait	672133676
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5CB71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672135943
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5CB71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672136485
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5CB71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672136730
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5CB71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672136970
File opened	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	672138092
Section loaded	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read Type: commit Baseaddress: 340000 Size: 1208320 Protection: readonly Mapped to pid: own pid	success or wait	672138855
File opened	Path: C:\WINDOWS\AppPatch\systest.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	object name not found	672139978
System info queried	Type: ProcessorInformation	success or wait	672140621
Process information queried	PID: 1096 Info Class: Wow64Information	success or wait	672140816
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter Name: Installed	success or wait	672141135
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	672141733
Process information queried	PID: 1096 Info Class: Wow64Information	success or wait	672142352
System info queried	Type: BasicInformation	success or wait	672142537
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 470000 Length: 13F0C8 Allocation Type: unknown Protection: page read and write	success or wait	672142747
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 470000 Length: 13F0CC Allocation Type: unknown Protection: page read and write	success or wait	672142957
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	672143661
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 472000 Length: 13EB64 Allocation Type: unknown Protection: page read and write	success or wait	672144314
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 473000 Length: 13EEA8 Allocation Type: unknown Protection: page read and write	success or wait	672145866
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	672146557
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672147901
Section loaded	Path: C:\WINDOWS\AppPatch\acgenral.dll Access: write and read and execute Type: commit Baseaddress: 480000 Size: 1855488 Protection: execute Mapped to pid: own pid	success or wait	672148646
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672150517
Section loaded	Path: C:\WINDOWS\AppPatch\acgenral.dll Access: write and read and execute Type: commit Baseaddress: 480000 Size: 1855488 Protection: execute Mapped to pid: own pid	success or wait	672151260
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672152802
Section loaded	Path: C:\WINDOWS\AppPatch\acgenral.dll Access: query and write and read and execute Type: image Baseaddress: 6F880000 Size: 1875968 Protection: read write Mapped to pid: own pid	success or wait	672153544
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672155144
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672155666
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672155989
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672156303
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672156558
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672156804
Section loaded	Path: \KnownDlls\ADVAPI32.dll Access: write and read and execute Type: unknown Baseaddress: 77DD0000 Size: 634880 Protection: read write Mapped to pid: own pid	success or wait	672157091
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672158478
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672159053
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672159319
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672159779
Section loaded	Path: \KnownDlls\RPCRT4.dll Access: write and read and execute Type: unknown Baseaddress: 77E70000 Size: 602112 Protection: read write Mapped to pid: own pid	success or wait	672160075
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672161526
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672162350
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672162630
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672163009
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672163284
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672163575
Section loaded	Path: \KnownDlls\Secur32.dll Access: write and read and execute Type: unknown Baseaddress: 77FE0000 Size: 69632 Protection: read write Mapped to pid: own pid	success or wait	672163888
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672165710
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672166205
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672166497
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672166799
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672167090
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672167458
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672167730
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672168000
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672168258
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672168786
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672169029
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672169281
Section loaded	Path: \KnownDlls\WINMM.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	672169566
File opened	Path: C:\WINDOWS\system32\WINMM.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672169991
Section loaded	Path: C:\WINDOWS\system32\winmm.dll Access: query and write and read and execute Type: image Baseaddress: 76B40000 Size: 184320 Protection: read write Mapped to pid: own pid	success or wait	672170771
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672174619
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672175219
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672176047
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672176308
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672176576
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672176890
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672177149
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672177436
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672177702
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672177959
Section loaded	Path: \KnownDlls\ole32.dll Access: write and read and execute Type: unknown Baseaddress: 774E0000 Size: 1302528 Protection: read write Mapped to pid: own pid	success or wait	672178248
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672179727
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672180270
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672180533
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672180807
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672181068
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672181451
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672181712
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672181974
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672182234
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672182500
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672182760
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672183129
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672183389
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672183773
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672184018
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672184458
Section loaded	Path: \KnownDlls\OLEAUT32.dll Access: write and read and execute Type: unknown Baseaddress: 77120000 Size: 569344 Protection: read write Mapped to pid: own pid	success or wait	672184740
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672186092
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672186687
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672186952
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672187220
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672187482
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672187855
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672188114
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672188383
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672188645
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672188921
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672189184
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672189437
Section loaded	Path: \KnownDlls\MSACM32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	672189724
File opened	Path: C:\WINDOWS\system32\MSACM32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672190184
Section loaded	Path: C:\WINDOWS\system32\msacm32.dll Access: query and write and read and execute Type: image Baseaddress: 77BE0000 Size: 86016 Protection: read write Mapped to pid: own pid	success or wait	672190951
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672192825
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672193358
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672193624
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672193881
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672194146
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672194433
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672194695
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672194951
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672195211
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672195464
Section loaded	Path: \KnownDlls\VERSION.dll Access: write and read and execute Type: unknown Baseaddress: 77C00000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	672195753
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672197072
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672197618
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672197884
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672198150
Section loaded	Path: \KnownDlls\SHELL32.dll Access: write and read and execute Type: unknown Baseaddress: 7C9C0000 Size: 8482816 Protection: read write Mapped to pid: own pid	success or wait	672198436
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	672199965
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	672200573
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	672200841
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	672201242
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	672201507
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	672202030
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	672202290
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	672202672
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	672202940
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	672203327
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	672203587
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	672203966
Section loaded	Path: \KnownDlls\SHLWAPI.dll Access: write and read and execute Type: unknown Baseaddress: 77F60000 Size: 483328 Protection: read write Mapped to pid: own pid	success or wait	672204264
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672205718
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672206263
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672206542
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672206824
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672207101
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672207498
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672207774
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672208048
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672208323
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672208712
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	672208969
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	672209678
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	672209938
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	672210590
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672210855
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672211295
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672211546
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672211788
Section loaded	Path: \KnownDlls\USERENV.dll Access: write and read and execute Type: unknown Baseaddress: 769C0000 Size: 737280 Protection: read write Mapped to pid: own pid	success or wait	672212071
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672213433
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672214091
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672214359
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672214666
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672214927
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672215191
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672215455
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672215800
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672216060
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672216323
Section loaded	Path: \KnownDlls\UxTheme.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	672216611
File opened	Path: C:\WINDOWS\system32\UxTheme.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672217030
Section loaded	Path: C:\WINDOWS\system32\uxtheme.dll Access: query and write and read and execute Type: image Baseaddress: 5AD70000 Size: 229376 Protection: read write Mapped to pid: own pid	success or wait	672217791
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672220209
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672220737
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672221026
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672221366
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672221632
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672221930
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672222192
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672222452
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672222714
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672222973
System info queried	Type: BasicInformation	success or wait	672224056
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 480000 Length: 13E978 Allocation Type: unknown Protection: page read and write	success or wait	672224294
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 480000 Length: 13E97C Allocation Type: unknown Protection: page read and write	success or wait	672224527
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 481000 Length: 13E658 Allocation Type: unknown Protection: page read and write	success or wait	672224950
Section loaded	Path: \NLS\NlsSectionCType Access: read Type: unknown Baseaddress: 490000 Size: 12288 Protection: readonly Mapped to pid: own pid	success or wait	672226612
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 483000 Length: 13E6FC Allocation Type: unknown Protection: page read and write	success or wait	672229484
Process information queried	PID: 1096 Info Class: Cookie	success or wait	672230169
Process information queried	PID: 1096 Info Class: Cookie	success or wait	672232146
Mutant created	Name: \BaseNamedObjects\SHIMLIB_LOG_MUTEX	object name exists	672232578
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	672234516
System info queried	Type: BasicInformation	success or wait	672235053
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 4A0000 Length: 13F04C Allocation Type: unknown Protection: page read and write	success or wait	672235284
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 4A0000 Length: 13F050 Allocation Type: unknown Protection: page read and write	success or wait	672235633
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 4A1000 Length: 13ED2C Allocation Type: unknown Protection: page read and write	success or wait	672236114
System info queried	Type: BasicInformation	success or wait	672236874
System info queried	Type: ProcessorInformation	success or wait	672237085
Process information queried	PID: 1096 Info Class: ImageInformation	success or wait	672238146
System info queried	Type: BasicInformation	success or wait	672241764
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 30000 Length: 13F91C Allocation Type: unknown Protection: page read and write	success or wait	672241978
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 30000 Length: 13F920 Allocation Type: unknown Protection: page read and write	success or wait	672242189
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 31000 Length: 13F5FC Allocation Type: unknown Protection: page read and write	success or wait	672242587
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 33000 Length: 13F6B8 Allocation Type: unknown Protection: page read and write	success or wait	672244594
Process information queried	PID: 1096 Info Class: Cookie	success or wait	672245780
Process information queried	PID: 1096 Info Class: Cookie	success or wait	672245964
System info queried	Type: BasicInformation	success or wait	672246341
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: SafeDllSearchMode	object name not found	672247406
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672248122
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 410000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	672248879
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672250719
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 410000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	672251464
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672252897
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: query and write and read and execute Type: image Baseaddress: 76390000 Size: 118784 Protection: read write Mapped to pid: own pid	success or wait	672253644
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672255201
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672255724
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672255989
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672256314
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672256573
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672256859
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672257121
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672257387
System info queried	Type: BasicInformation	success or wait	672257945
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize Name: DisableMetaFiles	object name not found	672258846
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 154000 Length: 13F02C Allocation Type: unknown Protection: page read and write	success or wait	672261908
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Name: AppInit_DLLs	success or wait	672263378
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: LeakTrack	object name not found	672264500
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 155000 Length: 13F718 Allocation Type: unknown Protection: page read and write	success or wait	672265555
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave	success or wait	672266135
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 8F0000 Length: 13F52C Allocation Type: unknown Protection: page read and write	success or wait	672266692
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 8F0000 Length: 13F528 Allocation Type: unknown Protection: page read and write	success or wait	672266920
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave	success or wait	672267424
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave1	success or wait	672268352
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave1	success or wait	672268926
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave2	object name not found	672269492
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave3	object name not found	672270043
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave4	object name not found	672270590
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave5	object name not found	672271137
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave6	object name not found	672271624
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave7	object name not found	672272170
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave8	object name not found	672272717
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave9	object name not found	672273260
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi	success or wait	672273806
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi	success or wait	672274369
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi1	success or wait	672274916
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi1	success or wait	672275477
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi2	object name not found	672276062
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi3	object name not found	672276609
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi4	object name not found	672277156
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi5	object name not found	672277704
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi6	object name not found	672278251
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi7	object name not found	672278798
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi8	object name not found	672279345
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi9	object name not found	672279890
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux	success or wait	672280443
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux	success or wait	672281001
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux1	success or wait	672281549
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux1	success or wait	672282109
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux2	object name not found	672282672
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux3	object name not found	672283218
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux4	object name not found	672285653
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux5	object name not found	672286208
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux6	object name not found	672286755
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux7	object name not found	672287311
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux8	object name not found	672287855
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux9	object name not found	672288426
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaProperties\PrivateProperties\Joystick\Winmm Name: wheel	success or wait	672289144
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer	success or wait	672289680
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer	success or wait	672290297
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer1	success or wait	672290855
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer1	success or wait	672291427
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer2	object name not found	672291988
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer3	object name not found	672292550
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer4	object name not found	672293104
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer5	object name not found	672293669
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer6	object name not found	672294224
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer7	object name not found	672294775
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer8	object name not found	672295333
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer9	object name not found	672295878
File opened	Path: \Device\KsecDD Access: read data or list directory and synchronize Options: synchronous io alert Overwritten: false	success or wait	672296766
System info queried	Type: BasicInformation	success or wait	672299711
System info queried	Type: ProcessorInformation	success or wait	672299915
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CriticalSectionTimeout	success or wait	672300296
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: RWLockResourceTimeOut	object name not found	672300881
System info queried	Type: BasicInformation	success or wait	672301390
System info queried	Type: ProcessorInformation	success or wait	672301602
System info queried	Type: BasicInformation	success or wait	672301796
System info queried	Type: ProcessorInformation	success or wait	672302005
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAll	object name not found	672302302
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAllForOle32	object name not found	672302520
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableTypeLib	object name not found	672302737
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAll	object name not found	672303207
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAllForOle32	object name not found	672303422
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 156000 Length: 13F56C Allocation Type: unknown Protection: page read and write	success or wait	672303861
Key value queried	Path: HKEY_USERS\Software\Microsoft\Multimedia\Audio Name: SystemFormats	success or wait	672305959
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.imaadpcm	buffer overflow	672307570
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.imaadpcm	success or wait	672307810
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 157000 Length: 13EF90 Allocation Type: unknown Protection: page read and write	success or wait	672308236
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: fdwSupport	success or wait	672308837
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: cFormatTags	success or wait	672309174
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: aFormatTagCache	success or wait	672309513
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: cFilterTags	success or wait	672309849
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msadpcm	buffer overflow	672310596
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msadpcm	success or wait	672310833
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: fdwSupport	success or wait	672311409
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: cFormatTags	success or wait	672311748
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: aFormatTagCache	success or wait	672312083
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: cFilterTags	success or wait	672312416
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg711	buffer overflow	672313160
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg711	success or wait	672313394
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: fdwSupport	success or wait	672313951
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: cFormatTags	success or wait	672314289
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: aFormatTagCache	success or wait	672314624
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: cFilterTags	success or wait	672314955
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msgsm610	buffer overflow	672315693
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msgsm610	success or wait	672315928
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: fdwSupport	success or wait	672316484
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: cFormatTags	success or wait	672316822
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: aFormatTagCache	success or wait	672317158
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: cFilterTags	success or wait	672317494
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.trspch	buffer overflow	672318230
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.trspch	success or wait	672318464
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: fdwSupport	success or wait	672319053
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: cFormatTags	success or wait	672319390
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: aFormatTagCache	success or wait	672319726
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: cFilterTags	success or wait	672320057
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg723	buffer overflow	672320796
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg723	success or wait	672321034
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: fdwSupport	success or wait	672321604
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: cFormatTags	success or wait	672321942
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: aFormatTagCache	success or wait	672322279
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: cFilterTags	success or wait	672322614
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msaudio1	buffer overflow	672323353
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msaudio1	success or wait	672323591
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: fdwSupport	success or wait	672324155
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: cFormatTags	success or wait	672324490
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: aFormatTagCache	success or wait	672324827
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: cFilterTags	success or wait	672325158
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.sl_anet	buffer overflow	672325897
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.sl_anet	success or wait	672326138
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: fdwSupport	success or wait	672326703
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: cFormatTags	success or wait	672327038
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: aFormatTagCache	success or wait	672327376
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: cFilterTags	success or wait	672327710
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 158000 Length: 13F188 Allocation Type: unknown Protection: page read and write	success or wait	672328405
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.iac2	buffer overflow	672328858
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.iac2	success or wait	672329100
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: fdwSupport	success or wait	672329689
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: cFormatTags	success or wait	672330026
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: aFormatTagCache	success or wait	672330363
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: cFilterTags	success or wait	672330694
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.l3acm	buffer overflow	672331432
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.l3acm	success or wait	672331671
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: fdwSupport	success or wait	672332258
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: cFormatTags	success or wait	672332594
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: aFormatTagCache	success or wait	672332988
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: cFilterTags	success or wait	672333329
Key value queried	Path: HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM Name: NoPCMConverter	object name not found	672335559
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 159000 Length: 13EFB0 Allocation Type: unknown Protection: page read and write	success or wait	672336083
Key value queried	Path: HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00 Name: Priority1	object name not found	672338215
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	672342037
File opened	Path: C:\WINDOWS\system32\SHELL32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672343415
Section loaded	Path: C:\WINDOWS\system32\shell32.dll Access: read Type: commit Baseaddress: 970000 Size: 8462336 Protection: readonly Mapped to pid: own pid	success or wait	672344196
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	672345021
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	672346131
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	672390382
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672391390
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: write and read and execute Type: commit Baseaddress: 970000 Size: 1056768 Protection: execute Mapped to pid: own pid	success or wait	672392401
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672394203
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: query and write and read and execute Type: image Baseaddress: 773D0000 Size: 1060864 Protection: read write Mapped to pid: own pid	success or wait	672395156
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672398315
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672398788
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672399067
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672399336
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672399612
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672399951
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672400289
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672400586
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672400859
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672401178
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672401451
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672401717
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672401986
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672402314
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672404053
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: write and read and execute Type: commit Baseaddress: 440000 Size: 4096 Protection: execute Mapped to pid: own pid	success or wait	672404927
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	672406955
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: query and read Type: commit Baseaddress: 440000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	672407787
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672409292
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: read Type: commit Baseaddress: 440000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	672410100
File opened	Path: C:\WINDOWS\WindowsShell.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	672410895
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	672443966
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: EnableBalloonTips	object name not found	672444975
Section loaded	Path: \KnownDlls\comctl32.dll Access: write and read and execute Type: unknown Baseaddress: 5D090000 Size: 630784 Protection: read write Mapped to pid: own pid	success or wait	672448547
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672450051
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672450587
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672450860
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672451086
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672453319
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672453635
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672453902
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672454160
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	672454426
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	672454802
System info queried	Type: BasicInformation	success or wait	672455705
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 440000 Length: 13F1B8 Allocation Type: unknown Protection: page read and write	success or wait	672455960
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 440000 Length: 13F1BC Allocation Type: unknown Protection: page read and write	success or wait	672456211
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 441000 Length: 13EE98 Allocation Type: unknown Protection: page read and write	success or wait	672456661
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 443000 Length: 13EF3C Allocation Type: unknown Protection: page read and write	success or wait	672457979
File opened	Path: C:\WINDOWS\system32\comctl32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672459331
Section loaded	Path: C:\WINDOWS\system32\comctl32.dll Access: read Type: commit Baseaddress: 970000 Size: 618496 Protection: readonly Mapped to pid: own pid	success or wait	672460151
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	672461066
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	672462132
Process information queried	PID: 1096 Info Class: SessionInformation	success or wait	672469169
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	672470257
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	672472995
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: ChkAccDebugLevel	object name not found	672473617
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions Name: ProductType	success or wait	672474246
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Personal	success or wait	672475333
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Local Settings	success or wait	672476206
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: RsopDebugLevel	object name not found	672477010
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	672477606
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: RsopLogging	object name not found	672477941
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: UserEnvDebugLevel	object name not found	672478597
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: RsopLogging	object name not found	672478926
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	672479516
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: UserEnvDebugLevel	object name not found	672480116
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\ThemeManager Name: Compositing	object name not found	672481154
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: LameButtonText	object name not found	672482236
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: DisableUNCCheck	object name not found	672486663
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: EnableExtensions	success or wait	672487001
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: DelayedExpansion	object name not found	672487329
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: DefaultColor	success or wait	672487657
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: CompletionChar	success or wait	672487978
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: PathCompletionChar	success or wait	672488298
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: AutoRun	success or wait	672488618
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: DisableUNCCheck	object name not found	672489273
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: EnableExtensions	success or wait	672489600
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: DelayedExpansion	object name not found	672489922
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: DefaultColor	success or wait	672490296
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: CompletionChar	success or wait	672490617
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: PathCompletionChar	object name not found	672490938
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: AutoRun	object name not found	672491255
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	672492369
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	672493676
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	672494913
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 970000 Length: 13FE10 Allocation Type: unknown Protection: page read and write	success or wait	672496356
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 15A000 Length: 13BB90 Allocation Type: unknown Protection: page read and write	success or wait	672496807
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 15F000 Length: 13BB90 Allocation Type: unknown Protection: page read and write	success or wait	672497380
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	672498328
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	672498537
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	672498747
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	672499010
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	672499364
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 00000409	success or wait	672502079
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	672502667
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 34000 Length: 13F7D0 Allocation Type: unknown Protection: page read and write	success or wait	672503392
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	672504761
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	672504978
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	672505191
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	672505457
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	672505770
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc Access: read data or list directory and execute or traverse and read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672509730
Section loaded	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc Access: query and write and read and execute and extend size Type: image Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	invalid image not mz	672510537
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility Name: DisableAppCompat	object name not found	672838362
Section loaded	Path: \BaseNamedObjects\ShimSharedMemory Access: write Type: unknown Baseaddress: 980000 Size: 57344 Protection: read write Mapped to pid: own pid	success or wait	672846513
File opened	Path: C:\WINDOWS\system32\Apphelp.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	672848221
Section loaded	Path: C:\WINDOWS\system32\apphelp.dll Access: write and read and execute Type: commit Baseaddress: 990000 Size: 126976 Protection: execute Mapped to pid: own pid	success or wait	672850580
File opened	Path: C:\WINDOWS\system32\Apphelp.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	679596524
Section loaded	Path: C:\WINDOWS\system32\apphelp.dll Access: query and write and read and execute Type: image Baseaddress: 77B40000 Size: 139264 Protection: read write Mapped to pid: own pid	success or wait	679597412
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679710985
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679712268
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679712549
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 77B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679712984
File opened	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	679724179
Section loaded	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read Type: commit Baseaddress: 990000 Size: 1208320 Protection: readonly Mapped to pid: own pid	success or wait	679724993
File opened	Path: C:\WINDOWS\AppPatch\systest.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	object name not found	679730488
System info queried	Type: ProcessorInformation	success or wait	679731106
Process information queried	PID: 1096 Info Class: Wow64Information	success or wait	679731326
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter Name: Installed	success or wait	679731680
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	679745018
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	679745500
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	679746865
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679747317
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679755788
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679757544
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	679762846
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	679764200
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	679764437
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	679770452
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679770905
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679772198
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679773693
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	679779892
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	679781204
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: TransparentEnabled	success or wait	679785697
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: AuthenticodeEnabled	success or wait	679785996
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: Levels	object name not found	679787121
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} Name: ItemData	success or wait	679791598
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Paths\{dda3f824-d8cb-441b-834d-be2efd2c1a33} Name: SaferFlags	success or wait	679792066
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} Name: ItemData	success or wait	679793359
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} Name: HashAlg	success or wait	679797113
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} Name: ItemSize	success or wait	679797526
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{349d35ab-37b5-462f-9b89-edd5fbde1328} Name: SaferFlags	success or wait	679797939
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} Name: ItemData	success or wait	679798739
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} Name: HashAlg	success or wait	679799248
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} Name: ItemSize	success or wait	679802326
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{7fb9cd2e-3076-4df9-a57b-b813f72dbb91} Name: SaferFlags	success or wait	679802747
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} Name: ItemData	success or wait	679804388
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} Name: HashAlg	success or wait	679804808
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} Name: ItemSize	success or wait	679805993
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{81d1fe15-dd9d-4762-b16d-7c29ddecae3f} Name: SaferFlags	success or wait	679806452
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} Name: ItemData	success or wait	679807342
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} Name: HashAlg	success or wait	679807761
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} Name: ItemSize	success or wait	679808175
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{94e3e076-8f53-42a5-8411-085bcc18a68d} Name: SaferFlags	success or wait	679809181
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} Name: ItemData	success or wait	679812606
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} Name: HashAlg	success or wait	679813304
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} Name: ItemSize	success or wait	679815556
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\0\Hashes\{dc971ee5-44eb-4fe4-ae2e-b91490411bfc} Name: SaferFlags	success or wait	679815973
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: DefaultLevel	success or wait	679828091
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: PolicyScope	success or wait	679833280
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	679838731
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679839174
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679840439
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	679843999
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	679849066
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	679850364
Section loaded	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc Access: query and read Type: commit Baseaddress: 990000 Size: 24576 Protection: readonly Mapped to pid: own pid	success or wait	679850667
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cache	buffer overflow	679855097
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cache	success or wait	679855463
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 990000 Length: 13ED78 Allocation Type: unknown Protection: page read and write	success or wait	679856107
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 990000 Length: 13ED74 Allocation Type: unknown Protection: page read and write	success or wait	679860475
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: LogFileName	object name not found	679861001
File opened	Path: C:\WINDOWS\system32\rpcss.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	679873480
Section loaded	Path: C:\WINDOWS\system32\rpcss.dll Access: write and read and execute Type: commit Baseaddress: 9A0000 Size: 401408 Protection: execute Mapped to pid: own pid	success or wait	679874255
System info queried	Type: BasicInformation	success or wait	679880415
System info queried	Type: BasicInformation	success or wait	679880635
System info queried	Type: BasicInformation	success or wait	679880868
Window created	Window Name: IPTR Class Name: IPTR HWND: 40154	success	679929329
File opened	Path: C:\WINDOWS\system32\MSCTF.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	679932196
Section loaded	Path: C:\WINDOWS\system32\msctf.dll Access: write and read and execute Type: commit Baseaddress: 9A0000 Size: 299008 Protection: execute Mapped to pid: own pid	success or wait	679932985
File opened	Path: C:\WINDOWS\system32\MSCTF.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	679937223
Section loaded	Path: C:\WINDOWS\system32\msctf.dll Access: query and write and read and execute Type: image Baseaddress: 74720000 Size: 311296 Protection: read write Mapped to pid: own pid	success or wait	679938035
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679939753
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679943572
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679943871
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679944185
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679944480
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679944894
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679948154
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679948456
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679948745
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679949033
Process information queried	PID: 1096 Info Class: Wow64Information	success or wait	679952184
Section loaded	Path: \BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read Type: commit Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name exists	679953662
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared Name: CUAS	success or wait	679958655
Mutant created	Name: \BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	679959442
Mutant created	Name: \BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	679959764
Mutant created	Name: \BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	679960076
Mutant created	Name: \BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	679960644
Mutant created	Name: \BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	679962648
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	679963103
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	679963576
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	679963972
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	679964368
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF Name: EnableAnchorContext	object name not found	679968155
Mutant created	Name: \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500MUTEX.DefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	679969110
Section loaded	Path: \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500SFM.DefaultS-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read and execute and extend size Type: unknown Baseaddress: 9B0000 Size: 262144 Protection: read write Mapped to pid: own pid	success or wait	679969461
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 424 Hook ID: keyboard	success	679974784
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 424 Hook ID: mouse	success	679975047
Message sent	HWND: 40154 Message: NCCREATE WParam: 0 LParam: 1307800	success	679975712
Message sent	HWND: 40154 Message: NCCALCSIZE WParam: 0 LParam: 1307840	error	679975973
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer Name: MaximizeApps	object name not found	679977071
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer Name: MaximizeApps	object name not found	679981605
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 164000 Length: 13F81C Allocation Type: unknown Protection: page read and write	success or wait	679982424
Section loaded	Path: \KnownDlls\netapi32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	679983474
File opened	Path: C:\WINDOWS\system32\netapi32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	679984165
Section loaded	Path: C:\WINDOWS\system32\netapi32.dll Access: query and write and read and execute Type: image Baseaddress: 5B860000 Size: 348160 Protection: read write Mapped to pid: own pid	success or wait	679989770
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5B861000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679993445
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5B861000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679997964
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5B861000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679998272
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5B861000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679998619
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5B861000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679998923
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5B861000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	679999306
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5B861000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	679999854
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5B861000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	680004448
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5B861000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	680004757
Memory attributes changed	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 5B861000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	680005123
System info queried	Type: BasicInformation	success or wait	680008864
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc Name: MaxRpcSize	object name not found	680010389
System time queried	Time: 129876420231718750	success or wait	680012218
System info queried	Type: PerformanceInformation	success or wait	680012725
Process information queried	PID: 1096 Info Class: QuotaLimits	success or wait	680013208
Process information queried	PID: 1096 Info Class: VmCounters	success or wait	680013501
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	680014342
File opened	Path: \pipe\wkssvc Access: read attributes and synchronize and generic read and generic write Options: non directory file and open no recall Attributes: none Content Overwritten: true	success or wait	680015518
File other op	Path: \wkssvc New path: Disposition: PipeInformation Data : unknown	success or wait	680016456
File other op	Path: \wkssvc New path: Disposition: CompletionInformation Data : unknown	success or wait	680016778
File write	Path: \wkssvc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	680017158
File read	Path: \wkssvc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 73 18 00 00 0D 00 5C 50 49 50 45 5C 77 6B 73 73 76 63 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	680018968
File control set	Path: \wkssvc Control Code: 11C017 Input Buffer: ........ .......................	pending	680020755
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680031167
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680031557
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoNetHood	object name not found	680034390
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoNetHood	object name not found	680035113
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoPropertiesMyComputer	object name not found	680035850
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoPropertiesMyComputer	object name not found	680036540
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoInternetIcon	object name not found	680037261
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoInternetIcon	object name not found	680038477
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoCommonGroups	object name not found	680041386
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoCommonGroups	object name not found	680042084
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoControlPanel	object name not found	680043791
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoControlPanel	object name not found	680044616
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoSetFolders	object name not found	680045484
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoSetFolders	object name not found	680046322
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Name: NULL	success or wait	680048768
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	680052108
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680052726
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: AllowFileCLSIDJunctions	object name not found	680053491
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: AllowFileCLSIDJunctions	object name not found	680054261
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc Name: Progid	object name not found	680055829
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc Name: Application	object name not found	680056706
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc Name: NULL	success or wait	680089876
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: DontShowSuperHidden	object name not found	680091750
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: DontShowSuperHidden	object name not found	680092524
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer Name: ShellState	success or wait	680093365
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer Name: ShellState	success or wait	680093794
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: ForceActiveDesktopOn	object name not found	680094681
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: ForceActiveDesktopOn	object name not found	680095530
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoActiveDesktop	object name not found	680096365
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoActiveDesktop	object name not found	680097169
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoWebView	object name not found	680098096
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoWebView	object name not found	680098887
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: ClassicShell	object name not found	680099720
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: ClassicShell	object name not found	680100517
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: SeparateProcess	object name not found	680101386
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: SeparateProcess	object name not found	680102181
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoNetCrawling	object name not found	680103009
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoNetCrawling	object name not found	680103806
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoSimpleStartMenu	object name not found	680104636
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoSimpleStartMenu	object name not found	680105433
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: Hidden	success or wait	680106249
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: ShowCompColor	success or wait	680106665
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	680107078
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: DontPrettyPath	success or wait	680107495
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: ShowInfoTip	success or wait	680107912
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideIcons	success or wait	680108328
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: MapNetDrvBtn	success or wait	680108741
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: WebView	success or wait	680109189
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: Filter	success or wait	680109632
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: ShowSuperHidden	success or wait	680110043
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: SeparateProcess	success or wait	680110528
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: NoNetCrawling	success or wait	680110943
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc Name: PerceivedType	object name not found	680116017
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8 Name: DocObject	object name not found	680117122
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc Name: DocObject	object name not found	680117939
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8 Name: BrowseInPlace	object name not found	680118740
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc Name: BrowseInPlace	object name not found	680119526
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\CLSID Name: NULL	success or wait	680120786
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8 Name: IsShortcut	object name not found	680121952
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc Name: IsShortcut	object name not found	680122762
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8 Name: AlwaysShowExt	object name not found	680124077
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc Name: AlwaysShowExt	object name not found	680124865
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8 Name: NeverShowExt	object name not found	680125649
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc Name: NeverShowExt	object name not found	680126434
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Personal	success or wait	680128431
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Personal Type: unicode Data: C:\Documents and Settings\Administrator\My Documents Old data:	success or wait	680130177
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680130714
Section loaded	Path: \KnownDlls\SETUPAPI.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	680131401
File opened	Path: C:\WINDOWS\system32\SETUPAPI.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680131945
Section loaded	Path: C:\WINDOWS\system32\setupapi.dll Access: query and write and read and execute Type: image Baseaddress: 77920000 Size: 995328 Protection: read write Mapped to pid: own pid	success or wait	680132850
Process information queried	PID: 1096 Info Class: Wow64Information	success or wait	680143132
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	680143631
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\PnP Name: seed	success or wait	680144645
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: OsLoaderPath	success or wait	680145614
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: OsLoaderPath	success or wait	680146149
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemPartition	success or wait	680147112
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemPartition	success or wait	680147645
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: SourcePath	success or wait	680149542
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: SourcePath	success or wait	680150082
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackSourcePath	success or wait	680151067
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackSourcePath	success or wait	680151600
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackCachePath	success or wait	680152614
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackCachePath	success or wait	680153150
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: DriverCachePath	success or wait	680154193
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: DriverCachePath	success or wait	680154720
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: DevicePath	success or wait	680155699
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 16B000 Length: 13E658 Allocation Type: unknown Protection: page read and write	success or wait	680156238
Mutant created	Name: unknown	success or wait	680157229
Mutant created	Name: unknown	success or wait	680157616
Mutant created	Name: unknown	success or wait	680158005
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogLevel	success or wait	680158498
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogLevel	success or wait	680159030
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogPath	object name not found	680159614
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	680160841
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Hostname	success or wait	680161878
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Domain	success or wait	680162886
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	680164280
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	680165203
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	680165666
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	680166725
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 25 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	680167517
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	680168601
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........j.......R................LxD.{..A ./*.,.................S.e.L.o.a.d.D.r.i.v.e.r.P.r.i.v.i.l.e.g.e.	pending	680171263
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,........................LxD.{..A ./	pending	680172277
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	680174682
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	680175573
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	680176035
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	680176549
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 26 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	680177505
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	680178689
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........b.......J.............h.C..L......g.".$.................S.e.U.n.d.o.c.k.P.r.i.v.i.l.e.g.e.	pending	680180169
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,.....................h.C..L......g.	pending	680181196
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	680183444
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	680192710
File opened	Path: IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680200153
File opened	Path: IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680202897
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	680206127
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 16C000 Length: 13EE64 Allocation Type: unknown Protection: page read and write	success or wait	680211136
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f} Name: Data	buffer overflow	680212354
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f} Name: Data	success or wait	680212840
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f} Name: Generation	success or wait	680214499
File opened	Path: STORAGE#Volume#1&30a96598&0&SignatureF4ACF4ACOffset7E00Length3BFEFCE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680215333
File opened	Path: STORAGE#Volume#1&30a96598&0&SignatureF4ACF4ACOffset7E00Length3BFEFCE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680217197
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	680219683
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Data	buffer overflow	680224143
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Data	success or wait	680224622
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	680227694
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	680228517
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	680232958
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: BaseClass Type: unicode Data: Drive Old data:	success or wait	680238081
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	680238754
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	680243453
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{811e0202-1746-11df-8a4d-806d6172696f} Name: BaseClass Type: unicode Data: Drive Old data:	success or wait	680248860
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680249471
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680249825
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680250160
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	680251098
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	680251871
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: DocObject	object name not found	680257067
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: BrowseInPlace	object name not found	680258011
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: IsShortcut	object name not found	680260752
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: AlwaysShowExt	success or wait	680261689
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: NeverShowExt	object name not found	680262622
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	680263825
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 16D000 Length: 13E9F4 Allocation Type: unknown Protection: page read and write	success or wait	680265327
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	680265913
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680267477
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680267860
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680268643
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: UseDesktopIniCache	object name not found	680269196
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: UseDesktopIniCache	object name not found	680270160
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680271192
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D068 Allocation Type: unknown Protection: page read and write	success or wait	680272260
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D064 Allocation Type: unknown Protection: page read and write	success or wait	680272760
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	680273248
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680275439
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D068 Allocation Type: unknown Protection: page read and write	success or wait	680276461
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D064 Allocation Type: unknown Protection: page read and write	success or wait	680276958
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	680277446
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680279068
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680279451
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680279939
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680280401
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D068 Allocation Type: unknown Protection: page read and write	success or wait	680281341
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D064 Allocation Type: unknown Protection: page read and write	success or wait	680283076
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	680283562
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680284946
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D068 Allocation Type: unknown Protection: page read and write	success or wait	680285979
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D064 Allocation Type: unknown Protection: page read and write	success or wait	680286479
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	680286966
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680288578
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680288957
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680289445
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680289886
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D068 Allocation Type: unknown Protection: page read and write	success or wait	680290942
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D064 Allocation Type: unknown Protection: page read and write	success or wait	680291420
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	680291887
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680293232
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680293613
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680294102
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680294538
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D068 Allocation Type: unknown Protection: page read and write	success or wait	680296046
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D064 Allocation Type: unknown Protection: page read and write	success or wait	680296520
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	680296985
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 16E000 Length: 13F688 Allocation Type: unknown Protection: page read and write	success or wait	680298491
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Common Documents	success or wait	680300502
Key value replaced with same	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Common Documents Type: unicode Data: C:\Documents and Settings\All Users\Documents Old data:	success or wait	680302938
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680303488
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680303829
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	680304813
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	680305581
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	680307041
File opened	Path: C:\Documents and Settings\All Users\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	680308547
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680310086
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680310470
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680312795
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680313273
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D068 Allocation Type: unknown Protection: page read and write	success or wait	680314327
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D064 Allocation Type: unknown Protection: page read and write	success or wait	680314841
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	680315327
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680317734
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680318120
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680318611
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680319067
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D068 Allocation Type: unknown Protection: page read and write	success or wait	680320060
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D064 Allocation Type: unknown Protection: page read and write	success or wait	680320550
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	680321026
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680322350
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680322730
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680323214
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680323642
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D068 Allocation Type: unknown Protection: page read and write	success or wait	680324654
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 9F0000 Length: 16D064 Allocation Type: unknown Protection: page read and write	success or wait	680325125
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	680325582
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Desktop	success or wait	680327489
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Desktop Type: unicode Data: C:\Documents and Settings\Administrator\Desktop Old data:	success or wait	680329163
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680329697
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680330034
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	680330974
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	680331730
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	680333177
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	680334680
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Common Desktop	success or wait	680336738
Key value replaced with same	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Common Desktop Type: unicode Data: C:\Documents and Settings\All Users\Desktop Old data:	success or wait	680340195
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680340744
Process information queried	PID: 1096 Info Class: DeviceMap	success or wait	680341082
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	680342030
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	680342794
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	680344250
File opened	Path: C:\Documents and Settings\All Users\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	680345756
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32 Name: NULL	success or wait	680349572
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\InProcServer32 Name: LoadWithoutCOM	object name not found	680350285
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc Name: NULL	success or wait	680352511
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.asp Name: NULL	success or wait	680353617
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.bat Name: NULL	success or wait	680355450
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cer Name: NULL	success or wait	680357252
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.chm Name: NULL	success or wait	680358208
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cmd Name: NULL	success or wait	680360010
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.com Name: NULL	success or wait	680360971
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.cpl Name: NULL	success or wait	680361924
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.crt Name: NULL	success or wait	680363758
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.exe Name: NULL	success or wait	680365603
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hlp Name: NULL	success or wait	680367473
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.hta Name: NULL	success or wait	680368440
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.inf Name: NULL	success or wait	680370251
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.ins Name: NULL	success or wait	680371221
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.isp Name: NULL	success or wait	680372173
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.its Name: NULL	success or wait	680373122
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.js Name: NULL	success or wait	680374935
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.JSE Name: NULL	success or wait	680375894
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.lnk Name: NULL	success or wait	680377783
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mdb Name: NULL	object name not found	680379869
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msc Name: NULL	success or wait	680382266
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msi Name: NULL	success or wait	680383231
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.msp Name: NULL	success or wait	680384182
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.pif Name: NULL	success or wait	680386048
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.prf Name: NULL	success or wait	680387013
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.reg Name: NULL	success or wait	680388882
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.scf Name: NULL	success or wait	680390666
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.scr Name: NULL	success or wait	680391636
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.sct Name: NULL	success or wait	680392584
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.shb Name: NULL	success or wait	680395098
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.shs Name: NULL	success or wait	680396099
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.url Name: NULL	success or wait	680397929
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.VBE Name: NULL	success or wait	680399742
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.vbs Name: NULL	success or wait	680400707
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.wsc Name: NULL	success or wait	680402615
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WSF Name: NULL	success or wait	680403574
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.WSH Name: NULL	success or wait	680404525
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc Name: Progid	object name not found	680405403
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc Name: Application	object name not found	680406217
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc Name: NULL	success or wait	680407276
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8 Name: EditFlags	success or wait	680409185
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: ExecutableTypes	buffer too small	680410511
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: ExecutableTypes	success or wait	680410762
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: TransparentEnabled	success or wait	680411560
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: ExecutableTypes	buffer too small	680412443
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: ExecutableTypes	success or wait	680412678
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 16F000 Length: 13EFC4 Allocation Type: unknown Protection: page read and write	success or wait	680413465
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc Name: Progid	object name not found	680414191
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc Name: Application	object name not found	680415041
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc Name: NULL	success or wait	680416155
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell Name: NULL	success or wait	680418290
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\command Name: NULL	success or wait	680420061
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\command Name: command	success or wait	680421468
Section loaded	Path: \KnownDlls\msi.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	680422311
File opened	Path: C:\WINDOWS\system32\msi.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	680422794
Section loaded	Path: C:\WINDOWS\system32\msi.dll Access: query and write and read and execute Type: image Baseaddress: 7D1E0000 Size: 2867200 Protection: read write Mapped to pid: own pid	success or wait	680423597
Process information queried	PID: 1096 Info Class: Wow64Information	success or wait	680434680
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Group Policy\AppMgmt Name: {90110409-6000-11D3-8CFE-0150048383C9}	object name not found	680435901
Process information queried	PID: 1096 Info Class: Wow64Information	success or wait	680436541
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer Name: Debug	object name not found	680436966
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer Name: DisableUserInstalls	object name not found	680437744
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: WORDFiles	success or wait	680439996
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	680442454
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	680442850
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	success or wait	680443232
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C Name: 9040110900063D11C8EF10054038389C	success or wait	680445504
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680446128
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680446752
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A453DD12EE71CEF49A4EB2A8684FB83A Name: 9040110900063D11C8EF10054038389C	success or wait	680448046
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680448665
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680471860
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5861C19D5F3D8C8439408F306F31034A Name: 9040110900063D11C8EF10054038389C	success or wait	680472521
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680473150
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680474688
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\311714883E93F274A838DDB012991F9D Name: 9040110900063D11C8EF10054038389C	success or wait	680475201
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680475842
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680478026
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72E940125B15C02498F17C8F91EADC14 Name: 9040110900063D11C8EF10054038389C	success or wait	680478593
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680479207
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680479646
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16EFE5D0815A2D11A92E0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	680480194
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680480803
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680482335
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41AE703BF87339947BDCC4715F97EFED Name: 9040110900063D11C8EF10054038389C	success or wait	680482902
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680483516
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680485028
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	680485412
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	680486261
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	680486659
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	680487046
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	680488750
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680489375
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680489805
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	680490305
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680490923
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680491705
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	680492203
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680492821
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680493583
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	680494897
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	680496914
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	680497315
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680497939
Process information queried	PID: 1096 Info Class: DefaultHardErrorMode	success or wait	680498389
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	680498888
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	680502221
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	680504888
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	680507202
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	680510157
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	680512887
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	680513774
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	680516490
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	680518043
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C Name: 9040110900063D11C8EF10054038389C	success or wait	680521179
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: WORDFiles	success or wait	680524058
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: WORDFiles Type: dword Data: 1089994760 Old data: 1089994759	success or wait	680524516
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\ddeexec Name: NULL	success or wait	680527727
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\ddeexec Name: NoActivateHandler	object name not found	680529125
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\ddeexec\Application Name: NULL	success or wait	680530473
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\ddeexec\Topic Name: NULL	success or wait	680531837
Memory allocated	PID: 1096 Path: C:\WINDOWS\system32\cmd.exe Base: 170000 Length: 13F6B4 Allocation Type: unknown Protection: page read and write	success or wait	680532570
Window created	Window Name: WorkerW Class Name: WorkerW HWND: A014E	success	680534443
System info queried	Type: PerformanceInformation	success or wait	680534789
Process information queried	PID: 1096 Info Class: QuotaLimits	success or wait	680535213
Process information queried	PID: 1096 Info Class: VmCounters	success or wait	680535437
Message sent	HWND: 10014 Message: DDE_FIRST WParam: 655694 LParam: 3221864481	error	680535757
Window destroyed	HWND: A014E	success	747577586
Windows enumerated	Desktop: 0 Parent: 0 Enum Children: false TID: 1A8 HWNDs: A014E, 1, 530049, 520054, 5C0059, 530055, 520045, 53005C, 31002D, 35002D, 32002D, 2D0031, 300035, 390037, 310032	success or wait	747577990
Windows enumerated	Desktop: 0 Parent: 0 Enum Children: false TID: 1A8 HWNDs: A014E, 1, 530049, 520054, 5C0059, 530055, 520045, 53005C, 31002D, 35002D, 32002D, 2D0031, 300035, 390037, 310032	success or wait	747578519
Foreground Window Got	HWND: 1008C	success	747581288
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read attributes and write attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	747585279
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 00:20 25-07-2012 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: none	success or wait	747586154
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Offset: unknown Length: 64 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 01 00 00	success or wait	747586945
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE New path: Disposition: PositionInformation Data : Offset: 336	success or wait	747594389
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Offset: unknown Length: 64 Value: 50 45 00 00 4C 01 05 00 40 2A 5F 46 00 00 00 00 00 00 00 00 E0 00 0F 01 0B 01 07 0A 00 60 AA 00 00 24 12 00 00 14 02 00 F0 19 00 00 00 10 00 00 00 90 A9 00 00 00 00 30 00 10 00 00 00 02 00 00	success or wait	747594611
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE New path: Disposition: PositionInformation Data : Offset: 408	success or wait	747594916
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Offset: unknown Length: 4 Value: 04 00 00 00	success or wait	747595134
File other op	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE New path: Disposition: PositionInformation Data : Offset: 428	success or wait	747595396
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Offset: unknown Length: 4 Value: 02 00 40 00	success or wait	747596087
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe Name: UseShortName	object name not found	747599138
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell Name: NULL	success or wait	747600681
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open Name: FriendlyAppName	object name not found	747606665
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\command Name: NULL	success or wait	747607949
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\Winword.exe\shell Name: NULL	object name not found	747612638
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Applications\Winword.exe\shell\edit Name: FriendlyAppName	object name not found	747620296
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: Flags	success or wait	747627793
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: State	success or wait	747630797
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: UserPreference	object name not found	747631243
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: CentralProfile	success or wait	747631688
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: ProfileImagePath	success or wait	747633978
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: ProfileLoadTimeLow	success or wait	747634435
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: ProfileLoadTimeHigh	success or wait	747634880
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\ShellNoRoam\MUICache Name: LangID	success or wait	747640414
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\ShellNoRoam\MUICache Name: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	747640961
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\shell\Open\command Name: NULL	success or wait	747645122
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: InheritConsoleHandles	object name not found	747650462
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: InheritConsoleHandles	object name not found	747651243
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: RestrictRun	object name not found	747654851
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: RestrictRun	object name not found	747655528
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: DisallowRun	object name not found	747656241
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: DisallowRun	object name not found	747659693
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe Name: AppendPath	object name not found	747660458
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe Name: PATH	success or wait	747661133
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoRunasInstallPrompt	object name not found	747665587
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoRunasInstallPrompt	object name not found	747666283
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Winword.exe Name: RunAsOnNonAdminInstall	object name not found	747666969
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: read data or list directory and execute or traverse and read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	747670096
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: query and write and read and execute and extend size Type: image Baseaddress: 7D1E0000 Size: 2867200 Protection: read write Mapped to pid: own pid	success or wait	747670935
File opened	Path: C:\Program Files\Microsoft Office\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	747768281
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	747770653
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Access: query and read Type: commit Baseaddress: 9F0000 Size: 12312576 Protection: readonly Mapped to pid: own pid	success or wait	747774827
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: LogFileName	object name not found	747778450
System info queried	Type: WatchdogTimerHandler	success or wait	747779901
Process created	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Cmdline: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE /n /dde Createflags: none	success or wait	747780139
Process information queried	PID: 900 Info Class: BasicInformation	success or wait	747784388
Memory read	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7FFDE008 Length: 4 Value: 00 00 00 30	success or wait	747784625
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	747784949
Memory read	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30000000 Length: 4096 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 01 00 00 0E 1F BA 0E 00 B4 09 CD 21 B8 01 4C CD 21 54 68 69 73 20 70 72 6F 67 72 61 6D 20 63 61 6E 6E 6F 74 20 62 65 20 72 75 6E 20 69 6E 20 44 4F 53 20 6D 6F 64 65 2E 0D 0D 0A 24 00 00 00 00 00 00 00 8D A8 32 9F C9 C9 5C CC C9 C9 5C CC C9 C9 5C CC 21 D6 58 CC CB C9 5C CC 21 D6 57 CC C8 C9 5C CC 4A D5 52 CC CC C9 5C CC CC C5 53 CC CD C9 5C CC CC C5 03 CC CD C9 5C CC C9 C9 5C CC C8 C9 5C CC DA C1 03 CC C3 C9 5C CC 47 C1 03 CC C8 C9 5C CC 33 EA 45 CC CB C9 5C CC FA EB 79 CC CB C9 5C CC 3A CE 01 CC CB C9 5C CC 21 D6 56 CC C0 C9 5C CC 13 EA 40 CC CB C9 5C CC DA C1 01 CC C0 C9 5C	success or wait	747785792
Memory read	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30B82000 Length: 256 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 00 01 00 00 00 48 00 00 80 03 00 00 00 08 03 00 80 0C 00 00 00 10 07 00 80 0E 00 00 00 D0 09 00 80 10 00 00 00 68 0A 00 80 18 00 00 00 80 0A 00 80 E6 03 00 00 98 0A 00 80 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 00 80 00 00 00 E0 0A 00 80 81 00 00 00 F8 0A 00 80 82 00 00 00 10 0B 00 80 83 00 00 00 28 0B 00 80 84 00 00 00 40 0B 00 80 85 00 00 00 58 0B 00 80 86 00 00 00 70 0B 00 80 87 00 00 00 88 0B 00 80 88 00 00 00 A0 0B 00 80 89 00 00 00 B8 0B 00 80 8A 00 00 00 D0 0B 00 80 8B 00 00 00 E8 0B 00 80 8C 00 00 00 00 0C 00 80 8D 00 00 00 18 0C 00 80 8E 00 00 00 30 0C 00 80 8F 00 00 00 48 0C 00 80 90 00 00 00 60 0C 00 80 91 00 00 00 78 0C 00 80 92 00 00 00 90 0C 00 80 93 00 00 00 A8 0C 00 80 94 00 00 00 C0 0C 00	success or wait	747788501
Memory read	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30B82A80 Length: 24 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 02 00 00 00 98 28 00 80	success or wait	747793307
Process information queried	PID: 900 Info Class: BasicInformation	success or wait	747793587
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 10000 Length: 13E2EC Allocation Type: unknown Protection: page read and write	success or wait	747794372
Memory written	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 10000 Length: 2296 Value: 3D 00 3A 00 3A 00 3D 00 3A 00 3A 00 5C 00 00 00 3D 00 43 00 3A 00 3D 00 43 00 3A 00 5C 00 44 00 4F 00 43 00 55 00 4D 00 45 00 7E 00 31 00 5C 00 41 00 44 00 4D 00 49 00 4E 00 49 00 7E 00 31 00 5C 00 4C 00 4F 00 43 00 41 00 4C 00 53 00 7E 00 31 00 00 00 3D 00 5A 00 3A 00 3D 00 5A 00 3A 00 5C 00 00 00 41 00 4C 00 4C 00 55 00 53 00 45 00 52 00 53 00 50 00 52 00 4F 00 46 00 49 00 4C 00 45 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 6C 00 6C 00 20 00 55 00 73 00 65 00 72 00 73 00 00 00 41 00 50 00 50 00 44 00 41 00 54 00 41 00 3D 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53	success or wait	747796164
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 20000 Length: 13E2EC Allocation Type: unknown Protection: page read and write	success or wait	747796629
Memory written	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 20000 Length: 2044 Value: 00 10 00 00 FC 07 00 00 00 00 00 00 00 00 00 00 02 00 31 00 00 00 00 00 03 00 00 00 07 00 00 00 0B 00 00 00 3A 00 08 02 90 02 00 00 00 00 00 00 DA 01 DC 01 98 04 00 00 6C 00 6E 00 74 06 00 00 82 00 84 00 E4 06 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 01 00 00 00 6C 00 6E 00 68 07 00 00 1E 00 20 00 D8 07 00 00 00 00 02 00 F8 07 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	747800333
Memory written	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7FFDE010 Length: 4 Value: 00 00 02 00	success or wait	747800749
Memory written	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7FFDE1E8 Length: 4 Value: 00 00 00 00	success or wait	747801100
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30000 Length: 13E558 Allocation Type: unknown Protection: page read and write	success or wait	747801415
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 12E000 Length: 13E554 Allocation Type: unknown Protection: page read and write	success or wait	747801695
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 12E000 Length: 1000 New Protection: page read and write and page guard New Protection: page read and write	success or wait	747801972
Thread created	PID: 900 TID: 1492 EIP: 7C810705 EAX: 300019F0 Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	747805833
Thread resumed	TID: 1492 PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	749224709
Process information queried	PID: 900 Info Class: BasicInformation	success or wait	749225417
Window created	Window Name: WorkerW Class Name: WorkerW HWND: A013E	success	753054038
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 424 Hook ID: keyboard	success	753054304
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 424 Hook ID: mouse	success	753054589
Message sent	HWND: 10014 Message: DDE_FIRST WParam: 655678 LParam: 3221864481	error	753055015
Message posted	HWND: 600F8 Message: DDE_EXECUTE WParam: 655678 LParam: 9371660	success	753203980
Window destroyed	HWND: A013E	success	755257728
Windows enumerated	Desktop: 0 Parent: 0 Enum Children: false TID: 1A8 HWNDs: A013E, 1, 530049, 520054, 5C0059, 530055, 520045, 53005C, 31002D, 35002D, 32002D, 2D0031, 300035, 390037, 310032	success or wait	755257962
Windows enumerated	Desktop: 0 Parent: 0 Enum Children: false TID: 1A8 HWNDs: A013E, 1, 530049, 520054, 5C0059, 530055, 520045, 53005C, 31002D, 35002D, 32002D, 2D0031, 300035, 390037, 310032	success or wait	755258343
Message posted	HWND: 600F8 Message: DDE_TERMINATE WParam: 655678 LParam: 0	success	755259083
Window destroyed	HWND: 40154	success	755360132
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 424 Hook ID: keyboard	success	755360328
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 424 Hook ID: mouse	success	755360581
Windows enumerated	Desktop: 0 Parent: 0 Enum Children: false TID: 1A8 HWNDs: 1, 1, 530049, 520054, 5C0059, 530055, 520045, 53005C, 31002D, 35002D, 32002D, 2D0031, 300035, 390037, 310032	success or wait	755360819
Windows enumerated	Desktop: 0 Parent: 0 Enum Children: false TID: 1A8 HWNDs: 1, 1, 530049, 520054, 5C0059, 530055, 520045, 53005C, 31002D, 35002D, 32002D, 2D0031, 300035, 390037, 310032	success or wait	755361144

Analysis File: rundll32.exe PID: 760 Parent PID: 1112

General

Start time:	15:20:41
Start date:	24/07/2012
Path:	C:\WINDOWS\system32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	rundll32.exe C:\Documents and Settings\Administrator\Application Data\taskman.dll start
Imagebase:	0x1000000
File size:	33280 bytes
MD5 hash:	037B1E7798960E0420003D05BB577EE6

File Activites

File Path	Access	Options	Content overwritten	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1\	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\ShimEng.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\AppPatch\AcGenral.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	3	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\WINMM.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\MSACM32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\UxTheme.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\IMM32.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	3	7C90E457	KiUserApcDispatcher
\Device\KsecDD	read data or list directory and synchronize	synchronous io alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	4	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Manifest	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\Documents and Settings\Administrator\Application Data\taskman.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	3	1001770	CreateActCtxW
C:\Documents and Settings\Administrator\Application Data\taskman.dll.123.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	1001770	CreateActCtxW
C:\WINDOWS\system32\WS2_32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	1001792	LoadLibraryW
C:\WINDOWS\system32\WS2HELP.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	1001792	LoadLibraryW
C:\WINDOWS\system32\MSCTF.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	1001412	CreateWindowExW
C:\WINDOWS\system32\msctfime.ime	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	4	1001412	CreateWindowExW
C:\WINDOWS\system32\urlmon.dll.123.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	10001A80	LoadLibraryA
C:\WINDOWS\system32\urlmon.dll.123.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	10001A80	LoadLibraryA
C:\WINDOWS\system32\WININET.dll.123.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	10001A80	LoadLibraryA
C:\WINDOWS\system32\WININET.dll.123.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	10001A80	LoadLibraryA
C:\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	6	10001CCA	GetVolumeInformationA
C:\WINDOWS\System32\mswsock.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	10001EEC	gethostname
C:\WINDOWS\system32\DNSAPI.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	10001EEC	gethostname
C:\WINDOWS\System32\winrnr.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	10001EEC	gethostname
C:\WINDOWS\system32\rasadhlp.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	10001EF9	gethostbyname
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files	write attributes and synchronize	synchronous io non alert and open for backup ident and open reparse point	false	success or wait	1	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5	write attributes and synchronize	synchronous io non alert and open for backup ident and open reparse point	false	success or wait	1	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Local Settings\History	write attributes and synchronize	synchronous io non alert and open for backup ident and open reparse point	false	success or wait	1	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5	write attributes and synchronize	synchronous io non alert and open for backup ident and open reparse point	false	success or wait	1	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\	write attributes and synchronize	synchronous io non alert and open for backup ident and open reparse point	false	success or wait	2	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Cookies\	write attributes and synchronize	synchronous io non alert and open for backup ident and open reparse point	false	success or wait	1	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\	write attributes and synchronize	synchronous io non alert and open for backup ident and open reparse point	false	success or wait	2	10002055	InternetGetConnectedState
C:\WINDOWS\system32\RASAPI32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	10002055	InternetGetConnectedState
C:\WINDOWS\system32\rasman.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	10002055	InternetGetConnectedState
C:\WINDOWS\system32\NETAPI32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	10002055	InternetGetConnectedState
C:\WINDOWS\system32\TAPI32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	10002055	InternetGetConnectedState
C:\WINDOWS\system32\rtutils.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	10002055	InternetGetConnectedState
C:\WINDOWS\system32\TAPI32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	10002055	InternetGetConnectedState
C:\WINDOWS\system32\TAPI32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	10002055	InternetGetConnectedState
C:\WINDOWS\system32\msapsspc.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\MSVCRT40.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C80B729	unknown
C:\WINDOWS\system32\schannel.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\Documents and Settings\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	4	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	4	10002055	InternetGetConnectedState
C:\WINDOWS\system32\CRYPT32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\MSASN1.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	10002055	InternetGetConnectedState
C:\WINDOWS\system32\Ras\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	10002055	InternetGetConnectedState
C:\WINDOWS\system32\digest.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\msnsspc.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Network\Connections\Pbk\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	object path not found	1	10002055	InternetGetConnectedState
C:\WINDOWS\system32\sensapi.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	10002055	InternetGetConnectedState
C:\WINDOWS\system32\msv1_0.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C80B729	unknown
C:\WINDOWS\system32\cryptdll.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\iphlpapi.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\mscoree.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C80B729	unknown
C:\WINDOWS\system32\hnetcfg.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	1000215C	HttpSendRequestA
C:\WINDOWS\System32\wshtcpip.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	1000215C	HttpSendRequestA
C:\WINDOWS\AppPatch\sysmain.sdb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\AppPatch\systest.sdb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	object name not found	1	7C90E457	KiUserApcDispatcher
\Device\NamedPipe\ShimViewer	write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize	no options	true	object name not found	3	7C90E457	KiUserApcDispatcher
C:\WINDOWS\AppPatch\AcGenral.DLL	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Manifest	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\msctfime.ime	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	1001412	CreateWindowExW
WMIDataDevice	read attributes and synchronize and generic read and generic write	non directory file	true	success or wait	2	10001A80	LoadLibraryA
\Device\RasAcd	read data or list directory and write data or add file	no options	true	success or wait	3	10001EF9	gethostbyname
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat	read attributes and synchronize and generic read and generic write	synchronous io non alert and non directory file and random access	true	success or wait	1	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Cookies\index.dat	read attributes and synchronize and generic read and generic write	synchronous io non alert and non directory file and random access	true	success or wait	1	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat	read attributes and synchronize and generic read and generic write	synchronous io non alert and non directory file and random access	true	success or wait	1	10002055	InternetGetConnectedState
\pipe\ROUTER	read attributes and synchronize and generic read and generic write	non directory file and open no recall	true	success or wait	2	7C80B729	unknown
\pipe\lsarpc	read attributes and synchronize and generic read and generic write	non directory file	true	success or wait	6	10002055	InternetGetConnectedState
c:\autoexec.bat	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	10002055	InternetGetConnectedState
\Device\Tcp	generic execute	no options	true	success or wait	2	7C80B729	unknown
\Device\Ip	generic execute	no options	true	success or wait	2	7C80B729	unknown
Ip	read attributes and synchronize and generic execute	non directory file	true	success or wait	1	7C80B729	unknown
C:\WINDOWS\system32\mscoree.dll	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	7C80B729	unknown
\Device\Afd\Endpoint	synchronize and generic read and generic write	no options	true	success or wait	2	1000215C	HttpSendRequestA
\Device\Afd\AsyncConnectHlp	synchronize and generic read and generic write	no options	true	success or wait	1	1000215C	HttpSendRequestA

File Path	Length	Value	Completion	Count	Source Address	Symbol
\ROUTER	72	05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 80 BD A8 AF 8A 7D C9 11 BE F4 08 00 2B 10 29 89 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	1	7C80B729	unknown
\lsarpc	72	05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	5	10002055	InternetGetConnectedState
\lsarpc	72	05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 6A 28 19 39 0C B1 D0 11 9B A8 00 C0 4F D9 2E F5 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	1	10002055	InternetGetConnectedState
\ROUTER	144	05 00 0B 07 10 00 00 00 90 00 40 00 02 00 00 00 B8 10 B8 10 75 18 00 00 01 00 00 00 01 00 01 00 36 00 61 20 22 FA CF 11 98 23 00 A0 C9 11 E5 DF 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 0A 06 00 00 D8 02 0B 00 4E 54 4C 4D 53 53 50 00 01 00 00 00 B7 B2 08 E2 09 00 09 00	success or wait	1	7C80B729	unknown
\ROUTER	100	05 00 10 03 10 00 00 00 64 00 48 00 02 00 00 00 B8 10 B8 10 0A 06 00 00 D8 02 0B 00 4E 54 4C 4D 53 53 50 00 03 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 48 00 00 00 35 C2 88 E2 05 01 28 0A 00 00 00 0F	success or wait	1	7C80B729	unknown

File Path	Offset	Length	Value	Completion	Count	Source Address	Symbol
\ROUTER	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 75 18 00 00 0D 00 5C 50 49 50 45 5C 52 4F 55 54 45 52 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	7C80B729	unknown
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 29 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	10002055	InternetGetConnectedState
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 2A 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 48 00 41 00 4E 00 55 00 45 00 4C 00 45 00 2D 00 42 00 43 00 36 00 30 00 37 00 32 00 30 00 52 00	success or wait	1	10002055	InternetGetConnectedState
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 2B 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 48 00 41 00 4E 00 55 00 45 00 4C 00 45 00 2D 00 42 00 43 00 36 00 30 00 37 00 32 00 30 00 52 00	success or wait	1	10002055	InternetGetConnectedState
C:\AUTOEXEC.BAT	unknown	0	unknown	success or wait	2	10002055	InternetGetConnectedState
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 2E 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 0A 00 00 00 00 00 00 00 0A 00 00 00 57 00 4F 00 52 00 4B 00 47 00 52 00 4F 00 55 00 50 00 00 00	success or wait	1	10002055	InternetGetConnectedState
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 2F 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 48 00 41 00 4E 00 55 00 45 00 4C 00 45 00 2D 00 42 00 43 00 36 00 30 00 37 00 32 00 30 00 00 00	success or wait	1	10002055	InternetGetConnectedState
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 30 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 48 00 41 00 4E 00 55 00 45 00 4C 00 45 00 2D 00 42 00 43 00 36 00 30 00 37 00 32 00 30 00 00 00	success or wait	1	10002055	InternetGetConnectedState
\ROUTER	0	1024	05 00 0C 07 10 00 00 00 2E 01 E2 00 02 00 00 00 B8 10 B8 10 75 18 00 00 0D 00 5C 50 49 50 45 5C 52 4F 55 54 45 52 00 BE 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 0A 06 00 00 D8 02 0B 00 4E 54 4C 4D 53 53 50 00 02 00 00 00 1E 00 1E 00 38 00 00 00 35 C2 8A E2	success or wait	1	7C80B729	unknown
\ROUTER	0	1568	75 64 0D F0 05 32 93 83 C3 F8 D8 A2 46 AA 03 CC E9 59 B0 F6 7D 4D EF 2E 79 D9 B3 68 CC 42 F4 42 9F 70 7D B9 0A 7C 79 5E 75 FB 6D 72 84 E4 77 92 DD C9 6A 0F E8 CC 6E 9C B5 D8 91 AB 24 D5 49 23 63 C3 A7 F2 25 B3 F6 65 8B 60 A3 67 75 2E 06 5D 84 19 C3 27 77 82 CE A7 02 2E B3 39 E1 65 F3 C3 38 15 1D 8E	success or wait	1	7C80B729	unknown

File Path	Disposition	Data	Ascii Data	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1	90028	NU LL		success or wait	1	7C90E457	KiUserApcDispatcher
\ROUTER	11C017	05 00 00 03 10 00 00 00 20 00 00 00 01 00 00 00 08 00 00 00 00 00 04 00 09 00 00 00 00 01 00 00	........ .......................	pending	1	7C80B729	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 40 00 00 00 01 00 00 00 28 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 00 02 00 01 00 00 08 00 00	........@.......(.....,.........................................	pending	5	10002055	InternetGetConnectedState
\lsarpc	11C017	05 00 00 03 10 00 00 00 74 00 00 00 02 00 00 00 5C 00 00 00 00 00 39 00 00 00 00 00 E8 91 D3 8E 49 01 F3 47 B5 60 AE E5 34 0F D2 0B 01 00 00 00 00 00 02 00 01 00 00 00 04 00 02 00 05 00 00 00 01 05 00 00 00 00 00 05 15 00 00 00 FD 43 46 1E 81 77 D9 74 43 17 0A 32 F4 01 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00	........t.......\.....9.........I..G.`..4....................................CF..w.tC..2............................	pending	1	10002055	InternetGetConnectedState
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 E8 91 D3 8E 49 01 F3 47 B5 60 AE E5 34 0F D2 0B	........,.......................I..G.`..4...	pending	1	10002055	InternetGetConnectedState
\lsarpc	11C017	05 00 00 03 10 00 00 00 74 00 00 00 02 00 00 00 5C 00 00 00 00 00 39 00 00 00 00 00 83 82 8C 32 6A 71 8D 45 B4 CF 03 32 C3 3A DF 20 01 00 00 00 00 00 02 00 01 00 00 00 04 00 02 00 05 00 00 00 01 05 00 00 00 00 00 05 15 00 00 00 FD 43 46 1E 81 77 D9 74 43 17 0A 32 F4 01 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00	........t.......\.....9........2jq.E...2.:. .................................CF..w.tC..2............................	pending	1	10002055	InternetGetConnectedState
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 83 82 8C 32 6A 71 8D 45 B4 CF 03 32 C3 3A DF 20	........,......................2jq.E...2.:.	pending	1	10002055	InternetGetConnectedState
\lsarpc	11C017	05 00 00 03 10 00 00 00 1A 00 00 00 01 00 00 00 02 00 00 00 00 00 00 00 01 00	..........................	pending	1	10002055	InternetGetConnectedState
\lsarpc	11C017	05 00 00 03 10 00 00 00 74 00 00 00 02 00 00 00 5C 00 00 00 00 00 39 00 00 00 00 00 42 2F 4A F8 78 6C 3E 48 95 02 FE 40 0B AF FC F2 01 00 00 00 00 00 02 00 01 00 00 00 04 00 02 00 05 00 00 00 01 05 00 00 00 00 00 05 15 00 00 00 FD 43 46 1E 81 77 D9 74 43 17 0A 32 F4 01 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00	........t.......\.....9.....B/J.xl>H...@.....................................CF..w.tC..2............................	pending	1	10002055	InternetGetConnectedState
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 42 2F 4A F8 78 6C 3E 48 95 02 FE 40 0B AF FC F2	........,...................B/J.xl>H...@....	pending	1	10002055	InternetGetConnectedState
\lsarpc	11C017	05 00 00 03 10 00 00 00 74 00 00 00 02 00 00 00 5C 00 00 00 00 00 39 00 00 00 00 00 03 B4 5F EC D3 88 92 43 8F EA BF 4E 52 9D C4 FE 01 00 00 00 00 00 02 00 01 00 00 00 04 00 02 00 05 00 00 00 01 05 00 00 00 00 00 05 15 00 00 00 FD 43 46 1E 81 77 D9 74 43 17 0A 32 F4 01 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00	........t.......\.....9......._....C...NR....................................CF..w.tC..2............................	pending	1	10002055	InternetGetConnectedState
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 03 B4 5F EC D3 88 92 43 8F EA BF 4E 52 9D C4 FE	........,....................._....C...NR...	pending	1	10002055	InternetGetConnectedState
\lsarpc	11C017	05 00 00 03 10 00 00 00 88 00 00 00 02 00 00 00 70 00 00 00 00 00 44 00 00 00 00 00 A5 61 99 4C FE 08 C9 42 8D 42 EF CB 06 DE 7F EF 01 00 00 00 01 00 00 00 26 00 28 00 00 00 02 00 14 00 00 00 00 00 00 00 13 00 00 00 4E 00 54 00 20 00 41 00 75 00 74 00 68 00 6F 00 72 00 69 00 74 00 79 00 5C 00 53 00 79 00 73 00 74 00 65 00 6D 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00	................p.....D......a.L...B.B..............&.(.................N.T. .A.u.t.h.o.r.i.t.y.\.S.y.s.t.e.m...........................	pending	1	10002055	InternetGetConnectedState
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 A5 61 99 4C FE 08 C9 42 8D 42 EF CB 06 DE 7F EF	........,....................a.L...B.B......	pending	1	10002055	InternetGetConnectedState
\ROUTER	11C017	05 00 00 03 10 00 00 00 60 0A 10 00 02 00 00 00 24 0A 00 00 01 00 0C 00 63 8B 49 8D F9 0D 9F A6 D6 1E 06 6D 22 4A 6F BF D8 C2 27 47 97 C0 5F 1F 9C 19 A1 BB C1 04 4E BE FC 79 3F B8 E3 EC 91 6C EA 5B 64 11 0E 5B F0 58 C8 68 DC DF 7E AF 49 57 AE 24 98 E4 71 B1 05 72 0E AA 2E B0 CB FC 45 7E D4 D7 F4 8E 10 01 52 A1 BA 17 43 3D 5C 9D 50 9E 06 5C F1 4C 58 47 58 A4 4C 7A 1C 1D 2A 05 36 8B 9A E0 CF 65 18 68 A0 A6 B4 7A 8A 5E 34 8F CB F8 55 97 66 B1 ED 82 77 58 F5 A5 0D C3 1D 75 6F C3 D5 41 03 9A D8 4C 17 90 E2 17 8B 74 4C 88 E1 38 6E 06 0F B7 3B 2C 8D C3 21 8E ED 93 EC A4 04 03 38 90 B4 80 ED FB 86 E4 2B D0 19 81 DD C2 20 48 B1 5A 54 5B AC C9 45 A7 D2 8D 99 67 00 4A 63 BE F7 80 88 28 C0 80 25 D6 D6 74 16 F4 B9 F5 A5 0F 6B D8 88 07 F6 EF 9D 64 D9 7B 96 49 DE C9 97 0A EE 32 1B 61 BC 96 06 5A E8 F6 6E E3 A1 77 53 F3 E7 D2 7E 9F E8 91 E8 06 0E 53 73 B6 33 83 98 66 0F 8F 09 0A CA 08 1D 7F 14 F2 82 F4 B7 8E A8 5F 97 F9 41 EB BD FB 33 56 8B 28 0B 80 EF AF 2D 3F C6 77 CF 47 CB 77 F8 F2 2A 08 D0 1C 76 9B CF F6 F5 FE E0 0A 73 CB 38 D8 58 6F AF 83 C5 34 8B 1C A3 CF E7 85 9B CE 41 C2 D9 B6 69 26 22 E8 3E DB 89 9B EB 36 BB 03 C3 96 70 31 44 12 F7 63 EE 74 C9 8F 37 37 7F 8E 2A EC F1 6B 7B 03 D1 C7 83 91 BF CC 51 37 C3 7B 35 03 A7 51 C8 6D D4 BD F7 3C 56 FE D0 95 83 C6 7E 81 CD 04 71 03 46 42 5B D7 EA 60 E5 6E 96 38 2A 83 B5 4C 79 60 56 88 5F E5 58 F0 C6 43 EC EB CC EE A3 32 F6 8B 29 FF A6 24 15 EC DD 0C 0E 2C 3F 71 C9 17 0A A3 0E 17 0D 81 BF 66 D9 F2 D1 46 46 ED 4E 70 F7 BF 2F 1C A1 CC 2B 8E FA 51 97 8F 9D F9 BD AD 8F 70 80 15 15 14 64 90 7A 23 77 5B AD E0 39 D4 28 1D 71 D4 83 B7 D2 82 1F 68 6A 98 EE F5 FA 10 D3 EF 00 F8 E3 7A 1C B1 DF 45 35 FF D3 D0 AE C4 D5 21 4E D1 54 25 34 A1 39 70 E0 4D DA 0B 60 E0 67 38 AC B7 50 33 E5 3A B4 09 EF 78 90 5F 62 85 FB CF 3D 10 79 F6 FE 56 78 27 B8 16 FE 1C E7 62 5C 59 2E 86 51 81 D0 6E CE 11 BF 67 2F E1 83 1C E4 52 E0 6E E3 FC 93 1B C2 FE D1 F5 E1 98 AC F1 49 B8 FC B1 14 A2 A8 4D 66 A1 BF 75 42 9E CA 57 B9 72 F0 CE 30 0C B4 C6 14 C9 27 A6 AB DD 69 A3 51 17 49 CA 3C 48 97 1F 10 FC 9A DD 9A 3A 5F 3A 17 FD 48 95 BB 50 D1 9F B3 CE 09 65 5F ED 03 F6 F6 6C AB CF A6 5C DF 00 84 D5 6E CF 18 5C 57 A2 6C 91 86 23 63 A1 FB 06 15 C8 41 2C 34 28 D8 B3 13 A2 F4 AA 8B 46 B8 2D 7A 2E 84 F8 A0 51 6A 12 9D 82 A1 FB BA 51 BD 4C 8D 2A E9 ED D8 6D 27 7D F7 C6 25 A1 4F 0D F3 C6 CE 54 03 8E D2 84 14 D1 E3 5E 40 D2 96 42 C7 D8 7F FA FA AE C9 4B 48 A9 8B A5 6A F1 B9 64 F5 DE CC B0 C0 57 2D C4 58 2E E3 26 9D 7B 4D E8 4F 69 DD 7C 51 C3 18 44 E7 62 0C 1E 7B 22 4A A9 E7 0A 45 DC 12 4B 28 E9 C3 26 1C C4 0A DC AB 64 97 C2 2C 0D FE EF 82 6F 78 DF 93 64 9E 16 FF 88 60 8C B8 56 04 72 EB 99 66 2D 83 92 87 CD BE 46 F9 C0 3C E9 53 C8 20 D0 00 AD 8C 4B 02 5A 8C B2 2F F0 08 50 68 A0 4C 0C 08 31 FA A0 CC 99 06 D0 96 89 5B C7 0A 6B 8F C3 29 62 D7 E8 32 C4 84 40 01 10 CA 86 46 1C 0C 54 17 99 31 43 48 8D 93 D6 19 41 0B 42 B8 5B 39 2C 94 70 F2 62 A8 DE 4F 5F 57 BF AB DE 59 ED FD EB 7C 11 73 E4 F5 6B 50 C1 14 7F 8B F8 34 8C 83 E4 CE F6 AD 28 87 1A 47 DB 71 91 D5 31 2A ED 5B 67 F7 DB DA E4 43 C9 E5 C8 C1 53 70 B8 CC 1A 4D 8F 37 57 4B 75 F5 8F 8F ED D8 08 C6 49 CF 96 81 65 FA 1D BA 0B EB 05 7A BA B0 35 B7 C1 38 27 46 88 3B 0B E9 F8 4D 84 1F 83 D7 FC 9F 6D 38 84 A8 5F 55 33 73 5E 42 4E 13 4F F9 62 E1 BE ED A8 74 95 09 E0 02 F8 EA BC 91 BA 93 C8 66 4D B7 8F AE 2A 9F 6A 98 89 16 33 EB 97 90 D7 3F 83 0A BC 6D 27 00 FF AE 97 4A F3 BC 60 6C 63 8F 63 56 C6 42 B2 0F CC B5 0E D5 0C BD C5 B7 78 3B AA 96 50 4B A8 E8 14 8E EB AD 57 EF B2 5E 1E 90 72 7E EE 91 68 9B 36 0D 81 CD 58 A8 E8 44 EE 85 CA B3 87 74 8E B2 C7 7A DD F1 F8 05 35 A6 EA 1C AB 65 9D F5 19 7B CF 7E 1A 5D 11 46 92 0C E7 D5 0A 2E A9 0C 85 B0 D7 43 D6 0D 0A 7F BE 1D 11 D5 E4 AD ED 17 9F A4 9C EC 6E 22 25 D3 ED A7 47 B2 8C 9A 7F FA 31 7A 21 B6 72 83 38 76 AD 13 7A 2B D7 31 BC D5 0D 26 FB B0 05 AD BA 1A 5F E4 A1 9C D8 55 67 BA 77 77 A5 37 A0 FF 5D 12 2A 19 69 6A 60 B5 43 D6 43 B1 B7 AD 01 DC A2 47 68 D3 81 82 17 96 25 0F FA 1A 97 7E 01 9B 32 8D 7E 44 7B 6E 69 05 02 A0 B9 25 8E FE B5 61 F5 67 F2 85 F8 44 55 A7 1A A8 38 4F A5 06 7F D5 D9 05 2E 71 89 1C F7 F8 CB CC 94 42 AB 07 2E 21 73 DD BE 1D 36 58 C2 08 98 EA FF B3 0D 86 87 AE 37 66 37 8D 30 3A CB 7F D8 CE E3 ED 90 74 6D BD 1D AF 1B 63 76 D5 4A B0 49 FD 0A 22 E9 59 DB 40 74 C3 17 3E 4F ED 58 E3 2C 59 71 C5 EA 36 52 6B 49 D8 8B 4A AA 7C 3A 77 99 26 20 98 01 E4 80 F3 D7 4F 98 C6 D2 45 CB 95 14 B9 7E 3E B5 66 D6 EE 11 83 61 42 5E 31 08 D2 89 8B D9 7F C2 C5 E6 C6 41 BD 22 25 8F 08 07 D9 EA A2 CC CE 8F BE EA 91 2D 7E 50 33 EA 6C BD C2 11 59 8D 3E 3E C7 CD 74 AA A3 EB E8 27 14 63 2C 4C 5D 36 DB 4C 8D 74 FB 16 15 EB 43 1F CA D4 9D 6F 76 5B 81 C0 2B 6D 58 1B 48 8F AD 09 88 04 A5 07 DF A2 F8 8A 7A 9E C0 E3 E9 2B B6 74 FF 6B 47 FF 9C EF E6 3A DA 45 18 6E CE F6 05 43 5F C1 03 50 AB 79 A1 18 84 A2 48 E7 AA D9 87 74 30 7D 95 09 36 C6 B8 A2 80 64 70 E6 A1 93 04 6A 29 0C 89 93 15 FA D9 2E 37 10 DB 09 72 68 B5 47 A8 30 AF 56 4B 62 59 75 6E B6 D3 0C 2A 1E 25 FE E5 8E 85 9C BC 76 39 AD BC 33 C8 3C F0 E0 B0 57 95 25 C2 43 95 C1 A6 50 8C 0D 96 CF C6 8C A3 15 87 EB E5 2C 48 C1 C3 B6 68 68 CE 9C 0C 50 02 DA CF F4 CC CD C9 72 5B B7 FD 57 B4 C2 13 47 3F FD F8 50 4E 1B 1F 68 3D 48 D2 6A 29 84 9D 52 A0 47 F6 1E 4E 68 8D E8 08 09 B3 2E 1A 9A EC A5 0E CA AE A1 33 01 1F 54 DE 75 9C 7B 3A BB 4A DE D3 28 B0 75 D3 77 5C 1C A9 CE 4C C9 B1 11 DF 0B F0 8C 69 D3 A6 A6 AD 5E 6D 91 02 46 DE E9 96 31 09 5D 3C FD E7 0B 1A 2A A7 24 DB 43 44 E6 88 75 AA 78 EE 35 0C 1D 32 1F 93 7E 6D 00 2C 5C F2 8D 97 4A A0 B7 D6 31 C1 BD FA 44 38 DB 5F F3 74 82 F5 0A C1 11 90 34 DD 17 28 B8 12 F4 E4 D3 72 E8 E7 19 E8 E8 09 B5 8A 65 CB 59 69 C1 BF 32 15 65 F5 00 3A C4 83 F8 85 65 4F C1 BE 0E 96 DD 7B ED 61 A2 BE 7C 4E A6 45 9F B1 EE BC 96 0C 49 CF D9 96 0E 7F B8 B1 A4 D2 5A 6B A4 B3 D2 7A 28 F0 23 2E AB 3F 1E 4F FA 11 B4 4E DA 48 3E 60 F8 35 E6 85 F2 10 13 5C 0F 85 84 8C EE F7 83 E9 66 0D EA 48 8A 40 13 26 90 A4 FF 89 82 00 22 3C 21 94 2C 63 60 3B 5D 6D 35 99 E6 DC 0F D5 E5 97 D3 71 F6 0B F4 9D A5 F8 7A DB C5 6A 64 94 CE 27 13 6A 47 91 0C 13 09 B7 87 36 A1 47 E7 43 5D DE C8 34 AA 02 30 67 8B 2B AC 5D A5 2C 9B 8D BE 6A 07 EA 14 43 AB F7 03 91 D5 58 ED 87 8E F7 9A 22 47 DF DA 87 A6 5E 78 88 15 24 8A 3A 8F F8 CD 78 6E D6 9C 44 48 CB 94 EC E7 A4 57 E2 15 69 90 37 11 B9 AE 68 B7 C1 B1 D8 3E 1F AB 9A DB 7B 88 CD 42 24 A6 13 BB 36 8B 7C 09 E5 9F 68 A3 7A 67 CC 28 7F 4A 3A 48 0E 45 D7 78 65 A8 ED 50 F5 07 A0 FF 3B A8 AC B2 B9 15 41 06 D0 70 DE D4 9F B2 14 34 9B 11 19 36 22 A9 69 C5 DB A6 4A FF 64 9A 42 93 80 64 66 77 F6 0B 78 AB D3 01 C9 93 08 A0 FF 45 C2 46 9B 8B 40 29 CC B1 1B 7D 25 67 8C 06 DE A9 CD 87 E6 2D EF 97 B6 B2 77 40 3A 78 4E 93 9D 51 17 0B 0F C3 66 0F CD 6E C1 BC 16 5B BB 5E B2 3B 55 D2 E7 3A 3C 76 7A 09 8B 0A 64 A1 9B 30 A0 81 B8 11 2F 50 A3 72 84 8D 01 2F D2 39 B7 C0 D0 3D B7 32 F0 94 F1 F3 44 39 58 87 36 D1 FA EE 45 20 13 0F 71 28 B5 D3 41 5C 19 83 5D 2E 8B E8 36 16 06 25 A1 88 75 B3 0A 15 06 D5 49 66 8B EC 0D 5D 35 7C 76 C5 14 66 B8 03 EE BB CC E5 EC 88 3F 9B 43 C3 08 E4 65 82 56 65 AE 8B 9A FD 44 C6 75 DD CC 86 B1 AC 19 B9 E8 69 FB E0 35 66 7A BB 3B 64 BF 45 01 65 06 2C 7B 5F 92 9A B7 45 E9 49 E9 34 D7 6B 65 6E B2 BE 25 DB 75 11 37 3D D7 01 E7 2A C2 BE A4 5B 20 5D 46 D2 8F 21 FF FC EA 48 00 80 25 00 EE D2 43 60 77 5B 16 A0 A9 EA D9 EC E1 EE 94 5E 64 EC 46 3F E0 10 AD AD 0B 53 0B 5B 9D 2C 62 C9 96 9E 56 63 7E A5 0F 0B 13 19 C0 4E 8E 08 BB AD 5F AA 9D C8 24 62 C3 85 E9 D6 4E 8D FD E7 A7 54 E2 8B FC F0 1C B7 13 CD F0 34 65 A7 7F 68 71 3C 4A 3A 62 31 62 A4 E8 5C 80 57 F3 70 F4 D7 26 B5 BC 82 37 16 D0 22 07 00 A0 3D 7A FF 1E B1 3D 56 52 E6 C7 A1 62 CA 6D 61 22 25 2D AD BA DF F0 77 AF 23 04 93 8B 6E 2C 05 70 0E C0 90 5E 85 8A 8B 29 3A 8E D1 72 C0 66 73 64 4D 10 81 12 C0 DB 9A 99 2E 87 67 BD 39 6E DD E9 58 B7 10 F4 12 09 B1 28 31 AF 1B E7 7D 9E 30 08 0B 42 BB 8F 8C 11 4E 14 0E 13 67 B1 75 1C 6E 0C 26 0A B9 10 D9 DB 8C 93 AB C8 2C 0F A3 EF F2 3B 6C 53 BD 61 81 F4 23 A0 A9 34 C0 CA 18 9E D9 7B 59 74 0E BC 90 B6 51 3C B6 03 33 84 A0 8D DD 0A 06 0C 00 D8 02 0B 00 01 00 00 00 24 D7 B6 64 29 D4 F9 A4 00 00 00 00	........`.......$.......c.I........m"Jo...'G.._.......N..y?....l.[d..[.X.h..~.IW.$..q..r......E~......R...C=\.P..\.LXGX.Lz...6....e.h...z.^4...U.f...wX.....uo..A...L.....tL..8n...;,..!.......8.......+..... H.ZT[..E....g.Jc....(..%..t......k......d.{.I.....2.a...Z..n..wS...~......Ss.3..f..............._..A...3V.(....-?.w.G.w.....v.......s.8.Xo...4........A...i&".>....6....p1D..c.t..77....k{.......Q7.{5..Q.m...<V.....~...q.FB[..`.n.8..Ly`V._.X..C.....2..)..$.....,?q.........f...FF.Np../...+..Q.......p....d.z#w[..9.(.q......hj..........z...E5......!N.T%4.9p.M..`.g8..P3.:...x._b...=.y..Vx'.....b\Y..Q..n...g/....R.n............I......Mf..uB..W.r..0.....'...i.Q.I.<H.......:_:..H..P.....e_....l...\....n..\W.l..#c.....A,4(.......F.-z....Qj......Q.L....m'}..%.O....T.......^@..B.......KH...j..d.....W-.X..&.{M.Oi.\|Q..D.b..{"J...E..K(..&.....d..,....ox..d....`..V.r..f-.....F..<.S. ....K.Z../..Ph.L..1........[..k..)b..2..@....F..T..1CH....A.B.[9,.p.b..O_W...Y...\|.s..kP.....4......(..G.q..1.[g....C....Sp...M.7WKu.......I...e......z..5..8'F.;...M......m8.._U3s^BN.O.b....t...........fM....j...3....?...m'....J..`lc.cV.B..........x;..PK......W..^..r~..h.6...X..D.....t...z....5....e...{.~.].F...........C................n"%...G.....1z!.r.8v..z+.1...&......_....Ug.ww.7..]..ij`.C.C......Gh.....%....~..2.~D{ni....%...a.g...DU...8O.......q.......B...!s...6X..........7f7.0:.......tm....cv.J.I..".Y.@t..>O.X.,Yq..6RkI..J.\|:w.& ......O...E....~>.f....aB^1..........A."%............-~P3.l...Y.>>..t....'.c,L]6.L.t....C....ov[..+mX.H...........z....+.t.kG....:.E.n...C_..P.y....H....t0}..6....dp....j).......7...rh.G.0.VKbYun....%......v9..3.<...W.%.C...P...........,H...hh...P.......r[..W...G?..PN..h=H.j)..R.G..Nh..............3..T.u.{:.J..(.u.w\...L.......i....^m..F...1.]<.....$.CD..u.x.5..2..~m.,\...J...1...D8._.t......4..(.....r........e.Yi..2.e..:....eO.....{.a..\|N.E......I.........Zk...z(.#..?.O...N.H>`.5.....\........f..H.@.&......"<!.,c`;]m5........q......z..jd..'.jG......6.G.C]..4..0g.+.].,...j...C.....X....."G....^x..$.:...xn..DH.....W..i.7...h....>....{..B$...6.\|...h.zg.(.J:H.E.xe..P....;.....A..p.....4...6".i...J.d.B..dfw..x........E.F..@)...}%g.......-....w@:xN..Q....f..n...[.^.;U..:<vz...d..0..../P.r.../.9...=.2....D9X.6...E ..q(..A\..]...6..%..u.....If...]5\|v..f........?.C...e.Ve....D.u........i..5fz.;d.E.e.,{_...E.I.4.ken..%.u.7=...*...[ ]F..!...H..%...C`w[.........^d.F?.....S.[.,b...Vc~......N...._...$b....N....T.........4e..hq<J:b1b..\.W.p..&...7.."...=z...=VR...b.ma"%-....w.#...n,.p...^...):..r.fsdM.........g.9n..X......(1...}.0..B....N...g.u.n.&.........,....;lS.a..#..4.....{Yt....Q<..3................$..d).......	pending	1	7C80B729	unknown
\ROUTER	11C017	05 00 00 03 10 00 00 00 20 0A 10 00 03 00 00 00 F0 09 00 00 01 00 0C 00 6E 2F 53 97 52 5B C2 08 E0 67 02 74 F3 87 66 D4 0F 4F 8C 8D A6 BA BB B4 A4 FF 19 6F 0C 67 08 DF ED 5A 94 C2 20 51 DD 15 41 27 4D 6E 1B 07 BF B0 17 12 EF 13 80 28 7A 73 FB 7C CF D8 C4 D4 1E 09 2B F4 E1 EF A0 EF 63 B5 69 E5 B5 E1 82 70 8B C1 8C 5B 61 E8 2E 28 2F 79 F6 9E F0 41 53 A5 62 E7 FE 20 FD 09 11 50 92 5A 00 E4 54 BA A2 B2 23 22 E5 D8 39 65 E0 CA 8F 3B 96 7F 60 EB 03 5E CE 38 B9 26 7B CF A6 2A 72 DF DC 62 3B BA BC 0C EA 8D 99 DA 25 47 2D 77 E8 88 C4 7C 70 45 FB A7 C0 99 40 BC EE EC 04 5F 3E 26 F6 39 0F BF 6C 53 D7 F0 9C 1B ED C5 C3 BB CF A3 C9 C7 0B F0 CD 87 D4 EF 92 82 7D 93 C5 27 E9 07 04 AA 47 C0 4D 5C 9C 37 58 46 60 14 4A 05 51 4F 0E 12 47 05 76 1C 1C 41 B7 9C 91 03 6C AF 2D 5A CD 43 B3 05 DB C0 30 5B 60 A2 05 95 40 75 57 BD 9B 3F 2B 0A 8A 5D E6 F5 E8 C6 2E CD 2C 86 08 FC D6 8D B5 CB 40 C8 88 E6 BD 0C 2C EF 63 14 65 98 0E A7 A2 41 A1 3F 1D B8 A9 B6 0C DC 84 E3 59 0D 87 68 9D CD 36 36 9C C0 9E E3 8A 8D 2F BD 11 92 09 CC 6A 85 D3 48 73 5F 5A F2 E5 4D A3 35 8C B6 BC 87 48 06 A2 89 BD 58 F6 0F EE AC 69 1E 2E 21 B4 03 BF 5A A7 DD 87 84 D7 C3 24 BE 37 84 2C C7 EF AA BE DA B8 2E A0 7F 95 4F DC 25 16 E0 E1 D3 32 EC 33 79 AA 0A B4 BD 75 15 9D 74 DD 04 D4 2B 55 A1 D1 C9 CD CC 1A 45 1F 36 AE F6 43 21 9A 92 DC DF 61 BC 5C D7 A7 54 FA 25 D5 D8 DB AB 34 DC D8 73 DD 60 4D F9 6B 64 DB E9 EC D3 27 DF 72 29 E6 95 F6 22 80 F9 92 F5 8D CD E6 E6 30 B3 C5 E1 FB FC EB DF 1F B9 EB 01 3C FD 96 04 06 14 4D 13 D0 B9 50 DD 81 12 00 9B FD F9 CB 36 B3 03 4B 08 0D FB 0C 51 91 04 13 4A EC 8B D4 85 D1 5B 87 37 C4 ED CC 5A 47 59 52 CF 50 57 7E 70 9A 2E 7B 15 CB 62 01 B8 C5 97 00 12 9D 05 E7 DB 50 E6 72 75 4F A9 5D 45 D0 1B C7 08 AC 4D 75 FF F7 ED B2 60 F8 A1 30 42 63 34 8E C1 AB 25 26 E1 43 34 2B 02 70 2D A3 29 B5 53 D2 DD 12 5B 68 B1 65 BC EC B2 46 C4 DE 9D 8D 70 A9 09 A5 D0 6C 5D 80 CA 2A 53 61 E6 3C E4 31 57 79 A7 24 88 8E C9 5A 30 85 2D BA 66 5C 86 DF B6 85 FE 79 7D D7 D1 34 83 95 A6 60 73 68 7E 03 FA 50 D6 6F DD 4C 08 6E 2E 5E 97 48 92 19 4A 1E C6 8E E9 48 A7 0A D3 6B 02 B0 B7 41 DB FB C2 3E FD 3C A0 4C 6D F2 C4 E3 EF 02 BF D5 B1 E8 0C 3B FB E5 25 BB 07 DE C1 02 29 18 B1 77 97 0A 11 5F F0 55 A2 63 25 D6 33 7A 72 E1 9E BC 8F A6 31 18 0A AB 9F 23 3D 78 27 A0 E8 7C CD 7D AD A3 D0 1B C5 E3 40 03 2A A8 BE 99 AF 65 06 9C 7C 35 08 02 E9 1E 89 F1 5A A7 E4 82 D1 B4 D2 9E D2 6D DE 95 75 23 FF C8 C0 84 8A 64 F3 48 D3 40 E0 E9 37 64 8F 4C BF CE 10 B8 CB 79 E5 65 4D F4 CC D2 8D 4E 82 3A 54 B1 F8 8A 04 E8 AF 08 D0 C5 46 FC 31 DB BB D2 4F F0 58 57 7D 68 AC 2F 5B 4E 1C 37 3D 58 94 C7 32 FE 73 11 01 61 39 0F 8F A1 CA 35 6D 06 53 6C 2D A5 C8 AC E9 5C 97 91 8C C7 FF 30 BF 62 16 F0 B1 97 49 A9 38 B1 99 C1 70 DE 16 76 42 4A B8 AD 5B 75 D8 F3 36 46 12 56 0F 59 60 CB 9E 1A 50 30 21 47 5A 25 56 7A 19 18 D4 B4 65 D9 86 5B 00 85 82 BB FD EF 04 E3 0E 74 00 FF F4 29 DD 8F 3B 4C F7 DF AB C0 72 2E 31 0A F5 D7 47 18 11 76 1D 3F CD C2 A6 A7 5A 96 4A 46 9C AC CD 87 31 A4 45 09 77 01 B9 76 AC B8 02 41 25 65 6D 43 7B FF AD AF 89 EB B7 54 10 D7 98 75 E5 E0 AE A5 07 1C 7D EE 8F 7D E9 76 92 71 EB CD D0 99 89 B8 CB 52 DD 75 0D AA 92 3A B9 F1 7A 3C CB 2A CB D2 95 89 65 9C A1 A2 D8 61 E0 81 FD 43 5B 19 AE 55 20 57 F5 4B D0 08 B4 ED 0E 52 2A 49 A2 1B 28 F7 7D 37 ED 4B 39 F8 E5 12 5F 07 B0 FE 1B DF 3E 82 17 A1 B6 62 C5 06 A7 1A 16 CA 98 AE 64 76 26 8E 7D E1 82 70 5A BF FC 62 DF 17 D7 73 34 0A 9D 62 CB 8E AB 32 7C 2D 99 3F 69 C5 3A C9 4C 49 CB 3D 67 79 80 DA 2F 8E 76 B1 16 4E 0A BF 03 B1 B7 2A CA 45 44 E7 DC D8 64 7A 7B E0 86 6C 23 33 7A 7E 6A 17 2A D8 A8 56 2D 68 E9 66 F0 8A 16 79 EB 8F CB 26 0A 00 E5 73 2A 52 BB 92 53 A3 7B F5 FA 51 B9 98 58 24 CD C8 87 29 DD A7 1D AF B2 4B B7 5E 5E 1C 5B DC F0 18 61 C2 99 B2 19 94 7F 52 9E 15 83 EF 5F 5A 97 AB F3 24 5F 16 A8 DD 2F 95 2B C9 E0 42 A9 02 79 1B C8 6C 05 2C F7 07 15 8A B6 F8 77 34 DD 05 5A 49 A9 EC 20 2C 61 A7 7A 4A A1 00 73 4A F4 66 2C DF E2 83 C6 79 CC B9 AE 51 D1 3F D4 59 95 11 C3 03 74 11 DD 98 27 D3 B6 32 D0 1D D5 3F CF E6 DE 13 3D 94 38 4F 84 23 47 D0 24 F3 58 84 8A C6 8B 6B 32 A1 88 D6 4C E3 68 01 01 D5 72 7A 79 FF E0 2E AF DF C8 14 30 57 DC 3F 0E 8B C5 E1 D1 C2 A0 8F 3E 74 60 B2 D9 8D 78 B9 1F F1 BF ED EE 3C ED CF 0B 20 04 8B 53 4A 10 AF B4 66 DB 21 C2 91 6C 7B 9C 04 3F 27 2A C6 98 37 EC BA E2 02 3A 20 8B 02 01 35 5B 01 A0 14 40 BB 3E 85 66 DA 63 F4 AC 80 F7 B7 57 66 F5 98 B1 25 B5 31 92 20 77 83 CB 45 A0 38 5A 13 07 D1 BD 2F 89 42 6F FB BF 34 D2 AA DD 4D 6C A1 57 C2 26 45 24 C6 E5 56 77 A1 74 AE F6 65 77 CE 80 93 50 38 53 21 B7 17 80 2A FF DF 1C 3F B5 92 DF 53 8E 88 E9 13 EF 93 F8 E5 45 FB 60 64 91 DA 39 F0 26 AA 6F CD FD E3 0E B5 31 FD 44 92 91 67 0C 1E 8D 24 F7 7E F6 96 25 71 EF 99 9D 0F C7 7E 66 49 0E B5 AD F2 31 78 7D A7 E9 69 D6 54 F3 36 E0 37 02 A8 66 A4 9B 4E 5B DE DB 6F 21 12 DB 8F 9A F7 DA 99 3A 00 38 55 D2 63 BD 77 59 21 3D 48 27 7C BB B7 CF 1E 5B 4F 70 6F 32 51 4F C6 FD 54 26 86 AB 47 12 46 9E D2 FD 72 CA B3 88 A9 66 62 C4 0F F9 50 1B 5A E8 FC 0A 01 CF 24 24 BB 70 D2 B8 D0 68 2B EE 90 96 0E 61 F8 CA 98 68 BE DF BB 24 BA 7C 6C 31 5E 57 51 36 5D E2 1B 06 C1 8A B9 EE 97 81 7B B2 45 C5 E0 66 06 85 F5 1C 21 96 DC F7 2F F7 E8 B6 C9 F3 1B AD 93 A8 AC 69 FC 9A 68 24 A9 92 B8 2B F7 2D 9F 18 38 F1 F0 ED 99 2D 30 DB DC 55 02 50 08 1B 06 99 16 72 29 AD A5 78 21 8B 28 BB 8B 2A AE FF FB 4A 21 58 11 D0 98 68 9F EA 51 13 E2 AA 56 A6 3D B3 08 11 13 38 ED 83 D6 39 A3 D1 C1 E0 E3 A8 4F A4 33 A6 C0 9F 73 E3 44 EC DF 7A CA BE BC BE 84 53 19 49 D8 E0 B4 80 AC 2B 76 5D 93 FC BE 37 98 40 77 A4 D6 50 9F AB 03 1B A2 DC E7 51 E6 E4 8F BC 66 5A F6 86 F0 6D 49 07 55 5E 7B 21 D9 B2 F1 FE FB 90 75 31 50 62 BC 96 5F F6 70 34 96 0A EC 2F 80 56 D5 47 8F 1A BE 14 18 C1 61 F6 4F 65 F7 04 CD AF 90 86 08 83 6D 2B 6C 51 17 6C 03 5B 20 AC 0B 35 6F 61 79 3C 0D 12 00 17 B1 10 BD 51 A6 8D DB EE DB CA B8 07 87 0C BE 01 82 4A AF 4E AF DE E2 70 49 C6 D1 26 AE 90 E9 5D 4E 25 85 5C 4A 80 E1 0E 82 CD D7 82 33 DC 4B 9B 33 20 46 C2 E6 46 2E 0C 16 AB 39 6A 81 FD 68 05 80 EB C5 12 87 A8 D4 D8 9C 17 FF BB 12 99 2B 48 C0 88 B7 2E C9 D1 C6 91 D6 0D 2F 30 D8 CD E4 D7 6C FF E1 3C B8 26 33 CF A1 49 6D 99 19 CC 6E 65 0D 9E DF C4 38 A6 FB A7 BE 00 42 B7 CB 0E BC 43 67 1D 5F F1 9D 8B 8A 47 AC 73 41 65 52 49 5C A9 3B 49 47 80 F1 A2 C9 D9 1D 40 DA BD 58 6C 9B 6D AE A8 A3 B6 A3 75 E3 B3 A6 9F DF DD 87 82 86 34 02 83 8A 77 F2 A5 60 C6 7E D7 1C D2 DD 62 ED 79 84 92 AA 1E 87 9C 05 2F D7 2B 93 A5 98 99 4A 65 D7 0D 5E 9D 61 AE 3D 21 4A FA 82 71 B1 60 DA 2D 60 DF 7E 51 5D 4E 64 EE 17 41 3C BF 49 8C D9 30 64 A0 0A 1A B1 4A 33 21 B0 75 27 A8 E2 61 75 CC 4A 18 76 81 87 59 28 B8 54 46 93 8B 1A 0B 6A AF 85 F2 BD 61 C0 B3 0C 0D 56 93 65 C0 B1 E0 35 54 85 31 27 F6 6E 2A F0 48 ED F8 06 3C BD 99 88 8E 40 AF D4 24 D6 AB 04 EF CA C5 72 5A 25 7D D6 C8 8D 88 0F 18 2B 03 6B E8 CA 12 AF 9B E4 17 A1 4D 21 5E 0D C9 35 F0 99 74 5C 81 CC 0A 17 45 53 3D B6 7F CB 7E F6 34 DB 68 07 98 75 70 F6 4C BD 76 39 0A 4A BA AD 66 ED E6 0A E0 74 5E 61 8A 96 50 50 99 70 99 E7 C5 A5 F6 75 E4 59 22 CA 14 D7 20 5B 09 37 73 3C 85 0C 0F 61 68 BC 86 87 91 3E 9D 11 B5 F7 A6 7A 37 CF B7 64 B7 5E B9 BC F4 F2 DE 23 CD 71 FE 85 F4 C9 2A FB A3 21 91 8C FA 93 64 D9 13 15 60 FD A8 79 B0 77 DD 72 3C 38 F2 81 5A 86 A3 48 03 1B B1 6F 93 1C E4 DE 76 56 D2 22 E0 0B 92 B4 B1 4A 0B EF 6F EC C0 C5 C7 B2 5A 4C 74 41 6D B2 3E 80 DD C9 17 BA 2C 6A C4 D7 F7 C3 22 E4 C6 6F C7 85 66 DF 90 1C 29 3E 81 3A 35 44 C2 C8 FB 37 BB 7B 39 07 2E 4D B6 1B 32 57 4B 9D C4 79 E9 4D FF F7 6A EE 55 C0 62 C6 DA F0 9A B5 80 29 03 A2 22 0A 53 B2 FB 1B 19 77 21 97 9F BA C9 0D FE 48 86 8B 4F B2 58 C6 15 AD 76 67 63 4E 72 66 C8 BA 2D C1 D6 EE 92 85 0C 26 84 32 26 8D 4E 37 1C 94 09 3F D4 D4 A6 B4 10 0A 30 B8 32 2B 7D 3C 78 27 A9 EB 81 F3 DF 27 34 44 29 CB 34 12 F2 71 C0 BE 93 43 8E 2F 90 D9 9A DC FC 37 F7 68 90 C0 12 49 ED 33 B9 1A 9F 0A 06 00 00 D8 02 0B 00 01 00 00 00 98 24 8F 98 1D 8C 5C 87 01 00 00 00	........ ...............n/S.R[...g.t..f..O.........o.g...Z.. Q..A'Mn.........(zs.\|......+.....c.i....p...[a..(/y...AS.b.. ...P.Z..T...#"..9e...;..`..^.8.&{..r..b;.......%G-w...\|pE....@...._>&.9..lS....................}..'....G.M\.7XF`.J.QO..G.v..A....l.-Z.C....0[`...@uW..?+..]......,.......@.....,.c.e....A.?........Y..h..66....../.....j..Hs_Z..M.5....H....X....i..!...Z......$.7.,..........O.%....2.3y....u..t...+U......E.6..C!....a.\..T.%....4..s.`M.kd....'.r)..."........0...........<.....M...P........6..K....Q...J.....[.7...ZGYR.PW~p..{..b..........P.ruO.]E.....Mu....`..0Bc4...%&.C4+.p-.).S...[h.e...F....p....l]..Sa.<.1Wy.$...Z0.-.f\.....y}..4...`sh~..P.o.L.n.^.H..J....H...k...A...>.<.Lm..........;..%.....)..w..._.U.c%.3zr.....1....#=x'..\|.}......@.....e..\|5......Z........m..u#.....d.H.@..7d.L.....y.eM....N.:T.........F.1...O.XW}h./[N.7=X..2.s..a9....5m.Sl-....\.....0.b....I.8...p..vBJ..[u..6F.V.Y`...P0!GZ%Vz....e..[.........t...)..;L....r.1...G..v.?....Z.JF....1.E.w..v...A%emC{......T...u......}..}.v.q.......R.u...:..z<.....e....a...C[..U W.K.....RI..(.}7.K9..._.....>....b........dv&.}..pZ..b...s4..b...2\|-.?i.:.LI.=gy../.v..N......ED...dz{..l#3z~j...V-h.f...y...&...sR..S.{..Q..X$...).....K.^^.[...a......R...._Z...$_.../.+..B..y..l.,......w4..ZI.. ,a.zJ..sJ.f,....y...Q.?.Y....t...'..2...?....=.8O.#G.$.X....k2...L.h...rzy.......0W.?........>t`...x......<... ..SJ...f.!..l{..?'..7....: ...5[...@.>.f.c.....Wf...%.1. w..E.8Z..../.Bo..4...Ml.W.&E$..Vw.t..ew...P8S!......?...S........E.`d..9.&.o.....1.D..g...$.~..%q.....~fI....1x}..i.T.6.7..f..N[..o!.......:.8U.c.wY!=H'\|....[Opo2QO..T&..G.F...r....fb...P.Z.....$$.p...h+....a...h...$.\|l1^WQ6].........{.E..f....!.../..........i..h$...+.-..8....-0..U.P.....r)..x!.(.....J!X...h..Q...V.=....8...9......O.3...s.D..z.....S.I.....+v]...7.@w..P.......Q....fZ...mI.U^{!......u1Pb.._.p4.../.V.G......a.Oe........m+lQ.l.[ ..5oay<.......Q.............J.N...pI..&...]N%.\J.......3.K.3 F..F....9j..h...............+H........../0....l..<.&3..Im...ne....8.....B....Cg._....G.sAeRI\.;IG......@..Xl.m.....u.........4...w..`.~....b.y......./.+....Je..^.a.=!J..q.`.-`.~Q]Nd..A<.I..0d....J3!.u'..au.J.v..Y(.TF....j....a....V.e...5T.1'.n.H...<....@..$......rZ%}......+.k........M!^..5..t\....ES=...~.4.h..up.L.v9.J..f....t^a..PP.p.....u.Y"... [.7s<...ah....>.....z7..d.^.....#.q....*..!....d...`..y.w.r<8..Z..H...o....vV.".....J..o.....ZLtAm.>.....,j...."..o..f...)>.:5D...7.{9..M..2WK..y.M..j.U.b......)..".S....w!......H..O.X...vgcNrf..-......&.2&.N7...?......0.2+}<x'.....'4D).4..q...C./.....7.h...I.3................$....\.....	pending	1	7C80B729	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file		success or wait	1	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file		success or wait	3	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Local Settings\History	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file		success or wait	1	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file		success or wait	3	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 00:20 25-07-2012 Change Time: 01:00 01-01-1601 File Attributes: none		success or wait	1	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Cookies	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file		success or wait	1	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Cookies\index.dat	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 00:20 25-07-2012 Change Time: 01:00 01-01-1601 File Attributes: none		success or wait	1	10002055	InternetGetConnectedState
C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 00:20 25-07-2012 Change Time: 01:00 01-01-1601 File Attributes: none		success or wait	1	10002055	InternetGetConnectedState
\ROUTER	PipeInformation	unknown		success or wait	2	7C80B729	unknown
\ROUTER	CompletionInformation	unknown		success or wait	2	7C80B729	unknown
\lsarpc	PipeInformation	unknown		success or wait	6	10002055	InternetGetConnectedState
\lsarpc	CompletionInformation	unknown		success or wait	6	10002055	InternetGetConnectedState
\AsyncConnectHlp	CompletionInformation	unknown		success or wait	1	1000215C	HttpSendRequestA

Section Activites

Section loaded by Windows

File Path	Access	Type	Base	Size	Mapped to pid	Protection	Completion	Count
\KnownDlls\kernel32.dll	write and read and execute	unknown	7C800000	1007616	own pid	read write	success or wait	1
unknown	query and write and read and execute and extend size	reserve	7C800000	1007616	own pid	read write	success or wait	1
\NLS\NlsSectionUnicode	read	unknown	1B0000	90112	own pid	readonly	success or wait	1
\NLS\NlsSectionLocale	read	unknown	1D0000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey	query and read	unknown	220000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortTbls	read	unknown	270000	24576	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\KnownDlls\msvcrt.dll	write and read and execute	unknown	77C10000	360448	own pid	read write	success or wait	1
\KnownDlls\GDI32.dll	write and read and execute	unknown	77F10000	299008	own pid	read write	success or wait	1
\KnownDlls\USER32.dll	write and read and execute	unknown	7E410000	593920	own pid	read write	success or wait	1
\KnownDlls\IMAGEHLP.dll	write and read and execute	unknown	76C90000	163840	own pid	read write	success or wait	1
\KnownDlls\ShimEng.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\shimeng.dll	query and write and read and execute	image	5CB70000	155648	own pid	read write	success or wait	1
C:\WINDOWS\AppPatch\sysmain.sdb	read	commit	280000	1208320	own pid	readonly	success or wait	1
C:\WINDOWS\AppPatch\acgenral.dll	write and read and execute	commit	3C0000	1855488	own pid	execute	success or wait	1
C:\WINDOWS\AppPatch\acgenral.dll	write and read and execute	commit	3C0000	1855488	own pid	execute	success or wait	1
C:\WINDOWS\AppPatch\acgenral.dll	query and write and read and execute	image	6F880000	1875968	own pid	read write	success or wait	1
\KnownDlls\ADVAPI32.dll	write and read and execute	unknown	77DD0000	634880	own pid	read write	success or wait	1
\KnownDlls\RPCRT4.dll	write and read and execute	unknown	77E70000	602112	own pid	read write	success or wait	1
\KnownDlls\Secur32.dll	write and read and execute	unknown	77FE0000	69632	own pid	read write	success or wait	1
\KnownDlls\WINMM.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\winmm.dll	query and write and read and execute	image	76B40000	184320	own pid	read write	success or wait	1
\KnownDlls\ole32.dll	write and read and execute	unknown	774E0000	1302528	own pid	read write	success or wait	1
\KnownDlls\OLEAUT32.dll	write and read and execute	unknown	77120000	569344	own pid	read write	success or wait	1
\KnownDlls\MSACM32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msacm32.dll	query and write and read and execute	image	77BE0000	86016	own pid	read write	success or wait	1
\KnownDlls\VERSION.dll	write and read and execute	unknown	77C00000	32768	own pid	read write	success or wait	1
\KnownDlls\SHELL32.dll	write and read and execute	unknown	7C9C0000	8482816	own pid	read write	success or wait	1
\KnownDlls\SHLWAPI.dll	write and read and execute	unknown	77F60000	483328	own pid	read write	success or wait	1
\KnownDlls\USERENV.dll	write and read and execute	unknown	769C0000	737280	own pid	read write	success or wait	1
\KnownDlls\UxTheme.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\uxtheme.dll	query and write and read and execute	image	5AD70000	229376	own pid	read write	success or wait	1
\NLS\NlsSectionCType	read	unknown	3D0000	12288	own pid	readonly	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	350000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	350000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	query and write and read and execute	image	76390000	118784	own pid	read write	success or wait	1
C:\WINDOWS\system32\shell32.dll	read	commit	1010000	8462336	own pid	readonly	success or wait	1
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	write and read and execute	commit	9B0000	1056768	own pid	execute	success or wait	1
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	query and write and read and execute	image	773D0000	1060864	own pid	read write	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	write and read and execute	commit	380000	4096	own pid	execute	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	query and read	commit	380000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	read	commit	380000	4096	own pid	readonly	success or wait	1
\KnownDlls\comctl32.dll	write and read and execute	unknown	5D090000	630784	own pid	read write	success or wait	1
C:\WINDOWS\system32\comctl32.dll	read	commit	9B0000	618496	own pid	readonly	success or wait	1
C:\Documents and Settings\Administrator\Application Data\taskman.dll	read	commit	9B0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\msctf.dll	write and read and execute	commit	9B0000	299008	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctf.dll	query and write and read and execute	image	74720000	311296	own pid	read write	success or wait	1
\BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-507921405-1960408961-839522115-500	query and write and read	commit	unknown	unknown	unknown	unknown	object name exists	1
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500SFM.DefaultS-1-5-21-507921405-1960408961-839522115-500	query and write and read and execute and extend size	unknown	9C0000	262144	own pid	read write	success or wait	1
C:\WINDOWS\system32\msctfime.ime	write and read and execute	commit	A00000	180224	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctfime.ime	query and read	commit	A00000	180224	own pid	readonly	success or wait	1
C:\WINDOWS\system32\msctfime.ime	write and read and execute	commit	A00000	180224	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctfime.ime	query and read	commit	A00000	180224	own pid	readonly	success or wait	1
\BaseNamedObjects\ShimSharedMemory	write	unknown	A00000	57344	own pid	read write	success or wait	1
C:\WINDOWS\system32\msctfime.ime	write and read and execute	commit	A10000	180224	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctfime.ime	query and write and read and execute	image	755C0000	188416	own pid	read write	success or wait	1
C:\WINDOWS\system32\mswsock.dll	write and read and execute	commit	BC0000	245760	own pid	execute	success or wait	1
C:\WINDOWS\system32\mswsock.dll	query and write and read and execute	image	71A50000	258048	own pid	read write	success or wait	1
\KnownDlls\DNSAPI.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\dnsapi.dll	query and write and read and execute	image	76F20000	159744	own pid	read write	success or wait	1
C:\WINDOWS\system32\winrnr.dll	write and read and execute	commit	BC0000	20480	own pid	execute	success or wait	1
C:\WINDOWS\system32\winrnr.dll	query and write and read and execute	image	76FB0000	32768	own pid	read write	success or wait	1
\KnownDlls\WLDAP32.dll	write and read and execute	unknown	76F60000	180224	own pid	read write	success or wait	1
\KnownDlls\rasadhlp.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\rasadhlp.dll	query and write and read and execute	image	76FC0000	24576	own pid	read write	success or wait	1
\BaseNamedObjects\Local\C:_Documents and Settings_Administrator_Local Settings_Temporary Internet Files_Content.IE5_index.dat_65536	write	unknown	BD0000	65536	own pid	read write	success or wait	1
\BaseNamedObjects\Local\C:_Documents and Settings_Administrator_Cookies_index.dat_32768	write	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\C:_Documents and Settings_Administrator_Cookies_index.dat_32768	query and write and read	commit	BE0000	32768	own pid	read write	success or wait	1
\BaseNamedObjects\Local\C:_Documents and Settings_Administrator_Local Settings_History_History.IE5_index.dat_32768	write	unknown	BF0000	32768	own pid	read write	success or wait	1
\KnownDlls\RASAPI32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\rasapi32.dll	query and write and read and execute	image	76EE0000	245760	own pid	read write	success or wait	1
\KnownDlls\rasman.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\rasman.dll	query and write and read and execute	image	76E90000	73728	own pid	read write	success or wait	1
\KnownDlls\NETAPI32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\netapi32.dll	query and write and read and execute	image	5B860000	348160	own pid	read write	success or wait	1
\KnownDlls\TAPI32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\tapi32.dll	query and write and read and execute	image	76EB0000	192512	own pid	read write	success or wait	1
\KnownDlls\rtutils.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\rtutils.dll	query and write and read and execute	image	76E80000	57344	own pid	read write	success or wait	1
C:\WINDOWS\system32\tapi32.dll	read	commit	C80000	184320	own pid	readonly	success or wait	1
\KnownDlls\msapsspc.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msapsspc.dll	query and write and read and execute	image	71E50000	86016	own pid	read write	success or wait	1
\KnownDlls\MSVCRT40.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msvcrt40.dll	query and write and read and execute	image	78080000	69632	own pid	read write	success or wait	1
\KnownDlls\schannel.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\schannel.dll	query and write and read and execute	image	767F0000	163840	own pid	read write	success or wait	1
\KnownDlls\CRYPT32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\crypt32.dll	query and write and read and execute	image	77A80000	610304	own pid	read write	success or wait	1
\KnownDlls\MSASN1.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msasn1.dll	query and write and read and execute	image	77B20000	73728	own pid	read write	success or wait	1
\KnownDlls\digest.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\digest.dll	query and write and read and execute	image	75B00000	86016	own pid	read write	success or wait	1
\KnownDlls\msnsspc.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msnsspc.dll	query and write and read and execute	image	747B0000	290816	own pid	read write	success or wait	1
\KnownDlls\MSVCRT40.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msvcrt40.dll	query and write and read and execute	image	78080000	69632	own pid	read write	success or wait	1
\KnownDlls\sensapi.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\sensapi.dll	query and write and read and execute	image	722B0000	20480	own pid	read write	success or wait	1
\BaseNamedObjects\SENS Information Cache	read	unknown	C80000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\msv1_0.dll	write and read and execute	commit	CC0000	139264	own pid	execute	success or wait	1
C:\WINDOWS\system32\msv1_0.dll	query and write and read and execute	image	77C70000	151552	own pid	read write	success or wait	1
\KnownDlls\cryptdll.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\cryptdll.dll	query and write and read and execute	image	76790000	49152	own pid	read write	success or wait	1
\KnownDlls\iphlpapi.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\iphlpapi.dll	query and write and read and execute	image	76D60000	102400	own pid	read write	success or wait	1
C:\WINDOWS\system32\mscoree.dll	write and read and execute	commit	CC0000	299008	own pid	execute	success or wait	1
C:\WINDOWS\system32\mscoree.dll	query and read	commit	CC0000	299008	own pid	readonly	success or wait	1
C:\WINDOWS\system32\mscoree.dll	write and read and execute	commit	CC0000	299008	own pid	execute	success or wait	1
C:\WINDOWS\system32\mscoree.dll	query and read	commit	CC0000	299008	own pid	readonly	success or wait	1
\BaseNamedObjects\Local\UrlZonesSM_Administrator	query and write and read	commit	unknown	unknown	unknown	unknown	object name exists	1
\KnownDlls\hnetcfg.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\hnetcfg.dll	query and write and read and execute	image	662B0000	360448	own pid	read write	success or wait	1
C:\WINDOWS\system32\wshtcpip.dll	write and read and execute	commit	CE0000	20480	own pid	execute	success or wait	1
C:\WINDOWS\system32\wshtcpip.dll	query and write and read and execute	image	71A90000	32768	own pid	read write	success or wait	1

Section loaded by Program

File Path	Access	Type	Base	Size	Mapped to pid	Protection	Completion	Count	Source Address
C:\Documents and Settings\Administrator\Application Data\taskman.dll	write and read and execute	commit	9B0000	61440	own pid	execute	success or wait	1	1001792
C:\Documents and Settings\Administrator\Application Data\taskman.dll	query and write and read and execute	image	10000000	61440	own pid	read write	success or wait	1	1001792
\KnownDlls\WS2_32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1	1001792
C:\WINDOWS\system32\ws2_32.dll	query and write and read and execute	image	71AB0000	94208	own pid	read write	success or wait	1	1001792
\KnownDlls\WS2HELP.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1	1001792
C:\WINDOWS\system32\ws2help.dll	query and write and read and execute	image	71AA0000	32768	own pid	read write	success or wait	1	1001792
\KnownDlls\WININET.dll	write and read and execute	unknown	3D930000	942080	own pid	read write	success or wait	1	10001A80
\KnownDlls\Normaliz.dll	write and read and execute	unknown	A10000	36864	own pid	read write	conflicting addresses	1	10001A80
\KnownDlls\urlmon.dll	write and read and execute	unknown	78130000	1257472	own pid	read write	success or wait	1	10001A80
\KnownDlls\iertutil.dll	write and read and execute	unknown	3DFD0000	2002944	own pid	read write	success or wait	1	10001A80

Registry Activites

Key Path	Key Value Name	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ProxyServer	object name not found	2	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ProxyOverride	object name not found	2	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	AutoConfigURL	object name not found	2	10002055	InternetGetConnectedState

Key Value Created

Key Path	Name	Type	Data	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run	rundll32.exe	unicode	rundll32.exe "C:\Documents and Settings\Administrator\Application Data\taskman.dll",start	success or wait	1	10002781	RegSetValueExA

Key Path	Name	Type	Old Data	New Data	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SavedLegacySettings	binary	46 00 00 00 9B 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 10 C5 45 3D 26 AB CA 01 01 00 00 00 0A 00 02 0F 00 00 00 00 00 00 00 00 00 00 00 00	46 00 00 00 9C 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 10 C5 45 3D 26 AB CA 01 01 00 00 00 0A 00 02 0F 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SavedLegacySettings	binary	46 00 00 00 9C 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 10 C5 45 3D 26 AB CA 01 01 00 00 00 0A 00 02 0F 00 00 00 00 00 00 00 00 00 00 00 00	46 00 00 00 9D 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 10 C5 45 3D 26 AB CA 01 01 00 00 00 0A 00 02 0F 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	1000215C	HttpSendRequestA

Key Value Queried

Key Path	Name	Completion	Count	Source Address	Symbol
HKEY_LOCAL_MACHINE\SOFTWARE\Classes	CWDIllegalInDLLSearch	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server	TSAppCompat	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter	Installed	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	SafeDllSearchMode	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize	DisableMetaFiles	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows	AppInit_DLLs	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	LeakTrack	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaProperties\PrivateProperties\Joystick\Winmm	wheel	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CriticalSectionTimeout	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	RWLockResourceTimeOut	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAllForOle32	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableTypeLib	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAllForOle32	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Multimedia\Audio	SystemFormats	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.imaadpcm	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.imaadpcm	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msadpcm	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msadpcm	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg711	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg711	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msgsm610	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msgsm610	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.trspch	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.trspch	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg723	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg723	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msaudio1	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msaudio1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.sl_anet	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.sl_anet	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.iac2	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.iac2	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.l3acm	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.l3acm	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM	NoPCMConverter	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00	Priority1	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	EnableBalloonTips	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	ChkAccDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions	ProductType	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Personal	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Local Settings	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	RsopDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	RsopLogging	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	RsopLogging	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\ThemeManager	Compositing	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	LameButtonText	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared	CUAS	success or wait	1	1001412	CreateWindowExW
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	1001412	CreateWindowExW
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	1001412	CreateWindowExW
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	1001412	CreateWindowExW
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	1001412	CreateWindowExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF	EnableAnchorContext	object name not found	1	1001412	CreateWindowExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM	Ime File	success or wait	1	1001412	CreateWindowExW
HKEY_USERS\Software\Microsoft\CTF	Disable Thread Input Manager	object name not found	1	1001412	CreateWindowExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared	CUAS	success or wait	1	1001412	CreateWindowExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	DisableImprovedZoneCheck	object name not found	1	10001A80	LoadLibraryA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN	rundll32.exe	object name not found	1	10001A80	LoadLibraryA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN	*	object name not found	1	10001A80	LoadLibraryA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	AppData	success or wait	1	10002A1F	SHGetSpecialFolderPathA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters	WinSock_Registry_Version	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters	WinSock_Registry_Version	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9	Serial_Access_Num	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9	Serial_Access_Num	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9	Next_Catalog_Entry_ID	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9	Num_Catalog_Entries	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013	PackedCatalogItem	buffer overflow	2	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013	PackedCatalogItem	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5	Serial_Access_Num	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5	Serial_Access_Num	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5	Num_Catalog_Entries	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001	LibraryPath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001	LibraryPath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001	DisplayString	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001	DisplayString	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001	DisplayString	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001	DisplayString	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001	ProviderId	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001	AddressFamily	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001	SupportedNameSpace	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001	Enabled	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001	Version	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001	StoresServiceClassInfo	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002	LibraryPath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002	LibraryPath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002	DisplayString	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002	DisplayString	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002	DisplayString	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002	DisplayString	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002	ProviderId	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002	AddressFamily	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002	SupportedNameSpace	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002	Enabled	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002	Version	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002	StoresServiceClassInfo	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003	LibraryPath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003	LibraryPath	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003	DisplayString	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003	DisplayString	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003	DisplayString	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003	DisplayString	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003	ProviderId	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003	AddressFamily	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003	SupportedNameSpace	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003	Enabled	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003	Version	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003	StoresServiceClassInfo	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters	Ws2_32NumHandleBuckets	object name not found	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	QueryAdapterName	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	DisableAdapterDomainName	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	UseDomainNameDevolution	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	UseDomainNameDevolution	success or wait	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	PrioritizeRecordData	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	PrioritizeRecordData	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	AllowUnqualifiedQuery	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	AllowUnqualifiedQuery	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	AppendToMultiLabelName	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	ScreenBadTlds	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	ScreenUnreachableServers	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	FilterClusterIp	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	WaitForNameErrorOnAll	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	UseEdns	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	QueryIpMatching	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	UseHostsFile	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	RegistrationEnabled	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	DisableDynamicUpdate	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	RegisterPrimaryName	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	RegisterAdapterName	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	EnableAdapterDomainNameRegistration	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	RegisterReverseLookup	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	DisableReverseAddressRegistrations	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	RegisterWanAdapters	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	DisableWanDynamicUpdate	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	RegistrationTtl	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	DefaultRegistrationTTL	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	RegistrationRefreshInterval	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	DefaultRegistrationRefreshInterval	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	RegistrationMaxAddressCount	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	MaxNumberOfAddressesToRegister	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	UpdateSecurityLevel	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	UpdateSecurityLevel	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	UpdateZoneExcludeFile	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	UpdateTopLevelDomainZones	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	DnsTest	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	MaxCacheSize	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	MaxCacheTtl	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	MaxNegativeCacheTtl	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	AdapterTimeoutLimit	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	ServerPriorityTimeLimit	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	MaxCachedSockets	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	MulticastListenLevel	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters	MulticastSendLevel	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	DnsQueryTimeouts	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	DnsQuickQueryTimeouts	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	DnsMulticastQueryTimeouts	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc	MaxRpcSize	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Hostname	success or wait	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Hostname	success or wait	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Domain	success or wait	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Domain	success or wait	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	DnsNbtLookupOrder	object name not found	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ldap	LdapClientIntegrity	success or wait	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Hostname	success or wait	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Hostname	success or wait	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Domain	success or wait	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Domain	success or wait	1	10001EEC	gethostname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Hostname	success or wait	1	10001EF9	gethostbyname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Hostname	success or wait	1	10001EF9	gethostbyname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Domain	success or wait	1	10001EF9	gethostbyname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Domain	success or wait	1	10001EF9	gethostbyname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters	WinSock_Registry_Version	success or wait	1	10001EF9	gethostbyname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters	WinSock_Registry_Version	success or wait	1	10001EF9	gethostbyname
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters	AutodialDLL	object name not found	1	10001EF9	gethostbyname
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	User Agent	success or wait	1	10001E58	RegQueryValueExA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	User Agent	success or wait	1	10001E58	RegDeleteValueW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	FromCacheTimeout	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	SecureProtocols	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	CertificateRevocation	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	CertificateRevocation	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DisableKeepAlive	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DisablePassport	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	IdnEnabled	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	CacheMode	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EnableHttp1_1	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ProxyHttp1.1	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ProxyHttp1.1	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EnableNegotiate	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DisableBasicOverClearChannel	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl	Feature_ClientAuthCertFilter	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ClientAuthBuiltInUI	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	SyncMode5	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	SessionStartTimeDefaultDeltaSecs	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	Signature	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	Signature	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content	PerUserItem	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Cache	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content	CacheLimit	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies	PerUserItem	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Cookies	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies	CacheLimit	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History	PerUserItem	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	History	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History	CacheLimit	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat	CacheRepair	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat	CachePath	buffer overflow	2	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat	CachePath	success or wait	2	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat	CacheLimit	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat	CacheOptions	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat	CacheRepair	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat	CachePath	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat	CachePath	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat	CacheLimit	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat	CacheOptions	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld	CacheRepair	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld	CachePath	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld	CachePath	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld	CacheLimit	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld	CacheOptions	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725	CacheRepair	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725	CachePath	buffer overflow	2	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725	CachePath	success or wait	2	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725	CacheLimit	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725	CacheOptions	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE:	CacheRepair	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE:	CachePath	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE:	CachePath	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE:	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE:	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE:	CacheLimit	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE:	CacheOptions	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData	CacheRepair	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData	CachePath	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData	CachePath	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData	CachePrefix	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData	CacheLimit	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData	CacheOptions	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DisableWorkerThreadHibernation	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	DisableWorkerThreadHibernation	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DisableReadRange	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	SocketSendBufferLength	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	SocketReceiveBufferLength	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	KeepAliveTimeout	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MaxHttpRedirects	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MaxConnectionsPerServer	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	MaxConnectionsPerServer	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MaxConnectionsPer1_0Server	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	MaxConnectionsPer1_0Server	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MaxConnectionsPerProxy	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ServerInfoTimeout	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ConnectTimeOut	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ConnectTimeOut	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ConnectRetries	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ConnectRetries	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	SendTimeOut	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	SendTimeOut	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ReceiveTimeOut	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ReceiveTimeOut	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DisableNTLMPreAuth	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ScavengeCacheLowerBound	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	CertCacheNoValidate	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	ScavengeCacheFileLifeTime	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	ScavengeCacheFileLimit	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache	ScavengeCacheFileLimit	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	HttpDefaultExpiryTimeSecs	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	FtpDefaultExpiryTimeSecs	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK	rundll32.exe	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK	*	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DisableCachingOfSSLPages	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	PerUserCookies	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	LeashLegacyCookies	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DisableNT4RasCheck	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DialupUseLanSettings	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	DialupUseLanSettings	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	SendExtraCRLF	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	BypassFtpTimeCheck	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ReleaseSocketDuringAuth	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ReleaseSocketDuring401Auth	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ReleaseSocketDuring401Auth	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WpadSearchAllDomains	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DisableLegacyPreAuthAsServer	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	DisableLegacyPreAuthAsServer	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	BypassHTTPNoCacheCheck	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	BypassHTTPNoCacheCheck	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	BypassSSLNoCacheCheck	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	BypassSSLNoCacheCheck	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	EnableHttpTrace	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	NoCheckAutodialOverRide	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	NoCheckAutodialOverRide	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DontUseDNSLoadBalancing	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	DontUseDNSLoadBalancing	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ShareCredsWithWinHttp	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MimeExclusionListForCache	success or wait	4	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	HeaderExclusionListForCache	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DnsCacheEnabled	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DnsCacheEntries	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	DnsCacheTimeout	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WarnOnPost	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WarnAlwaysOnPost	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WarnOnZoneCrossing	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WarnOnBadCertSending	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WarnOnBadCertRecving	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WarnOnPostRedirect	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	AlwaysDrainOnRedirect	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	WarnOnHTTPSToHTTPRedirect	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	GlobalUserOffline	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EnableAutodial	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	UrlEncoding	success or wait	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	UrlEncoding	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	TruncateFileName	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	BadProxyExpiresTime	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony	Tapi32MaxNumRequestRetries	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony	Tapi32RequestRetryTimeout	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing	EnableConsoleTracing	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	EnableFileTracing	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	FileTracingMask	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	EnableConsoleTracing	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	ConsoleTracingMask	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	MaxFileSize	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	FileDirectory	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	FileDirectory	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	EnableFileTracing	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	FileTracingMask	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	EnableConsoleTracing	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	ConsoleTracingMask	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	MaxFileSize	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	FileDirectory	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32	FileDirectory	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Common AppData	success or wait	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList	ProfilesDirectory	success or wait	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList	AllUsersProfile	success or wait	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	2	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList	ProfilesDirectory	success or wait	2	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList	DefaultUserProfile	success or wait	2	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	ProgramFilesDir	success or wait	2	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	CommonFilesDir	success or wait	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService	10	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders	SecurityProviders	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders	SecurityProviders	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	2	71E560A3	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	ProfileImagePath	success or wait	2	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Winlogon	ParseAutoexec	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	AppData	success or wait	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList	ProfilesDirectory	success or wait	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList	AllUsersProfile	success or wait	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	CommonFilesDir	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Winlogon	ParseAutoexec	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EnableAutodial	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Name	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Name	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Comment	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Comment	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Capabilities	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	RpcId	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Version	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	Type	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll	TokenSize	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Name	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Name	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Comment	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Comment	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Capabilities	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	RpcId	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Version	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	Type	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll	TokenSize	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Name	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Name	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Comment	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Comment	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Capabilities	success or wait	1	7C80B729	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	RpcId	success or wait	1	7C80B729	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MigrateProxy	success or wait	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Version	success or wait	1	7C80B729	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ProxyEnable	success or wait	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	Type	success or wait	1	7C80B729	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ProxyServer	object name not found	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll	TokenSize	success or wait	1	7C80B729	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ProxyOverride	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	AutoConfigURL	object name not found	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SavedLegacySettings	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SavedLegacySettings	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	DefaultConnectionSettings	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	DefaultConnectionSettings	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SavedLegacySettings	success or wait	1	10002055	InternetGetConnectedState
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SavedLegacySettings	success or wait	1	10002055	InternetGetConnectedState
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING	rundll32.exe	object name not found	1	100020F6	HttpOpenRequestA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING	*	object name not found	1	100020F6	HttpOpenRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EnableAutodial	object name not found	3	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EnableAutodial	object name not found	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Internet Explorer\IETld	IETldDllVersionLow	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Internet Explorer\IETld	IETldDllVersionHigh	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Internet Explorer\IETld	IETldVersionLow	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Internet Explorer\IETld	IETldVersionHigh	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Internet Explorer\Security	DisableSecuritySettingsCheck	object name not found	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security	DisableSecuritySettingsCheck	object name not found	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0	Flags	success or wait	2	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1	Flags	success or wait	2	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2	Flags	success or wait	2	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	Flags	success or wait	2	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4	Flags	success or wait	2	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	rundll32.exe	object name not found	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN	*	object name not found	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	CreateUriCacheSize	object name not found	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	CreateUriCacheSize	object name not found	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EnablePunycode	object name not found	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	EnablePunycode	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Internet Explorer\Security	DisableSecuritySettingsCheck	object name not found	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security	DisableSecuritySettingsCheck	object name not found	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EnableAutodial	object name not found	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	DefaultConnectionSettings	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	DefaultConnectionSettings	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SavedLegacySettings	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SavedLegacySettings	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap	AutoDetect	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3	1A10	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EnableAutodial	object name not found	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService	DefaultAuthLevel	object name not found	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock\Parameters	Transports	success or wait	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock\Parameters	Transports	success or wait	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock	Mapping	buffer overflow	2	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock	Mapping	success or wait	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock	MinSockaddrLength	success or wait	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock	MaxSockaddrLength	success or wait	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock	UseDelayedAcceptance	success or wait	1	1000215C	HttpSendRequestA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock	HelperDllName	success or wait	1	1000215C	HttpSendRequestA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	User Agent	success or wait	1	10001E58	RegQueryValueExA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	User Agent	success or wait	1	10001E58	RegDeleteValueW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EnableAutodial	object name not found	1	1000131A	InternetOpenUrlA
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings	EnableAutodial	object name not found	1	1000131A	InternetOpenUrlA

Mutex Activites

Name	Completion	Count	Source Address	Symbol
\BaseNamedObjects\SHIMLIB_LOG_MUTEX	object name exists	1	7C90E457	KiUserApcDispatcher
\BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	1001412	CreateWindowExW
\BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	1001412	CreateWindowExW
\BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	1001412	CreateWindowExW
\BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	1001412	CreateWindowExW
\BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	1001412	CreateWindowExW
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500MUTEX.DefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	1001412	CreateWindowExW
unknown	success or wait	2	10002055	InternetGetConnectedState
\BaseNamedObjects\RasPbFile	access denied	1	10002055	InternetGetConnectedState
\BaseNamedObjects\Local\ZonesCounterMutex	object name exists	1	1000215C	HttpSendRequestA
\BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex	object name exists	2	1000215C	HttpSendRequestA
\BaseNamedObjects\Local\ZonesCacheCounterMutex	object name exists	1	1000215C	HttpSendRequestA
\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex	object name exists	1	1000215C	HttpSendRequestA

Process Activites

PID	Process info class	Completion	Count	Source Address	Symbol
760	Cookie	success or wait	5	7C90E457	KiUserApcDispatcher
760	Wow64Information	success or wait	4	7C90E457	KiUserApcDispatcher
760	ImageInformation	success or wait	1	7C90E457	KiUserApcDispatcher
760	SessionInformation	success or wait	1	7C90E457	KiUserApcDispatcher
760	DefaultHardErrorMode	success or wait	33	1001A30	SetErrorMode
760	QuotaLimits	success or wait	1	10001EEC	gethostname
760	VmCounters	success or wait	1	10001EEC	gethostname

Thread Activites

Thread Created

TID	PID	EIP	EAX (Usermode EIP)	Filepath	Completion	Count	Source Address	Symbol
928	760	7C8106F9	77DF848A	C:\WINDOWS\system32\rundll32.exe	success or wait	1	10001A80	LoadLibraryA
1524	760	7C8106F9	100025BA	C:\WINDOWS\system32\rundll32.exe	success or wait	1	10002D6D	CreateThread
1300	760	7C8106F9	7C927D83	C:\WINDOWS\system32\rundll32.exe	success or wait	1	10002055	InternetGetConnectedState
1120	760	7C8106F9	7C910250	C:\WINDOWS\system32\rundll32.exe	success or wait	1	10002055	InternetGetConnectedState
812	760	7C8106F9	71A5D2C6	C:\WINDOWS\system32\rundll32.exe	success or wait	1	1000215C	HttpSendRequestA

TID	PID	Path	Completion	Count	Source Address	Symbol
928	760	C:\WINDOWS\system32\rundll32.exe	success or wait	1	10001A80	LoadLibraryA
1524	760	C:\WINDOWS\system32\rundll32.exe	success or wait	1	10002D6D	CreateThread
1300	760	C:\WINDOWS\system32\rundll32.exe	success or wait	1	10002055	InternetGetConnectedState
1120	760	C:\WINDOWS\system32\rundll32.exe	success or wait	1	10002055	InternetGetConnectedState
812	760	C:\WINDOWS\system32\rundll32.exe	success or wait	1	1000215C	HttpSendRequestA

Thread Delayed

TID	Delay	Completion	Count	Source Address	Symbol
1300	-922337203685s	unknown	1	7C80B729	unknown
1524	-10800s	unknown	1	1000271C	Sleep

TID	PID	Completion	Count	Source Address	Symbol
1120	760	unknown	1	7C80B729	unknown

Memory Activites

PID	Filepath	Base	Length	Protection	Completion	Count	Source Address	Symbol
760	C:\WINDOWS\system32\rundll32.exe	90000	7FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	90000	7FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	91000	7F7F4	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	190000	7FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	190000	7FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	1A0000	7F340	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	93000	7F21C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	1A1000	7F168	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	3B0000	7F0C8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	3B0000	7F0CC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	3B2000	7EB64	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	3B3000	7EEA8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	3C0000	7E978	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	3C0000	7E97C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	3C1000	7E658	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	3C3000	7E6FC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	3E0000	7F04C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	3E0000	7F050	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	3E1000	7ED2C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	30000	7F91C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	30000	7F920	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	31000	7F5FC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	33000	7F6B8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	94000	7F02C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	830000	7F9A0	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	830000	7F9A4	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	95000	7F694	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	930000	7F52C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	930000	7F528	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	96000	7F56C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	97000	7EF90	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	98000	7F188	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	99000	7EFB0	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	380000	7F1B8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	380000	7F1BC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	381000	7EE98	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	383000	7EF3C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	34000	7EE98	page read and write	success or wait	1	10002DC5	??2@YAPAXI@Z
760	C:\WINDOWS\system32\rundll32.exe	9A000	7ED08	page read and write	success or wait	1	1001412	CreateWindowExW
760	C:\WINDOWS\system32\rundll32.exe	9B000	7EDE8	page read and write	success or wait	1	10001A80	LoadLibraryA
760	C:\WINDOWS\system32\rundll32.exe	9C000	7F4C8	page read and write	success or wait	1	10001A80	LoadLibraryA
760	C:\WINDOWS\system32\rundll32.exe	A30000	7F714	page read and write	success or wait	1	10001A80	LoadLibraryA
760	C:\WINDOWS\system32\rundll32.exe	A30000	7F718	page read and write	success or wait	1	10001A80	LoadLibraryA
760	C:\WINDOWS\system32\rundll32.exe	A31000	7F3F4	page read and write	success or wait	1	10001A80	LoadLibraryA
760	C:\WINDOWS\system32\rundll32.exe	A33000	7F38C	page read and write	success or wait	1	10001A80	LoadLibraryA
760	C:\WINDOWS\system32\rundll32.exe	B30000	7F164	page read and write	success or wait	1	10001A80	LoadLibraryA
760	C:\WINDOWS\system32\rundll32.exe	B63000	7F160	page read and write	success or wait	1	10001A80	LoadLibraryA
760	C:\WINDOWS\system32\rundll32.exe	A35000	7F2F8	page read and write	success or wait	1	10001A80	LoadLibraryA
760	C:\WINDOWS\system32\rundll32.exe	B80000	7FAA4	page read and write	success or wait	1	10002D6D	CreateThread
760	C:\WINDOWS\system32\rundll32.exe	BB3000	7FAA0	page read and write	success or wait	1	10002D6D	CreateThread

PID	Filepath	Base	Length	New Protection	Old Protection	Completion	Count	Source Address	Symbol
760	C:\WINDOWS\system32\rundll32.exe	7C801000	1000	page read and write	page execute read	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	7C801000	1000	page execute read	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77C11000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77C11000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	1001000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	1001000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77F11000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77F11000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	7E411000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	7E411000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	76C91000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	76C91000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	5CB71000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	5CB71000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	6F881000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	6F881000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77DD1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77DD1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77E71000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77E71000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77FE1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77FE1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	76B41000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	76B41000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	774E1000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	774E1000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77121000	1000	page read and write	page execute read	success or wait	6	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77121000	1000	page execute read	page read and write	success or wait	6	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77BE1000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77BE1000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77C01000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77C01000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	7C9C1000	2000	page read and write	page execute read	success or wait	8	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	7C9C1000	2000	page execute read	page read and write	success or wait	8	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77F61000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	77F61000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	769C1000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	769C1000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	5AD71000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	5AD71000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	76391000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	76391000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	773D1000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	773D1000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	5D091000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	5D091000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
760	C:\WINDOWS\system32\rundll32.exe	10009000	1000	page read and write	page readonly	success or wait	8	1001792	LoadLibraryW
760	C:\WINDOWS\system32\rundll32.exe	10009000	1000	page readonly	page read and write	success or wait	8	1001792	LoadLibraryW
760	C:\WINDOWS\system32\rundll32.exe	71AB1000	1000	page read and write	page execute read	success or wait	4	1001792	LoadLibraryW
760	C:\WINDOWS\system32\rundll32.exe	71AB1000	1000	page execute read	page read and write	success or wait	4	1001792	LoadLibraryW

Memory Usage Statistics

Time	Private Usage (mb)	Workingset (mb)	Page File Usage (mb)
15:20:42	0	1	0
15:20:43	2	4	2
15:20:44	2	5	2
15:20:45	2	5	2
15:21:02	2	5	2
15:21:10	2	5	2
15:21:24	2	5	2

System Activites

System info class	Completion	Count	Source Address	Symbol
BasicInformation	success or wait	26	7C90E457	KiUserApcDispatcher
RangeStartInformation	success or wait	1	7C90E457	KiUserApcDispatcher
ProcessorInformation	success or wait	9	7C90E457	KiUserApcDispatcher
PerformanceInformation	success or wait	1	10001EEC	gethostname

Timing Activites

Time	Completion	Count	Source Address	Symbol
129876420429687500	success or wait	1	10001EEC	gethostname
129876420449687500	success or wait	1	1000215C	HttpSendRequestA
129876420449687500	success or wait	1	1000215C	HttpSendRequestA
129876420628906250	success or wait	1	1000131A	InternetOpenUrlA
129876420628906250	success or wait	1	1000131A	InternetOpenUrlA

Windows UI Activites

Window Created

Window name	Class name	HWND	Completion	Count	Source Address	Symbol
RunDLL	RunDLL	B014E	success	1	1001412	CreateWindowExW
c0d0so0	c0d0so0	60104	success	1	10002C64	CreateWindowExA

Window UI Shown

HWND	Command	Completion	Count	Source Address	Symbol
60104	hide	error	1	10002C79	NtUserShowWindow

HWND	Message	LParam	WParam	Completion	Count	Source Address	Symbol
B014E	NCCREATE	0	522484	success	1	1001412	CreateWindowExW
6013A	NCCREATE	0	522456	success	1	1001412	CreateWindowExW
B014E	NCCALCSIZE	0	522524	error	1	1001412	CreateWindowExW
60104	NCCREATE	0	522448	success	1	10002CC1	DefWindowProcA
60104	NCCALCSIZE	0	522504	error	1	10002CC1	DefWindowProcA
60104	WINDOWPOSCHANGING	0	521968	error	1	10002CC1	DefWindowProcA
60104	NCCALCSIZE	1	521924	error	1	10002CC1	DefWindowProcA

TID	Message	LParam	WParam	Completion	Count	Source Address	Symbol
7DC	C08C	0	1120	success	1	7C80B729	unknown

Module	Thread id	Hook code	Completion	Count	Source Address	Symbol
C:\WINDOWS\system32\MSCTF.dll	856	keyboard	success	1	1001412	CreateWindowExW
C:\WINDOWS\system32\MSCTF.dll	856	mouse	success	1	1001412	CreateWindowExW

Chronological Activities

Operation	Data	Completion	Time
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes Name: CWDIllegalInDLLSearch	object name not found	745942848
System info queried	Type: BasicInformation	success or wait	745944588
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 90000 Length: 7FB14 Allocation Type: unknown Protection: page read and write	success or wait	745944890
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 90000 Length: 7FB18 Allocation Type: unknown Protection: page read and write	success or wait	745946522
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 91000 Length: 7F7F4 Allocation Type: unknown Protection: page read and write	success or wait	745946971
System info queried	Type: BasicInformation	success or wait	745947239
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 190000 Length: 7FB14 Allocation Type: unknown Protection: page read and write	success or wait	745947458
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 190000 Length: 7FB18 Allocation Type: unknown Protection: page read and write	success or wait	745947671
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	745948445
File control set	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1 Control Code: 90028 Input Buffer:	success or wait	745949796
Section loaded	Path: \KnownDlls\kernel32.dll Access: write and read and execute Type: unknown Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	745950862
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C801000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747513562
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C801000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747514848
Process information queried	PID: 760 Info Class: Cookie	success or wait	747535548
System info queried	Type: RangeStartInformation	success or wait	747535801
System info queried	Type: BasicInformation	success or wait	747535989
Section loaded	Path: unknown Access: query and write and read and execute and extend size Type: reserve Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	747538808
System info queried	Type: BasicInformation	success or wait	747541093
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 1A0000 Length: 7F340 Allocation Type: unknown Protection: page read and write	success or wait	747541560
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	747542717
Section loaded	Path: \NLS\NlsSectionUnicode Access: read Type: unknown Baseaddress: 1B0000 Size: 90112 Protection: readonly Mapped to pid: own pid	success or wait	747544328
Section loaded	Path: \NLS\NlsSectionLocale Access: read Type: unknown Baseaddress: 1D0000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	747548502
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 93000 Length: 7F21C Allocation Type: unknown Protection: page read and write	success or wait	747551745
Section loaded	Path: \NLS\NlsSectionSortkey Access: query and read Type: unknown Baseaddress: 220000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	747552089
Section loaded	Path: \NLS\NlsSectionSortTbls Access: read Type: unknown Baseaddress: 270000 Size: 24576 Protection: readonly Mapped to pid: own pid	success or wait	747555358
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	747557234
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	747558961
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 1A1000 Length: 7F168 Allocation Type: unknown Protection: page read and write	success or wait	747559182
Section loaded	Path: \KnownDlls\msvcrt.dll Access: write and read and execute Type: unknown Baseaddress: 77C10000 Size: 360448 Protection: read write Mapped to pid: own pid	success or wait	747575493
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747581435
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747582775
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747583031
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747583272
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 1001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747583505
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 1001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747588619
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 1001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747589949
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 1001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747591326
Section loaded	Path: \KnownDlls\GDI32.dll Access: write and read and execute Type: unknown Baseaddress: 77F10000 Size: 299008 Protection: read write Mapped to pid: own pid	success or wait	747591608
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747597286
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747597712
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747597959
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747598212
Section loaded	Path: \KnownDlls\USER32.dll Access: write and read and execute Type: unknown Baseaddress: 7E410000 Size: 593920 Protection: read write Mapped to pid: own pid	success or wait	747600860
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747602074
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747605288
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747605556
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747605857
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747606112
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747609023
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747609268
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747609888
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 1001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747610121
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 1001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747610347
Section loaded	Path: \KnownDlls\IMAGEHLP.dll Access: write and read and execute Type: unknown Baseaddress: 76C90000 Size: 163840 Protection: read write Mapped to pid: own pid	success or wait	747610709
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747617587
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747618693
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747618943
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747619314
Section loaded	Path: \KnownDlls\ShimEng.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	747622291
File opened	Path: C:\WINDOWS\system32\ShimEng.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	747622768
Section loaded	Path: C:\WINDOWS\system32\shimeng.dll Access: query and write and read and execute Type: image Baseaddress: 5CB70000 Size: 155648 Protection: read write Mapped to pid: own pid	success or wait	747623519
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: TransparentEnabled	success or wait	747623953
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5CB71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747629445
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5CB71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747632253
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5CB71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747632501
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5CB71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747632744
File opened	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	747636232
Section loaded	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read Type: commit Baseaddress: 280000 Size: 1208320 Protection: readonly Mapped to pid: own pid	success or wait	747637005
File opened	Path: C:\WINDOWS\AppPatch\systest.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	object name not found	747638006
System info queried	Type: ProcessorInformation	success or wait	747638646
Process information queried	PID: 760 Info Class: Wow64Information	success or wait	747642046
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter Name: Installed	success or wait	747642348
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	747642941
Process information queried	PID: 760 Info Class: Wow64Information	success or wait	747643509
System info queried	Type: BasicInformation	success or wait	747643690
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 3B0000 Length: 7F0C8 Allocation Type: unknown Protection: page read and write	success or wait	747646044
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 3B0000 Length: 7F0CC Allocation Type: unknown Protection: page read and write	success or wait	747646254
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	747648076
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 3B2000 Length: 7EB64 Allocation Type: unknown Protection: page read and write	success or wait	747648735
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 3B3000 Length: 7EEA8 Allocation Type: unknown Protection: page read and write	success or wait	747652938
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	747653523
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	747656995
Section loaded	Path: C:\WINDOWS\AppPatch\acgenral.dll Access: write and read and execute Type: commit Baseaddress: 3C0000 Size: 1855488 Protection: execute Mapped to pid: own pid	success or wait	747657735
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	747662320
Section loaded	Path: C:\WINDOWS\AppPatch\acgenral.dll Access: write and read and execute Type: commit Baseaddress: 3C0000 Size: 1855488 Protection: execute Mapped to pid: own pid	success or wait	747663073
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	747664494
Section loaded	Path: C:\WINDOWS\AppPatch\acgenral.dll Access: query and write and read and execute Type: image Baseaddress: 6F880000 Size: 1875968 Protection: read write Mapped to pid: own pid	success or wait	747667391
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747668806
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747761516
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747761887
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747762209
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747762464
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747762711
Section loaded	Path: \KnownDlls\ADVAPI32.dll Access: write and read and execute Type: unknown Baseaddress: 77DD0000 Size: 634880 Protection: read write Mapped to pid: own pid	success or wait	747763001
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747766946
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747767404
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747767668
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747772536
Section loaded	Path: \KnownDlls\RPCRT4.dll Access: write and read and execute Type: unknown Baseaddress: 77E70000 Size: 602112 Protection: read write Mapped to pid: own pid	success or wait	747772844
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747776551
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747777256
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747777533
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747777909
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747781775
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747782076
Section loaded	Path: \KnownDlls\Secur32.dll Access: write and read and execute Type: unknown Baseaddress: 77FE0000 Size: 69632 Protection: read write Mapped to pid: own pid	success or wait	747782395
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747790164
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747790962
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747791550
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747791858
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747792152
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747792522
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747792795
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747793136
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747797092
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747797623
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747797868
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747798121
Section loaded	Path: \KnownDlls\WINMM.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	747798406
File opened	Path: C:\WINDOWS\system32\WINMM.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	747798897
Section loaded	Path: C:\WINDOWS\system32\winmm.dll Access: query and write and read and execute Type: image Baseaddress: 76B40000 Size: 184320 Protection: read write Mapped to pid: own pid	success or wait	747802949
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747804680
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747808776
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747809050
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747814938
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747815214
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747815532
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747819629
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747819921
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747820185
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747821481
Section loaded	Path: \KnownDlls\ole32.dll Access: write and read and execute Type: unknown Baseaddress: 774E0000 Size: 1302528 Protection: read write Mapped to pid: own pid	success or wait	747821779
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747824752
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747828039
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747828307
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747828586
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747829820
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747830208
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747830470
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747831704
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747831970
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747832241
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747833513
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747833894
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747834159
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747835528
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747835780
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747836265
Section loaded	Path: \KnownDlls\OLEAUT32.dll Access: write and read and execute Type: unknown Baseaddress: 77120000 Size: 569344 Protection: read write Mapped to pid: own pid	success or wait	747837615
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747839820
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747840298
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747840563
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747841815
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747842086
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747842464
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747845690
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747845967
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747846234
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747957361
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	747957640
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	747957902
Section loaded	Path: \KnownDlls\MSACM32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	748126148
File opened	Path: C:\WINDOWS\system32\MSACM32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	748126661
Section loaded	Path: C:\WINDOWS\system32\msacm32.dll Access: query and write and read and execute Type: image Baseaddress: 77BE0000 Size: 86016 Protection: read write Mapped to pid: own pid	success or wait	748127481
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748460783
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748572782
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748684501
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748684784
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748685063
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748852310
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748852593
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748852861
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748874907
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748875795
Section loaded	Path: \KnownDlls\VERSION.dll Access: write and read and execute Type: unknown Baseaddress: 77C00000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	748876128
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748879279
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748880807
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748881075
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748883085
Section loaded	Path: \KnownDlls\SHELL32.dll Access: write and read and execute Type: unknown Baseaddress: 7C9C0000 Size: 8482816 Protection: read write Mapped to pid: own pid	success or wait	748883383
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	748918994
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	748919522
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	748919796
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	748922201
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	748922511
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	748922944
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	748964123
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	748964406
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	748964670
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	748967810
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	748968083
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	748968351
Section loaded	Path: \KnownDlls\SHLWAPI.dll Access: write and read and execute Type: unknown Baseaddress: 77F60000 Size: 483328 Protection: read write Mapped to pid: own pid	success or wait	748969719
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748975192
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748977944
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748978228
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748978514
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748981719
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748982127
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748982404
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748985288
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748985569
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748985991
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	748988802
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	748989399
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	748989664
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	748992459
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748992731
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748993173
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748995641
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	748995888
Section loaded	Path: \KnownDlls\USERENV.dll Access: write and read and execute Type: unknown Baseaddress: 769C0000 Size: 737280 Protection: read write Mapped to pid: own pid	success or wait	748996178
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	748999668
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749003047
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749003319
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749006015
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749006280
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749006545
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749011925
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749012283
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749012547
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749014951
Section loaded	Path: \KnownDlls\UxTheme.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	749015245
File opened	Path: C:\WINDOWS\system32\UxTheme.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749015733
Section loaded	Path: C:\WINDOWS\system32\uxtheme.dll Access: query and write and read and execute Type: image Baseaddress: 5AD70000 Size: 229376 Protection: read write Mapped to pid: own pid	success or wait	749018713
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749025436
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749032372
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749032692
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749033037
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749038225
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749038534
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749038798
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749042382
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749042650
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749042912
System info queried	Type: BasicInformation	success or wait	749048722
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 3C0000 Length: 7E978 Allocation Type: unknown Protection: page read and write	success or wait	749048964
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 3C0000 Length: 7E97C Allocation Type: unknown Protection: page read and write	success or wait	749053101
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 3C1000 Length: 7E658 Allocation Type: unknown Protection: page read and write	success or wait	749053425
Section loaded	Path: \NLS\NlsSectionCType Access: read Type: unknown Baseaddress: 3D0000 Size: 12288 Protection: readonly Mapped to pid: own pid	success or wait	749054494
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 3C3000 Length: 7E6FC Allocation Type: unknown Protection: page read and write	success or wait	749059259
Process information queried	PID: 760 Info Class: Cookie	success or wait	749064736
Process information queried	PID: 760 Info Class: Cookie	success or wait	749064946
Mutant created	Name: \BaseNamedObjects\SHIMLIB_LOG_MUTEX	object name exists	749070173
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	749075150
System info queried	Type: BasicInformation	success or wait	749079442
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 3E0000 Length: 7F04C Allocation Type: unknown Protection: page read and write	success or wait	749079676
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 3E0000 Length: 7F050 Allocation Type: unknown Protection: page read and write	success or wait	749079906
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 3E1000 Length: 7ED2C Allocation Type: unknown Protection: page read and write	success or wait	749082551
System info queried	Type: BasicInformation	success or wait	749083198
System info queried	Type: ProcessorInformation	success or wait	749083411
Process information queried	PID: 760 Info Class: ImageInformation	success or wait	749091263
System info queried	Type: BasicInformation	success or wait	749130958
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 30000 Length: 7F91C Allocation Type: unknown Protection: page read and write	success or wait	749131267
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 30000 Length: 7F920 Allocation Type: unknown Protection: page read and write	success or wait	749131484
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 31000 Length: 7F5FC Allocation Type: unknown Protection: page read and write	success or wait	749134410
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 33000 Length: 7F6B8 Allocation Type: unknown Protection: page read and write	success or wait	749135708
Process information queried	PID: 760 Info Class: Cookie	success or wait	749136783
Process information queried	PID: 760 Info Class: Cookie	success or wait	749139416
System info queried	Type: BasicInformation	success or wait	749139732
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: SafeDllSearchMode	object name not found	749143106
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749143845
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 350000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	749144685
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749152531
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 350000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	749155861
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749157396
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: query and write and read and execute Type: image Baseaddress: 76390000 Size: 118784 Protection: read write Mapped to pid: own pid	success or wait	749158143
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749169212
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749170242
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749184353
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749184688
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749184953
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749185333
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749185595
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749185865
System info queried	Type: BasicInformation	success or wait	749193248
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize Name: DisableMetaFiles	object name not found	749194728
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 94000 Length: 7F02C Allocation Type: unknown Protection: page read and write	success or wait	749197424
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Name: AppInit_DLLs	success or wait	749198655
System info queried	Type: BasicInformation	success or wait	749207856
System info queried	Type: ProcessorInformation	success or wait	749208071
System info queried	Type: BasicInformation	success or wait	749210876
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 830000 Length: 7F9A0 Allocation Type: unknown Protection: page read and write	success or wait	749211100
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 830000 Length: 7F9A4 Allocation Type: unknown Protection: page read and write	success or wait	749211316
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: LeakTrack	object name not found	749214289
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 95000 Length: 7F694 Allocation Type: unknown Protection: page read and write	success or wait	749215397
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave	success or wait	749216124
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 930000 Length: 7F52C Allocation Type: unknown Protection: page read and write	success or wait	749216731
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 930000 Length: 7F528 Allocation Type: unknown Protection: page read and write	success or wait	749216957
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave	success or wait	749220942
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave1	success or wait	749221873
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave1	success or wait	749222469
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave2	object name not found	749223912
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave3	object name not found	749226323
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave4	object name not found	749226874
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave5	object name not found	749229891
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave6	object name not found	749230776
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave7	object name not found	749231330
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave8	object name not found	749235757
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave9	object name not found	749236320
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi	success or wait	749236874
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi	success or wait	749238595
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi1	success or wait	749239162
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi1	success or wait	749239732
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi2	object name not found	749240908
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi3	object name not found	749241466
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi4	object name not found	749242017
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi5	object name not found	749243160
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi6	object name not found	749244106
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi7	object name not found	749245432
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi8	object name not found	749245984
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi9	object name not found	749246572
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux	success or wait	749247722
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux	success or wait	749248283
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux1	success or wait	749248836
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux1	success or wait	749250005
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux2	object name not found	749250554
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux3	object name not found	749251099
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux4	object name not found	749253259
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux5	object name not found	749253808
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux6	object name not found	749254354
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux7	object name not found	749255619
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux8	object name not found	749256168
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux9	object name not found	749256714
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaProperties\PrivateProperties\Joystick\Winmm Name: wheel	success or wait	749258007
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer	success or wait	749258548
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer	success or wait	749259768
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer1	success or wait	749260327
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer1	success or wait	749260892
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer2	object name not found	749262156
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer3	object name not found	749262774
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer4	object name not found	749263331
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer5	object name not found	749264532
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer6	object name not found	749265083
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer7	object name not found	749265630
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer8	object name not found	749267388
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer9	object name not found	749267941
File opened	Path: \Device\KsecDD Access: read data or list directory and synchronize Options: synchronous io alert Overwritten: false	success or wait	749268818
System info queried	Type: BasicInformation	success or wait	749273166
System info queried	Type: ProcessorInformation	success or wait	749273371
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CriticalSectionTimeout	success or wait	749274493
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: RWLockResourceTimeOut	object name not found	749275087
System info queried	Type: BasicInformation	success or wait	749277333
System info queried	Type: ProcessorInformation	success or wait	749277543
System info queried	Type: BasicInformation	success or wait	749279031
System info queried	Type: ProcessorInformation	success or wait	749279238
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAll	object name not found	749279552
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAllForOle32	object name not found	749281004
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableTypeLib	object name not found	749281220
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAll	object name not found	749282073
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAllForOle32	object name not found	749282543
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 96000 Length: 7F56C Allocation Type: unknown Protection: page read and write	success or wait	749284322
Key value queried	Path: HKEY_USERS\Software\Microsoft\Multimedia\Audio Name: SystemFormats	success or wait	749286347
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.imaadpcm	buffer overflow	749288570
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.imaadpcm	success or wait	749289873
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 97000 Length: 7EF90 Allocation Type: unknown Protection: page read and write	success or wait	749291013
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: fdwSupport	success or wait	749292287
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: cFormatTags	success or wait	749292632
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: aFormatTagCache	success or wait	749292976
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: cFilterTags	success or wait	749293952
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msadpcm	buffer overflow	749295455
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msadpcm	success or wait	749295693
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: fdwSupport	success or wait	749296517
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: cFormatTags	success or wait	749296859
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: aFormatTagCache	success or wait	749297194
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: cFilterTags	success or wait	749297804
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg711	buffer overflow	749298842
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg711	success or wait	749299076
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: fdwSupport	success or wait	749300100
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: cFormatTags	success or wait	749300441
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: aFormatTagCache	success or wait	749300777
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: cFilterTags	success or wait	749309019
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msgsm610	buffer overflow	749311700
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msgsm610	success or wait	749311944
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: fdwSupport	success or wait	749323438
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: cFormatTags	success or wait	749323788
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: aFormatTagCache	success or wait	749324130
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: cFilterTags	success or wait	749325064
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.trspch	buffer overflow	749329745
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.trspch	success or wait	749329988
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: fdwSupport	success or wait	749336150
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: cFormatTags	success or wait	749336497
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: aFormatTagCache	success or wait	749336836
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: cFilterTags	success or wait	749344211
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg723	buffer overflow	749346866
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg723	success or wait	749347112
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: fdwSupport	success or wait	749352413
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: cFormatTags	success or wait	749352763
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: aFormatTagCache	success or wait	749353108
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: cFilterTags	success or wait	749355018
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msaudio1	buffer overflow	749359706
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msaudio1	success or wait	749359956
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: fdwSupport	success or wait	749369721
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: cFormatTags	success or wait	749370068
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: aFormatTagCache	success or wait	749412488
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: cFilterTags	success or wait	749412836
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.sl_anet	buffer overflow	749500951
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.sl_anet	success or wait	749501208
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: fdwSupport	success or wait	749502592
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: cFormatTags	success or wait	749502933
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: aFormatTagCache	success or wait	749504832
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: cFilterTags	success or wait	749505179
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 98000 Length: 7F188 Allocation Type: unknown Protection: page read and write	success or wait	749506183
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.iac2	buffer overflow	749506560
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.iac2	success or wait	749507079
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: fdwSupport	success or wait	749507693
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: cFormatTags	success or wait	749508408
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: aFormatTagCache	success or wait	749508747
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: cFilterTags	success or wait	749509080
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.l3acm	buffer overflow	749510253
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.l3acm	success or wait	749510890
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: fdwSupport	success or wait	749511486
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: cFormatTags	success or wait	749512207
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: aFormatTagCache	success or wait	749512544
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: cFilterTags	success or wait	749512878
Key value queried	Path: HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM Name: NoPCMConverter	object name not found	749516283
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 99000 Length: 7EFB0 Allocation Type: unknown Protection: page read and write	success or wait	749517228
Key value queried	Path: HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00 Name: Priority1	object name not found	749579497
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	749667517
File opened	Path: C:\WINDOWS\system32\SHELL32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749672913
Section loaded	Path: C:\WINDOWS\system32\shell32.dll Access: read Type: commit Baseaddress: 1010000 Size: 8462336 Protection: readonly Mapped to pid: own pid	success or wait	749675038
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	749675766
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	749680414
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	749749294
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749750306
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: write and read and execute Type: commit Baseaddress: 9B0000 Size: 1056768 Protection: execute Mapped to pid: own pid	success or wait	749764088
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749769262
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: query and write and read and execute Type: image Baseaddress: 773D0000 Size: 1060864 Protection: read write Mapped to pid: own pid	success or wait	749770359
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749797644
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749798008
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749798288
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749798792
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749799069
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749799420
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749799990
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749800315
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749800590
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749801287
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749801564
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749801836
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749802636
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749804272
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749806139
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: write and read and execute Type: commit Baseaddress: 380000 Size: 4096 Protection: execute Mapped to pid: own pid	success or wait	749806970
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	749809606
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: query and read Type: commit Baseaddress: 380000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	749810467
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749812298
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: read Type: commit Baseaddress: 380000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	749813420
File opened	Path: C:\WINDOWS\WindowsShell.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	749814222
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	749846958
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: EnableBalloonTips	object name not found	749848302
Section loaded	Path: \KnownDlls\comctl32.dll Access: write and read and execute Type: unknown Baseaddress: 5D090000 Size: 630784 Protection: read write Mapped to pid: own pid	success or wait	749852497
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749854140
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749854557
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749854827
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749858989
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749859260
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749859576
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749873491
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749876563
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749876831
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749877205
System info queried	Type: BasicInformation	success or wait	749878101
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 380000 Length: 7F1B8 Allocation Type: unknown Protection: page read and write	success or wait	749878354
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 380000 Length: 7F1BC Allocation Type: unknown Protection: page read and write	success or wait	749878740
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 381000 Length: 7EE98 Allocation Type: unknown Protection: page read and write	success or wait	749881994
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 383000 Length: 7EF3C Allocation Type: unknown Protection: page read and write	success or wait	749882594
File opened	Path: C:\WINDOWS\system32\comctl32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749883822
Section loaded	Path: C:\WINDOWS\system32\comctl32.dll Access: read Type: commit Baseaddress: 9B0000 Size: 618496 Protection: readonly Mapped to pid: own pid	success or wait	749884628
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	749886140
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	749891035
Process information queried	PID: 760 Info Class: SessionInformation	success or wait	749896818
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	749899965
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	749902706
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: ChkAccDebugLevel	object name not found	749906236
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions Name: ProductType	success or wait	749906868
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Personal	success or wait	749910765
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Local Settings	success or wait	749911114
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: RsopDebugLevel	object name not found	749911937
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	749915031
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: RsopLogging	object name not found	749915371
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: UserEnvDebugLevel	object name not found	749916038
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: RsopLogging	object name not found	749916587
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	749952193
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: UserEnvDebugLevel	object name not found	749952822
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\ThemeManager Name: Compositing	object name not found	749956686
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: LameButtonText	object name not found	749957795
File opened	Path: C:\Documents and Settings\Administrator\Application Data\taskman.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749962916
Section loaded	Path: C:\Documents and Settings\Administrator\Application Data\taskman.dll Access: read Type: commit Baseaddress: 9B0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	749963806
File opened	Path: C:\Documents and Settings\Administrator\Application Data\taskman.dll.123.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	749966756
File opened	Path: C:\Documents and Settings\Administrator\Application Data\taskman.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749971387
Section loaded	Path: C:\Documents and Settings\Administrator\Application Data\taskman.dll Access: write and read and execute Type: commit Baseaddress: 9B0000 Size: 61440 Protection: execute Mapped to pid: own pid	success or wait	749972233
File opened	Path: C:\Documents and Settings\Administrator\Application Data\taskman.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749976001
Section loaded	Path: C:\Documents and Settings\Administrator\Application Data\taskman.dll Access: query and write and read and execute Type: image Baseaddress: 10000000 Size: 61440 Protection: read write Mapped to pid: own pid	success or wait	749976840
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	749981285
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	749981694
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	749981947
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	749984516
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	749984838
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	749985085
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	749985336
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	749985621
Section loaded	Path: \KnownDlls\WS2_32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	749985907
File opened	Path: C:\WINDOWS\system32\WS2_32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	749988797
Section loaded	Path: C:\WINDOWS\system32\ws2_32.dll Access: query and write and read and execute Type: image Baseaddress: 71AB0000 Size: 94208 Protection: read write Mapped to pid: own pid	success or wait	749989560
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 71AB1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749991270
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 71AB1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749995776
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 71AB1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749996053
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 71AB1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749996351
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 71AB1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749996616
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 71AB1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749996877
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 71AB1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749999246
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 71AB1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749999509
Section loaded	Path: \KnownDlls\WS2HELP.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	749999812
File opened	Path: C:\WINDOWS\system32\WS2HELP.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750000263
Section loaded	Path: C:\WINDOWS\system32\ws2help.dll Access: query and write and read and execute Type: image Baseaddress: 71AA0000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	750001043
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	750011142
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	750011385
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	750011635
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	750011880
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	750012131
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	750012448
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	750014659
Memory attributes changed	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 10009000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	750014909
System info queried	Type: BasicInformation	success or wait	750017364
System info queried	Type: ProcessorInformation	success or wait	750017586
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 34000 Length: 7EE98 Allocation Type: unknown Protection: page read and write	success or wait	750026198
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	750027237
Window created	Window Name: RunDLL Class Name: RunDLL HWND: B014E	success	750034816
File opened	Path: C:\WINDOWS\system32\MSCTF.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750036111
Section loaded	Path: C:\WINDOWS\system32\msctf.dll Access: write and read and execute Type: commit Baseaddress: 9B0000 Size: 299008 Protection: execute Mapped to pid: own pid	success or wait	750036877
File opened	Path: C:\WINDOWS\system32\MSCTF.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750041489
Section loaded	Path: C:\WINDOWS\system32\msctf.dll Access: query and write and read and execute Type: image Baseaddress: 74720000 Size: 311296 Protection: read write Mapped to pid: own pid	success or wait	750042242
Process information queried	PID: 760 Info Class: Wow64Information	success or wait	750056594
Section loaded	Path: \BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read Type: commit Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name exists	750057918
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared Name: CUAS	success or wait	750058648
Mutant created	Name: \BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	750061464
Mutant created	Name: \BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	750061756
Mutant created	Name: \BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	750062037
Mutant created	Name: \BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	750062317
Mutant created	Name: \BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	750062597
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	750065417
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	750065856
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	750066221
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	750066584
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF Name: EnableAnchorContext	object name not found	750069164
Mutant created	Name: \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500MUTEX.DefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	750231271
Section loaded	Path: \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500SFM.DefaultS-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read and execute and extend size Type: unknown Baseaddress: 9C0000 Size: 262144 Protection: read write Mapped to pid: own pid	success or wait	750231609
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 856 Hook ID: keyboard	success	750239965
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 856 Hook ID: mouse	success	750240202
Message sent	HWND: B014E Message: NCCREATE WParam: 0 LParam: 522484	success	750240716
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM Name: Ime File	success or wait	750241488
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	750242075
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750247510
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: write and read and execute Type: commit Baseaddress: A00000 Size: 180224 Protection: execute Mapped to pid: own pid	success or wait	750248359
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	750250259
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: query and read Type: commit Baseaddress: A00000 Size: 180224 Protection: readonly Mapped to pid: own pid	success or wait	750253355
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	750254738
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 9A000 Length: 7ED08 Allocation Type: unknown Protection: page read and write	success or wait	750256514
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	750258298
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750258772
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: write and read and execute Type: commit Baseaddress: A00000 Size: 180224 Protection: execute Mapped to pid: own pid	success or wait	750259569
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	750264562
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: query and read Type: commit Baseaddress: A00000 Size: 180224 Protection: readonly Mapped to pid: own pid	success or wait	750265357
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	750266814
Section loaded	Path: \BaseNamedObjects\ShimSharedMemory Access: write Type: unknown Baseaddress: A00000 Size: 57344 Protection: read write Mapped to pid: own pid	success or wait	750271993
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750273368
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: write and read and execute Type: commit Baseaddress: A10000 Size: 180224 Protection: execute Mapped to pid: own pid	success or wait	750274159
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750309654
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: query and write and read and execute Type: image Baseaddress: 755C0000 Size: 188416 Protection: read write Mapped to pid: own pid	success or wait	750310456
Message sent	HWND: 6013A Message: NCCREATE WParam: 0 LParam: 522456	success	750324984
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF Name: Disable Thread Input Manager	object name not found	750329703
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared Name: CUAS	success or wait	750330883
Message sent	HWND: B014E Message: NCCALCSIZE WParam: 0 LParam: 522524	error	750338395
Section loaded	Path: \KnownDlls\WININET.dll Access: write and read and execute Type: unknown Baseaddress: 3D930000 Size: 942080 Protection: read write Mapped to pid: own pid	success or wait	750338743
Section loaded	Path: \KnownDlls\Normaliz.dll Access: write and read and execute Type: unknown Baseaddress: A10000 Size: 36864 Protection: read write Mapped to pid: own pid	conflicting addresses	750364848
Section loaded	Path: \KnownDlls\urlmon.dll Access: write and read and execute Type: unknown Baseaddress: 78130000 Size: 1257472 Protection: read write Mapped to pid: own pid	success or wait	750384422
Section loaded	Path: \KnownDlls\iertutil.dll Access: write and read and execute Type: unknown Baseaddress: 3DFD0000 Size: 2002944 Protection: read write Mapped to pid: own pid	success or wait	750404878
File opened	Path: C:\WINDOWS\system32\urlmon.dll.123.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	750431921
File opened	Path: C:\WINDOWS\system32\urlmon.dll.123.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	750450624
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	750489839
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 9B000 Length: 7EDE8 Allocation Type: unknown Protection: page read and write	success or wait	750491597
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableImprovedZoneCheck	object name not found	750496205
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN Name: rundll32.exe	object name not found	750499033
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_PROTOCOL_LOCKDOWN Name: *	object name not found	750499463
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: 9C000 Length: 7F4C8 Allocation Type: unknown Protection: page read and write	success or wait	750506492
System info queried	Type: BasicInformation	success or wait	750507031
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: A30000 Length: 7F714 Allocation Type: unknown Protection: page read and write	success or wait	750507265
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: A30000 Length: 7F718 Allocation Type: unknown Protection: page read and write	success or wait	750507493
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: A31000 Length: 7F3F4 Allocation Type: unknown Protection: page read and write	success or wait	750516441
File opened	Path: WMIDataDevice Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: normal Content Overwritten: true	success or wait	750517023
File opened	Path: WMIDataDevice Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: normal Content Overwritten: true	success or wait	750521229
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: A33000 Length: 7F38C Allocation Type: unknown Protection: page read and write	success or wait	750521732
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: B30000 Length: 7F164 Allocation Type: unknown Protection: page read and write	success or wait	750522134
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: B63000 Length: 7F160 Allocation Type: unknown Protection: page read and write	success or wait	750522383
Thread created	PID: 760 TID: 928 EIP: 7C8106F9 EAX: 77DF848A Imagepath: C:\WINDOWS\system32\rundll32.exe	success or wait	750525972
Thread resumed	TID: 928 PID: 760 Path: C:\WINDOWS\system32\rundll32.exe	success or wait	750526828
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: A35000 Length: 7F2F8 Allocation Type: unknown Protection: page read and write	success or wait	750527505
File opened	Path: C:\WINDOWS\system32\WININET.dll.123.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	750537561
File opened	Path: C:\WINDOWS\system32\WININET.dll.123.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	750538515
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	750588749
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: B80000 Length: 7FAA4 Allocation Type: unknown Protection: page read and write	success or wait	750596770
Memory allocated	PID: 760 Path: C:\WINDOWS\system32\rundll32.exe Base: BB3000 Length: 7FAA0 Allocation Type: unknown Protection: page read and write	success or wait	750597002
Thread created	PID: 760 TID: 1524 EIP: 7C8106F9 EAX: 100025BA Imagepath: C:\WINDOWS\system32\rundll32.exe	success or wait	750604922
Thread resumed	TID: 1524 PID: 760 Path: C:\WINDOWS\system32\rundll32.exe	success or wait	750605673
Window created	Window Name: c0d0so0 Class Name: c0d0so0 HWND: 60104	success	750606022
Message sent	HWND: 60104 Message: NCCREATE WParam: 0 LParam: 522448	success	750606303
Message sent	HWND: 60104 Message: NCCALCSIZE WParam: 0 LParam: 522504	error	750606577
Message sent	HWND: 60104 Message: WINDOWPOSCHANGING WParam: 0 LParam: 521968	error	750606848
Message sent	HWND: 60104 Message: NCCALCSIZE WParam: 1 LParam: 521924	error	750611867
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: AppData	success or wait	750612840
Window shown	HWND: 60104 CMD: hide	error	750613264
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: AppData Type: unicode Data: C:\Documents and Settings\Administrator\Application Data Old data:	success or wait	750617397
Key value set	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run Name: rundll32.exe Type: unicode Data: rundll32.exe "C:\Documents and Settings\Administrator\Application Data\taskman.dll",start Old data:	success or wait	750619089
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters Name: WinSock_Registry_Version	success or wait	750624225
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters Name: WinSock_Registry_Version	success or wait	750627777
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9 Name: Serial_Access_Num	success or wait	750628237
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9 Name: Serial_Access_Num	success or wait	750628851
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9 Name: Next_Catalog_Entry_ID	success or wait	750629201
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9 Name: Num_Catalog_Entries	success or wait	750629532
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001 Name: PackedCatalogItem	buffer overflow	750630025
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001 Name: PackedCatalogItem	buffer overflow	750632996
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000001 Name: PackedCatalogItem	success or wait	750633644
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002 Name: PackedCatalogItem	buffer overflow	750634674
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002 Name: PackedCatalogItem	buffer overflow	750635010
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000002 Name: PackedCatalogItem	success or wait	750637241
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003 Name: PackedCatalogItem	buffer overflow	750638259
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003 Name: PackedCatalogItem	buffer overflow	750638597
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000003 Name: PackedCatalogItem	success or wait	750638927
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004 Name: PackedCatalogItem	buffer overflow	750642395
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004 Name: PackedCatalogItem	buffer overflow	750642734
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000004 Name: PackedCatalogItem	success or wait	750643065
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005 Name: PackedCatalogItem	buffer overflow	750644098
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005 Name: PackedCatalogItem	buffer overflow	750644435
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000005 Name: PackedCatalogItem	success or wait	750647136
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006 Name: PackedCatalogItem	buffer overflow	750648151
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006 Name: PackedCatalogItem	buffer overflow	750649623
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000006 Name: PackedCatalogItem	success or wait	750650258
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007 Name: PackedCatalogItem	buffer overflow	750651969
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007 Name: PackedCatalogItem	buffer overflow	750652307
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000007 Name: PackedCatalogItem	success or wait	750655739
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008 Name: PackedCatalogItem	buffer overflow	750656750
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008 Name: PackedCatalogItem	buffer overflow	750657085
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000008 Name: PackedCatalogItem	success or wait	750657416
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009 Name: PackedCatalogItem	buffer overflow	750659178
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009 Name: PackedCatalogItem	buffer overflow	750659515
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000009 Name: PackedCatalogItem	success or wait	750659847
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010 Name: PackedCatalogItem	buffer overflow	750664661
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010 Name: PackedCatalogItem	buffer overflow	750664996
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000010 Name: PackedCatalogItem	success or wait	750665634
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011 Name: PackedCatalogItem	buffer overflow	750672436
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011 Name: PackedCatalogItem	buffer overflow	750672772
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000011 Name: PackedCatalogItem	success or wait	750673103
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012 Name: PackedCatalogItem	buffer overflow	750674130
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012 Name: PackedCatalogItem	buffer overflow	750674465
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000012 Name: PackedCatalogItem	success or wait	750677258
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013 Name: PackedCatalogItem	buffer overflow	750678295
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013 Name: PackedCatalogItem	buffer overflow	750678626
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries\000000000013 Name: PackedCatalogItem	success or wait	750678957
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5 Name: Serial_Access_Num	success or wait	750682355
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5 Name: Serial_Access_Num	success or wait	750682715
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5 Name: Num_Catalog_Entries	success or wait	750683105
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Name: LibraryPath	success or wait	750683586
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Name: LibraryPath	success or wait	750683986
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Name: DisplayString	success or wait	750692323
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Name: DisplayString	success or wait	750692650
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Name: DisplayString	success or wait	750692978
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Name: DisplayString	success or wait	750693305
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Name: ProviderId	success or wait	750693632
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Name: AddressFamily	object name not found	750694034
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Name: SupportedNameSpace	success or wait	750700678
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Name: Enabled	success or wait	750703550
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Name: Version	success or wait	750703882
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000001 Name: StoresServiceClassInfo	success or wait	750704214
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Name: LibraryPath	success or wait	750705133
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Name: LibraryPath	success or wait	750707830
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Name: DisplayString	success or wait	750708163
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Name: DisplayString	success or wait	750708492
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Name: DisplayString	success or wait	750708821
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Name: DisplayString	success or wait	750709149
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Name: ProviderId	success or wait	750709476
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Name: AddressFamily	object name not found	750712166
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Name: SupportedNameSpace	success or wait	750712502
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Name: Enabled	success or wait	750712833
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Name: Version	success or wait	750713160
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000002 Name: StoresServiceClassInfo	success or wait	750713490
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Name: LibraryPath	success or wait	750716353
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Name: LibraryPath	success or wait	750716687
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Name: DisplayString	success or wait	750716986
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Name: DisplayString	success or wait	750717319
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Name: DisplayString	success or wait	750717646
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Name: DisplayString	success or wait	750717976
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Name: ProviderId	success or wait	750720707
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Name: AddressFamily	object name not found	750721043
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Name: SupportedNameSpace	success or wait	750721376
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Name: Enabled	success or wait	750726126
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Name: Version	success or wait	750726465
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries\000000000003 Name: StoresServiceClassInfo	success or wait	750726798
System info queried	Type: BasicInformation	success or wait	750730716
System info queried	Type: ProcessorInformation	success or wait	750730916
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters Name: Ws2_32NumHandleBuckets	object name not found	750731229
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	750731857
File opened	Path: C:\WINDOWS\System32\mswsock.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750735830
Section loaded	Path: C:\WINDOWS\system32\mswsock.dll Access: write and read and execute Type: commit Baseaddress: BC0000 Size: 245760 Protection: execute Mapped to pid: own pid	success or wait	750736616
File opened	Path: C:\WINDOWS\System32\mswsock.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750742909
Section loaded	Path: C:\WINDOWS\system32\mswsock.dll Access: query and write and read and execute Type: image Baseaddress: 71A50000 Size: 258048 Protection: read write Mapped to pid: own pid	success or wait	750743701
System info queried	Type: BasicInformation	success or wait	750766051
System info queried	Type: ProcessorInformation	success or wait	750766313
Section loaded	Path: \KnownDlls\DNSAPI.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	750767150
File opened	Path: C:\WINDOWS\system32\DNSAPI.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750800197
Section loaded	Path: C:\WINDOWS\system32\dnsapi.dll Access: query and write and read and execute Type: image Baseaddress: 76F20000 Size: 159744 Protection: read write Mapped to pid: own pid	success or wait	750801007
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: QueryAdapterName	object name not found	750821766
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: DisableAdapterDomainName	object name not found	750822206
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: UseDomainNameDevolution	object name not found	750822643
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: UseDomainNameDevolution	success or wait	750825156
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: PrioritizeRecordData	object name not found	750825587
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: PrioritizeRecordData	object name not found	750826518
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: AllowUnqualifiedQuery	object name not found	750826943
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: AllowUnqualifiedQuery	object name not found	750827361
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: AppendToMultiLabelName	object name not found	750827783
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: ScreenBadTlds	object name not found	750830642
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: ScreenUnreachableServers	object name not found	750831067
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: FilterClusterIp	object name not found	750831487
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: WaitForNameErrorOnAll	object name not found	750831907
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: UseEdns	object name not found	750832328
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: QueryIpMatching	object name not found	750832750
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: UseHostsFile	object name not found	750835859
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: RegistrationEnabled	object name not found	750836283
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: DisableDynamicUpdate	object name not found	750836709
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: RegisterPrimaryName	object name not found	750837132
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: RegisterAdapterName	object name not found	750837551
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: EnableAdapterDomainNameRegistration	object name not found	750837984
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: RegisterReverseLookup	object name not found	750840515
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: DisableReverseAddressRegistrations	object name not found	750840943
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: RegisterWanAdapters	object name not found	750841366
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: DisableWanDynamicUpdate	object name not found	750841791
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: RegistrationTtl	object name not found	750842211
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: DefaultRegistrationTTL	object name not found	750842637
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: RegistrationRefreshInterval	object name not found	750847673
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: DefaultRegistrationRefreshInterval	object name not found	750848110
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: RegistrationMaxAddressCount	object name not found	750848539
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: MaxNumberOfAddressesToRegister	object name not found	750848968
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: UpdateSecurityLevel	object name not found	750849390
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: UpdateSecurityLevel	object name not found	750849808
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: UpdateZoneExcludeFile	object name not found	750853940
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: UpdateTopLevelDomainZones	object name not found	750854365
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: DnsTest	object name not found	750854832
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: MaxCacheSize	object name not found	750855322
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: MaxCacheTtl	object name not found	750855743
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: MaxNegativeCacheTtl	object name not found	750856163
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: AdapterTimeoutLimit	object name not found	750858403
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: ServerPriorityTimeLimit	object name not found	750858828
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: MaxCachedSockets	object name not found	750859249
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: MulticastListenLevel	object name not found	750859668
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Dnscache\Parameters Name: MulticastSendLevel	object name not found	750860087
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	750860583
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: DnsQueryTimeouts	object name not found	750865214
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: DnsQuickQueryTimeouts	object name not found	750865494
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: DnsMulticastQueryTimeouts	object name not found	750870338
System info queried	Type: BasicInformation	success or wait	750873275
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc Name: MaxRpcSize	object name not found	750873691
System time queried	Time: 129876420429687500	success or wait	750874498
System info queried	Type: PerformanceInformation	success or wait	750874981
Process information queried	PID: 760 Info Class: QuotaLimits	success or wait	750876885
Process information queried	PID: 760 Info Class: VmCounters	success or wait	750879822
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Hostname	success or wait	750915645
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Hostname	success or wait	750919190
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Domain	success or wait	750926623
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Domain	success or wait	750927013
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: DnsNbtLookupOrder	object name not found	750927914
File opened	Path: C:\WINDOWS\System32\winrnr.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750932641
Section loaded	Path: C:\WINDOWS\system32\winrnr.dll Access: write and read and execute Type: commit Baseaddress: BC0000 Size: 20480 Protection: execute Mapped to pid: own pid	success or wait	750933428
File opened	Path: C:\WINDOWS\System32\winrnr.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750938095
Section loaded	Path: C:\WINDOWS\system32\winrnr.dll Access: query and write and read and execute Type: image Baseaddress: 76FB0000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	750938887
Section loaded	Path: \KnownDlls\WLDAP32.dll Access: write and read and execute Type: unknown Baseaddress: 76F60000 Size: 180224 Protection: read write Mapped to pid: own pid	success or wait	750950640
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\ldap Name: LdapClientIntegrity	success or wait	750964085
System info queried	Type: BasicInformation	success or wait	750966918
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Hostname	success or wait	750971732
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Hostname	success or wait	750972177
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Domain	success or wait	750987230
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Domain	success or wait	750995218
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Hostname	success or wait	751030893
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Hostname	success or wait	751031266
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Domain	success or wait	751035272
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Domain	success or wait	751039736
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters Name: WinSock_Registry_Version	success or wait	751041157
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters Name: WinSock_Registry_Version	success or wait	751041489
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\WinSock2\Parameters Name: AutodialDLL	object name not found	751041818
Section loaded	Path: \KnownDlls\rasadhlp.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	751050549
File opened	Path: C:\WINDOWS\system32\rasadhlp.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751050991
Section loaded	Path: C:\WINDOWS\system32\rasadhlp.dll Access: query and write and read and execute Type: image Baseaddress: 76FC0000 Size: 24576 Protection: read write Mapped to pid: own pid	success or wait	751078845
File opened	Path: \Device\RasAcd Access: read data or list directory and write data or add file Options: no options Attributes: normal Content Overwritten: true	success or wait	751100395
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: User Agent	success or wait	751108231
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: User Agent	success or wait	751108557
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: FromCacheTimeout	object name not found	751149308
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: SecureProtocols	success or wait	751154011
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: CertificateRevocation	object name not found	751154945
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: CertificateRevocation	object name not found	751155638
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableKeepAlive	object name not found	751160258
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisablePassport	object name not found	751160605
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: IdnEnabled	object name not found	751160945
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: CacheMode	object name not found	751161283
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableHttp1_1	success or wait	751161752
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ProxyHttp1.1	object name not found	751171364
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: ProxyHttp1.1	object name not found	751171839
Process information queried	PID: 760 Info Class: Wow64Information	success or wait	751172168
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableNegotiate	success or wait	751172585
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableBasicOverClearChannel	object name not found	751172927
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl Name: Feature_ClientAuthCertFilter	object name not found	751176234
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ClientAuthBuiltInUI	object name not found	751176759
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: SyncMode5	object name not found	751177664
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache Name: SessionStartTimeDefaultDeltaSecs	object name not found	751178168
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache Name: Signature	success or wait	751180956
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache Name: Signature	success or wait	751181306
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content Name: PerUserItem	success or wait	751182162
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Cache	success or wait	751184537
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cache Type: unicode Data: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files Old data:	success or wait	751186539
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	751191202
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file	success or wait	751192098
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	751198014
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file	success or wait	751198943
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content Name: CachePrefix	success or wait	751205139
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content Name: CachePrefix	success or wait	751205496
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content Name: CacheLimit	success or wait	751248482
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies Name: PerUserItem	success or wait	751249071
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Cookies	success or wait	751251018
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cookies Type: unicode Data: C:\Documents and Settings\Administrator\Cookies Old data:	success or wait	751255300
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies Name: CachePrefix	success or wait	751256017
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies Name: CachePrefix	success or wait	751256495
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies Name: CacheLimit	success or wait	751259570
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History Name: PerUserItem	success or wait	751260126
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: History	success or wait	751267705
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: History Type: unicode Data: C:\Documents and Settings\Administrator\Local Settings\History Old data:	success or wait	751279402
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\History Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	751280170
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\History New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file	success or wait	751290082
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\History\History.IE5 Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	751292052
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\History\History.IE5 New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file	success or wait	751292939
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History Name: CachePrefix	success or wait	751299313
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History Name: CachePrefix	success or wait	751299665
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History Name: CacheLimit	success or wait	751300012
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	751311747
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file	success or wait	751312723
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and random access Attributes: hidden and system and not contend indexed Content Overwritten: true	success or wait	751314410
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\index.dat New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 00:20 25-07-2012 Change Time: 01:00 01-01-1601 File Attributes: none	success or wait	751315662
Section loaded	Path: \BaseNamedObjects\Local\C:_Documents and Settings_Administrator_Local Settings_Temporary Internet Files_Content.IE5_index.dat_65536 Access: write Type: unknown Baseaddress: BD0000 Size: 65536 Protection: read write Mapped to pid: own pid	success or wait	751320748
File opened	Path: C:\Documents and Settings\Administrator\Cookies\ Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	751323377
File other op	Path: C:\Documents and Settings\Administrator\Cookies New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file	success or wait	751326332
File opened	Path: C:\Documents and Settings\Administrator\Cookies\index.dat Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and random access Attributes: hidden and system and not contend indexed Content Overwritten: true	success or wait	751327510
File other op	Path: C:\Documents and Settings\Administrator\Cookies\index.dat New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 00:20 25-07-2012 Change Time: 01:00 01-01-1601 File Attributes: none	success or wait	751353262
Section loaded	Path: \BaseNamedObjects\Local\C:_Documents and Settings_Administrator_Cookies_index.dat_32768 Access: write Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	751354839
Section loaded	Path: \BaseNamedObjects\Local\C:_Documents and Settings_Administrator_Cookies_index.dat_32768 Access: query and write and read Type: commit Baseaddress: BE0000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	751355126
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\ Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	751356887
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\History\History.IE5 New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file	success or wait	751377638
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and random access Attributes: hidden and system and not contend indexed Content Overwritten: true	success or wait	751378821
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\index.dat New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 00:20 25-07-2012 Change Time: 01:00 01-01-1601 File Attributes: none	success or wait	751379760
Section loaded	Path: \BaseNamedObjects\Local\C:_Documents and Settings_Administrator_Local Settings_History_History.IE5_index.dat_32768 Access: write Type: unknown Baseaddress: BF0000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	751385273
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5\ Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	751386582
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.IE5 New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file	success or wait	751387491
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\History\History.IE5\ Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	751392235
File other op	Path: C:\Documents and Settings\Administrator\Local Settings\History\History.IE5 New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: hidden and system and archive and temporary and sparse file	success or wait	751393165
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat Name: CacheRepair	success or wait	751394904
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat Name: CachePath	buffer overflow	751397673
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat Name: CachePath	success or wait	751398053
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat Name: CachePath	buffer overflow	751398394
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat Name: CachePath	success or wait	751398729
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat Name: CachePrefix	success or wait	751399082
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat Name: CachePrefix	success or wait	751399418
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat Name: CacheLimit	success or wait	751407367
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\feedplat Name: CacheOptions	success or wait	751407710
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat Name: CacheRepair	success or wait	751414067
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat Name: CachePath	success or wait	751414414
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat Name: CachePath	success or wait	751414805
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat Name: CachePrefix	success or wait	751415151
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat Name: CachePrefix	success or wait	751415485
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat Name: CacheLimit	success or wait	751415818
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\iecompat Name: CacheOptions	success or wait	751423638
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld Name: CacheRepair	success or wait	751424382
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld Name: CachePath	success or wait	751424728
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld Name: CachePath	success or wait	751425792
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld Name: CachePrefix	success or wait	751435842
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld Name: CachePrefix	success or wait	751436179
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld Name: CacheLimit	success or wait	751436517
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\ietld Name: CacheOptions	success or wait	751436854
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725 Name: CacheRepair	success or wait	751437663
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725 Name: CachePath	buffer overflow	751452780
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725 Name: CachePath	success or wait	751453128
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725 Name: CachePath	buffer overflow	751453474
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725 Name: CachePath	success or wait	751453807
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725 Name: CachePrefix	success or wait	751454162
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725 Name: CachePrefix	success or wait	751454565
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725 Name: CacheLimit	success or wait	751459815
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\MSHist012012072420120725 Name: CacheOptions	success or wait	751460154
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE: Name: CacheRepair	success or wait	751461688
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE: Name: CachePath	success or wait	751462032
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE: Name: CachePath	success or wait	751462612
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE: Name: CachePrefix	success or wait	751463282
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE: Name: CachePrefix	success or wait	751463617
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE: Name: CacheLimit	success or wait	751463950
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\PrivacIE: Name: CacheOptions	success or wait	751464328
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData Name: CacheRepair	success or wait	751465166
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData Name: CachePath	success or wait	751468419
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData Name: CachePath	success or wait	751468758
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData Name: CachePrefix	success or wait	751470507
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData Name: CachePrefix	success or wait	751470849
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData Name: CacheLimit	success or wait	751471186
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Extensible Cache\UserData Name: CacheOptions	success or wait	751471665
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableWorkerThreadHibernation	object name not found	751475075
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableWorkerThreadHibernation	object name not found	751475588
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableReadRange	object name not found	751478176
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: SocketSendBufferLength	object name not found	751478519
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: SocketReceiveBufferLength	object name not found	751478859
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: KeepAliveTimeout	object name not found	751479198
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: MaxHttpRedirects	object name not found	751479538
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: MaxConnectionsPerServer	object name not found	751479946
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: MaxConnectionsPerServer	object name not found	751486608
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: MaxConnectionsPer1_0Server	object name not found	751512449
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: MaxConnectionsPer1_0Server	object name not found	751512889
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: MaxConnectionsPerProxy	object name not found	751513417
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ServerInfoTimeout	object name not found	751513765
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ConnectTimeOut	object name not found	751539485
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: ConnectTimeOut	object name not found	751539930
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ConnectRetries	object name not found	751540458
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: ConnectRetries	object name not found	751540913
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: SendTimeOut	object name not found	751566883
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: SendTimeOut	object name not found	751567327
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ReceiveTimeOut	object name not found	751567859
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: ReceiveTimeOut	object name not found	751568282
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableNTLMPreAuth	object name not found	751594258
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ScavengeCacheLowerBound	object name not found	751594617
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: CertCacheNoValidate	object name not found	751594964
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache Name: ScavengeCacheFileLifeTime	object name not found	751595500
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache Name: ScavengeCacheFileLimit	object name not found	751596302
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache Name: ScavengeCacheFileLimit	object name not found	751622575
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: HttpDefaultExpiryTimeSecs	object name not found	751632711
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: FtpDefaultExpiryTimeSecs	object name not found	751633062
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK Name: rundll32.exe	object name not found	751635131
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_DISABLE_UNICODE_HANDLE_CLOSING_CALLBACK Name: *	object name not found	751661687
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableCachingOfSSLPages	success or wait	751671045
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: PerUserCookies	object name not found	751671573
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: LeashLegacyCookies	object name not found	751671915
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableNT4RasCheck	object name not found	751698158
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DialupUseLanSettings	object name not found	751698669
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: DialupUseLanSettings	object name not found	751699102
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: SendExtraCRLF	object name not found	751699809
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: BypassFtpTimeCheck	object name not found	751701517
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ReleaseSocketDuringAuth	object name not found	751701866
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ReleaseSocketDuring401Auth	object name not found	751702302
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: ReleaseSocketDuring401Auth	object name not found	751702723
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: WpadSearchAllDomains	object name not found	751706557
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableLegacyPreAuthAsServer	object name not found	751707017
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: DisableLegacyPreAuthAsServer	object name not found	751707447
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: BypassHTTPNoCacheCheck	object name not found	751708248
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: BypassHTTPNoCacheCheck	object name not found	751716910
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: BypassSSLNoCacheCheck	object name not found	751717706
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: BypassSSLNoCacheCheck	object name not found	751718127
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableHttpTrace	object name not found	751722075
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: NoCheckAutodialOverRide	object name not found	751722692
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: NoCheckAutodialOverRide	object name not found	751723119
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DontUseDNSLoadBalancing	object name not found	751737800
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: DontUseDNSLoadBalancing	object name not found	751738223
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: ShareCredsWithWinHttp	object name not found	751738813
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: MimeExclusionListForCache	success or wait	751741932
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: MimeExclusionListForCache	success or wait	751742282
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: MimeExclusionListForCache	success or wait	751742628
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: MimeExclusionListForCache	success or wait	751742967
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: HeaderExclusionListForCache	object name not found	751743326
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DnsCacheEnabled	object name not found	751743663
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DnsCacheEntries	object name not found	751745989
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: DnsCacheTimeout	object name not found	751746333
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: WarnOnPost	success or wait	751746677
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: WarnAlwaysOnPost	object name not found	751747014
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: WarnOnZoneCrossing	success or wait	751747354
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: WarnOnBadCertSending	object name not found	751747696
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: WarnOnBadCertRecving	object name not found	751749865
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: WarnOnPostRedirect	object name not found	751750210
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: AlwaysDrainOnRedirect	object name not found	751750595
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: WarnOnHTTPSToHTTPRedirect	object name not found	751750934
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: GlobalUserOffline	object name not found	751751637
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableAutodial	object name not found	751752440
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: UrlEncoding	success or wait	751761520
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: UrlEncoding	success or wait	751761858
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: TruncateFileName	object name not found	751762378
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: BadProxyExpiresTime	object name not found	751763127
Thread created	PID: 760 TID: 1300 EIP: 7C8106F9 EAX: 7C927D83 Imagepath: C:\WINDOWS\system32\rundll32.exe	success or wait	751776796
Thread resumed	TID: 1300 PID: 760 Path: C:\WINDOWS\system32\rundll32.exe	success or wait	751777800
System info queried	Type: BasicInformation	success or wait	751791758
Thread delayed	Time: -922337203685 TID: 1300	unknown	751791893
Thread created	PID: 760 TID: 1120 EIP: 7C8106F9 EAX: 7C910250 Imagepath: C:\WINDOWS\system32\rundll32.exe	success or wait	751793063
Thread resumed	TID: 1120 PID: 760 Path: C:\WINDOWS\system32\rundll32.exe	success or wait	751809135
Section loaded	Path: \KnownDlls\RASAPI32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	751810100
File opened	Path: C:\WINDOWS\system32\RASAPI32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751810543
Section loaded	Path: C:\WINDOWS\system32\rasapi32.dll Access: query and write and read and execute Type: image Baseaddress: 76EE0000 Size: 245760 Protection: read write Mapped to pid: own pid	success or wait	751811683
Section loaded	Path: \KnownDlls\rasman.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	751855168
File opened	Path: C:\WINDOWS\system32\rasman.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751866508
Section loaded	Path: C:\WINDOWS\system32\rasman.dll Access: query and write and read and execute Type: image Baseaddress: 76E90000 Size: 73728 Protection: read write Mapped to pid: own pid	success or wait	751867308
Section loaded	Path: \KnownDlls\NETAPI32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	751886989
File opened	Path: C:\WINDOWS\system32\NETAPI32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751894909
Section loaded	Path: C:\WINDOWS\system32\netapi32.dll Access: query and write and read and execute Type: image Baseaddress: 5B860000 Size: 348160 Protection: read write Mapped to pid: own pid	success or wait	751895744
Section loaded	Path: \KnownDlls\TAPI32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	751976788
File opened	Path: C:\WINDOWS\system32\TAPI32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751988368
Section loaded	Path: C:\WINDOWS\system32\tapi32.dll Access: query and write and read and execute Type: image Baseaddress: 76EB0000 Size: 192512 Protection: read write Mapped to pid: own pid	success or wait	751989179
Section loaded	Path: \KnownDlls\rtutils.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	752130656
File opened	Path: C:\WINDOWS\system32\rtutils.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	752131131
Section loaded	Path: C:\WINDOWS\system32\rtutils.dll Access: query and write and read and execute Type: image Baseaddress: 76E80000 Size: 57344 Protection: read write Mapped to pid: own pid	success or wait	752132399
File opened	Path: C:\WINDOWS\system32\TAPI32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	752266062
Section loaded	Path: C:\WINDOWS\system32\tapi32.dll Access: read Type: commit Baseaddress: C80000 Size: 184320 Protection: readonly Mapped to pid: own pid	success or wait	752296493
File opened	Path: C:\WINDOWS\system32\TAPI32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	752301261
File opened	Path: C:\WINDOWS\system32\TAPI32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	752323899
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	752365440
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony Name: Tapi32MaxNumRequestRetries	object name not found	752373775
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony Name: Tapi32RequestRetryTimeout	object name not found	752387959
Mutant created	Name: unknown	success or wait	752388536
Mutant created	Name: \BaseNamedObjects\RasPbFile	access denied	752411886
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing Name: EnableConsoleTracing	success or wait	752422058
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: EnableFileTracing	success or wait	752424239
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: FileTracingMask	success or wait	752424592
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: EnableConsoleTracing	success or wait	752424936
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: ConsoleTracingMask	success or wait	752425932
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: MaxFileSize	success or wait	752426272
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: FileDirectory	success or wait	752426612
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: FileDirectory	success or wait	752455149
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: EnableFileTracing	success or wait	752455628
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: FileTracingMask	success or wait	752455972
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: EnableConsoleTracing	success or wait	752464022
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: ConsoleTracingMask	success or wait	752464371
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: MaxFileSize	success or wait	752464715
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: FileDirectory	success or wait	752465056
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Tracing\RASAPI32 Name: FileDirectory	success or wait	752465398
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Common AppData	success or wait	752466717
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: ProfilesDirectory	success or wait	752485119
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: AllUsersProfile	success or wait	752485874
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	752487236
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	752504748
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	752506021
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	752506442
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	752507290
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	752517475
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: ProfilesDirectory	success or wait	752522054
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: DefaultUserProfile	success or wait	752532938
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	752533606
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: ProgramFilesDir	success or wait	752545959
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: CommonFilesDir	success or wait	752556140
File opened	Path: \pipe\ROUTER Access: read attributes and synchronize and generic read and generic write Options: non directory file and open no recall Attributes: none Content Overwritten: true	success or wait	752557987
File other op	Path: \ROUTER New path: Disposition: PipeInformation Data : unknown	success or wait	752566383
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	752566740
File other op	Path: \ROUTER New path: Disposition: CompletionInformation Data : unknown	success or wait	752567609
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	752567910
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	752572943
File write	Path: \ROUTER Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 80 BD A8 AF 8A 7D C9 11 BE F4 08 00 2B 10 29 89 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	752573182
File read	Path: \ROUTER Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 75 18 00 00 0D 00 5C 50 49 50 45 5C 52 4F 55 54 45 52 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	752577031
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	752577396
File control set	Path: \ROUTER Control Code: 11C017 Input Buffer: ........ .......................	pending	752578839
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 29 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	752579145
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	752588647
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService Name: 10	success or wait	752598686
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........t.......\.....9.........I..G.`..4....................................CF..w.tC..2............................	pending	752712257
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,.......................I..G.`..4...	pending	752773671
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders Name: SecurityProviders	success or wait	752785391
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders Name: SecurityProviders	success or wait	752791824
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	752803640
Section loaded	Path: \KnownDlls\msapsspc.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	752817803
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	752818045
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	752824872
File opened	Path: C:\WINDOWS\system32\msapsspc.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	752825170
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	752828649
Section loaded	Path: C:\WINDOWS\system32\msapsspc.dll Access: query and write and read and execute Type: image Baseaddress: 71E50000 Size: 86016 Protection: read write Mapped to pid: own pid	success or wait	752828867
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 2A 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 48 00 41 00 4E 00 55 00 45 00 4C 00 45 00 2D 00 42 00 43 00 36 00 30 00 37 00 32 00 30 00 52 00	success or wait	752844925
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	752846861
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........t.......\.....9........2jq.E...2.:. .................................CF..w.tC..2............................	pending	752853129
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,......................2jq.E...2.:.	pending	752885541
Section loaded	Path: \KnownDlls\MSVCRT40.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	752892607
File opened	Path: C:\WINDOWS\system32\MSVCRT40.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	752893131
Section loaded	Path: C:\WINDOWS\system32\msvcrt40.dll Access: query and write and read and execute Type: image Baseaddress: 78080000 Size: 69632 Protection: read write Mapped to pid: own pid	success or wait	752893976
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	752960983
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	752962057
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	752962858
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	752963214
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 6A 28 19 39 0C B1 D0 11 9B A8 00 C0 4F D9 2E F5 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	752963621
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 2B 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 48 00 41 00 4E 00 55 00 45 00 4C 00 45 00 2D 00 42 00 43 00 36 00 30 00 37 00 32 00 30 00 52 00	success or wait	752964325
Section loaded	Path: \KnownDlls\schannel.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	752972714
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ..........................	pending	752973116
File opened	Path: C:\WINDOWS\system32\schannel.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	752995168
Section loaded	Path: C:\WINDOWS\system32\schannel.dll Access: query and write and read and execute Type: image Baseaddress: 767F0000 Size: 163840 Protection: read write Mapped to pid: own pid	success or wait	752996817
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: ProfileImagePath	success or wait	753016092
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Name: ParseAutoexec	success or wait	753029262
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753029841
File opened	Path: c:\autoexec.bat Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	753037465
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753038215
File read	Path: C:\AUTOEXEC.BAT Offset: unknown Length: 0 Value: unknown	success or wait	753038509
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753056738
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753057218
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753072608
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753074038
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753075448
Section loaded	Path: \KnownDlls\CRYPT32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	753086592
File opened	Path: C:\WINDOWS\system32\CRYPT32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	753097972
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753098153
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753099079
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753100428
Section loaded	Path: C:\WINDOWS\system32\crypt32.dll Access: query and write and read and execute Type: image Baseaddress: 77A80000 Size: 610304 Protection: read write Mapped to pid: own pid	success or wait	753136604
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753138920
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753140310
Section loaded	Path: \KnownDlls\MSASN1.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	753161851
File opened	Path: C:\WINDOWS\system32\MSASN1.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	753162392
Key value replaced with same	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Common AppData Type: unicode Data: C:\Documents and Settings\All Users\Application Data Old data:	success or wait	753179387
File opened	Path: C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Connections\Pbk\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753180046
Section loaded	Path: C:\WINDOWS\system32\msasn1.dll Access: query and write and read and execute Type: image Baseaddress: 77B20000 Size: 73728 Protection: read write Mapped to pid: own pid	success or wait	753181741
File opened	Path: C:\WINDOWS\system32\Ras\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753206174
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: AppData	success or wait	753257147
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: ProfilesDirectory	success or wait	753277423
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: AllUsersProfile	success or wait	753286147
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753299587
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753300454
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753305902
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753310901
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	753316755
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: ProfilesDirectory	success or wait	753328382
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: DefaultUserProfile	success or wait	753336753
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: ProgramFilesDir	success or wait	753358005
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: CommonFilesDir	success or wait	753358440
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	753359874
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	753360658
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	753361020
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	753380931
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 2E 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 0A 00 00 00 00 00 00 00 0A 00 00 00 57 00 4F 00 52 00 4B 00 47 00 52 00 4F 00 55 00 50 00 00 00	success or wait	753381621
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	753384713
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........t.......\.....9.....B/J.xl>H...@.....................................CF..w.tC..2............................	pending	753386155
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,...................B/J.xl>H...@....	pending	753387305
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	753402591
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	753403367
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	753403727
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	753404136
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 2F 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 48 00 41 00 4E 00 55 00 45 00 4C 00 45 00 2D 00 42 00 43 00 36 00 30 00 37 00 32 00 30 00 00 00	success or wait	753405819
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	753417165
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........t.......\.....9......._....C...NR....................................CF..w.tC..2............................	pending	753418561
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,....................._....C...NR...	pending	753420748
Section loaded	Path: \KnownDlls\digest.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	753428828
File opened	Path: C:\WINDOWS\system32\digest.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	753430178
Section loaded	Path: C:\WINDOWS\system32\digest.dll Access: query and write and read and execute Type: image Baseaddress: 75B00000 Size: 86016 Protection: read write Mapped to pid: own pid	success or wait	753431492
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: ProfileImagePath	success or wait	753440366
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Winlogon Name: ParseAutoexec	success or wait	753448790
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753451433
File opened	Path: c:\autoexec.bat Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	753455860
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753457323
File read	Path: C:\AUTOEXEC.BAT Offset: unknown Length: 0 Value: unknown	success or wait	753457986
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753467529
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753472188
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753478795
System info queried	Type: BasicInformation	success or wait	753479009
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753488818
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753606644
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753613821
Mutant created	Name: unknown	success or wait	753614065
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753614839
Section loaded	Path: \KnownDlls\msnsspc.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	753619928
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753626060
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753627421
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	753628952
File opened	Path: C:\WINDOWS\system32\msnsspc.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	753637122
Section loaded	Path: C:\WINDOWS\system32\msnsspc.dll Access: query and write and read and execute Type: image Baseaddress: 747B0000 Size: 290816 Protection: read write Mapped to pid: own pid	success or wait	753638288
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: AppData Type: unicode Data: C:\Documents and Settings\Administrator\Application Data Old data:	success or wait	753663784
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Network\Connections\Pbk\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	object path not found	753664437
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableAutodial	object name not found	753665306
Section loaded	Path: \KnownDlls\MSVCRT40.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	753670453
File opened	Path: C:\WINDOWS\system32\MSVCRT40.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	753672600
Section loaded	Path: C:\WINDOWS\system32\msvcrt40.dll Access: query and write and read and execute Type: image Baseaddress: 78080000 Size: 69632 Protection: read write Mapped to pid: own pid	success or wait	753673448
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	753732276
Section loaded	Path: \KnownDlls\sensapi.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	753732977
File opened	Path: C:\WINDOWS\system32\sensapi.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	753734883
Section loaded	Path: C:\WINDOWS\system32\sensapi.dll Access: query and write and read and execute Type: image Baseaddress: 722B0000 Size: 20480 Protection: read write Mapped to pid: own pid	success or wait	753735681
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Name	success or wait	753910043
Section loaded	Path: \BaseNamedObjects\SENS Information Cache Access: read Type: unknown Baseaddress: C80000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	753910226
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Name	success or wait	753911209
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Comment	success or wait	753912842
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	753913632
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Comment	success or wait	753914310
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	753914912
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Capabilities	success or wait	753915230
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	753918252
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: RpcId	success or wait	753923049
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	753923659
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Version	success or wait	753924242
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 30 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 48 00 41 00 4E 00 55 00 45 00 4C 00 45 00 2D 00 42 00 43 00 36 00 30 00 37 00 32 00 30 00 00 00	success or wait	753924779
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: Type	success or wait	753925091
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	753930463
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ................p.....D......a.L...B.B..............&.(.................N.T. .A.u.t.h.o.r.i.t.y.\.S.y.s.t.e.m...........................	pending	753932447
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msapsspc.dll Name: TokenSize	success or wait	753934514
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,....................a.L...B.B......	pending	753935990
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Name	success or wait	753947303
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Name	success or wait	753947686
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Comment	success or wait	753954150
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Comment	success or wait	753954545
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Capabilities	success or wait	753954924
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: RpcId	success or wait	753964355
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Version	success or wait	753964745
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: Type	success or wait	753965121
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\digest.dll Name: TokenSize	success or wait	753989923
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Name	success or wait	753998458
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Name	success or wait	754019113
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Comment	success or wait	754510096
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	754510319
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Comment	success or wait	754524075
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Capabilities	success or wait	754526722
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: MigrateProxy	success or wait	754534619
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: RpcId	success or wait	754534805
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Version	success or wait	754553547
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ProxyEnable	success or wait	754554092
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: Type	success or wait	754554386
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ProxyServer	object name not found	755035074
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Lsa\SspiCache\msnsspc.dll Name: TokenSize	success or wait	755041198
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ProxyOverride	object name not found	755041802
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: AutoConfigURL	object name not found	755042381
File opened	Path: C:\WINDOWS\system32\msv1_0.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755075596
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Name: SavedLegacySettings	success or wait	755076620
Section loaded	Path: C:\WINDOWS\system32\msv1_0.dll Access: write and read and execute Type: commit Baseaddress: CC0000 Size: 139264 Protection: execute Mapped to pid: own pid	success or wait	755083756
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Name: SavedLegacySettings	success or wait	755092073
File opened	Path: C:\WINDOWS\system32\msv1_0.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755106854
Section loaded	Path: C:\WINDOWS\system32\msv1_0.dll Access: query and write and read and execute Type: image Baseaddress: 77C70000 Size: 151552 Protection: read write Mapped to pid: own pid	success or wait	755107710
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Name: DefaultConnectionSettings	success or wait	755112580
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Name: DefaultConnectionSettings	success or wait	755112922
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ProxyEnable Type: dword Data: 0 Old data:	success or wait	755115540
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Keyname: ProxyServer	object name not found	755116072
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Keyname: ProxyOverride	object name not found	755120312
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Keyname: AutoConfigURL	object name not found	755120519
Section loaded	Path: \KnownDlls\cryptdll.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	755124008
File opened	Path: C:\WINDOWS\system32\cryptdll.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755124516
Section loaded	Path: C:\WINDOWS\system32\cryptdll.dll Access: query and write and read and execute Type: image Baseaddress: 76790000 Size: 49152 Protection: read write Mapped to pid: own pid	success or wait	755125370
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Name: SavedLegacySettings	success or wait	755132230
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Name: SavedLegacySettings	success or wait	755133111
Key value replaced with new	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Name: SavedLegacySettings Type: binary Data: 46 00 00 00 9C 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 10 C5 45 3D 26 AB CA 01 01 00 00 00 0A 00 02 0F 00 00 00 00 00 00 00 00 00 00 00 00 Old data: 46 00 00 00 9B 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 10 C5 45 3D 26 AB CA 01 01 00 00 00 0A 00 02 0F 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	755142548
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Name: rundll32.exe	object name not found	755154920
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_MIME_HANDLING Name: *	object name not found	755164717
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	755168276
Section loaded	Path: \KnownDlls\iphlpapi.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	755176268
File opened	Path: C:\WINDOWS\system32\iphlpapi.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755176769
Section loaded	Path: C:\WINDOWS\system32\iphlpapi.dll Access: query and write and read and execute Type: image Baseaddress: 76D60000 Size: 102400 Protection: read write Mapped to pid: own pid	success or wait	755177626
System info queried	Type: BasicInformation	success or wait	755361955
File opened	Path: \Device\Tcp Access: generic execute Options: no options Attributes: normal Content Overwritten: true	success or wait	755367632
File opened	Path: \Device\Tcp Access: generic execute Options: no options Attributes: normal Content Overwritten: true	success or wait	755368384
File opened	Path: \Device\Ip Access: generic execute Options: no options Attributes: normal Content Overwritten: true	success or wait	755377190
File opened	Path: \Device\Ip Access: generic execute Options: no options Attributes: normal Content Overwritten: true	success or wait	755377685
File opened	Path: Ip Access: read attributes and synchronize and generic execute Options: non directory file Attributes: normal Content Overwritten: true	success or wait	755378175
File opened	Path: C:\WINDOWS\system32\mscoree.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755584788
Section loaded	Path: C:\WINDOWS\system32\mscoree.dll Access: write and read and execute Type: commit Baseaddress: CC0000 Size: 299008 Protection: execute Mapped to pid: own pid	success or wait	755585578
File opened	Path: \pipe\ROUTER Access: read attributes and synchronize and generic read and generic write Options: non directory file and open no recall Attributes: none Content Overwritten: true	success or wait	755608674
File opened	Path: C:\WINDOWS\system32\mscoree.dll Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	755609196
Section loaded	Path: C:\WINDOWS\system32\mscoree.dll Access: query and read Type: commit Baseaddress: CC0000 Size: 299008 Protection: readonly Mapped to pid: own pid	success or wait	755614200
File other op	Path: \ROUTER New path: Disposition: PipeInformation Data : unknown	success or wait	755614487
File other op	Path: \ROUTER New path: Disposition: CompletionInformation Data : unknown	success or wait	755618606
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	755621129
File write	Path: \ROUTER Offset: 0 Length: 144 Value: 05 00 0B 07 10 00 00 00 90 00 40 00 02 00 00 00 B8 10 B8 10 75 18 00 00 01 00 00 00 01 00 01 00 36 00 61 20 22 FA CF 11 98 23 00 A0 C9 11 E5 DF 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 0A 06 00 00 D8 02 0B 00 4E 54 4C 4D 53 53 50 00 01 00 00 00 B7 B2 08 E2 09 00 09 00	success or wait	755630507
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	755630721
File read	Path: \ROUTER Offset: 0 Length: 1024 Value: 05 00 0C 07 10 00 00 00 2E 01 E2 00 02 00 00 00 B8 10 B8 10 75 18 00 00 0D 00 5C 50 49 50 45 5C 52 4F 55 54 45 52 00 BE 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 0A 06 00 00 D8 02 0B 00 4E 54 4C 4D 53 53 50 00 02 00 00 00 1E 00 1E 00 38 00 00 00 35 C2 8A E2	success or wait	755633570
File opened	Path: C:\WINDOWS\system32\mscoree.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755639941
File write	Path: \ROUTER Offset: 0 Length: 100 Value: 05 00 10 03 10 00 00 00 64 00 48 00 02 00 00 00 B8 10 B8 10 0A 06 00 00 D8 02 0B 00 4E 54 4C 4D 53 53 50 00 03 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 48 00 00 00 00 00 00 00 48 00 00 00 35 C2 88 E2 05 01 28 0A 00 00 00 0F	success or wait	755657871
Section loaded	Path: C:\WINDOWS\system32\mscoree.dll Access: write and read and execute Type: commit Baseaddress: CC0000 Size: 299008 Protection: execute Mapped to pid: own pid	success or wait	755665546
File control set	Path: \ROUTER Control Code: 11C017 Input Buffer: ........`.......$.......c.I........m"Jo...'G.._.......N..y?....l.[d..[.X.h..~.IW.$..q..r......E~......R...C=\.P..\.LXGX.Lz...6....e.h...z.^4...U.f...wX.....uo..A...L.....tL..8n...;,..!.......8.......+..... H.ZT[..E....g.Jc....(..%..t......k......d.{.I.....2.a...Z..n..wS...~......Ss.3..f..............._..A...3V.(....-?.w.G.w.....v.......s.8.Xo...4........A...i&".>....6....p1D..c.t..77....k{.......Q7.{5..Q.m...<V.....~...q.FB[..`.n.8..Ly`V._.X..C.....2..)..$.....,?q.........f...FF.Np../...+..Q.......p....d.z#w[..9.(.q......hj..........z...E5......!N.T%4.9p.M..`.g8..P3.:...x._b...=.y..Vx'.....b\Y..Q..n...g/....R.n............I......Mf..uB..W.r..0.....'...i.Q.I.<H.......:_:..H..P.....e_....l...\....n..\W.l..#c.....A,4(.......F.-z....Qj......Q.L....m'}..%.O....T.......^@..B.......KH...j..d.....W-.X..&.{M.Oi.\|Q..D.b..{"J...E..K(..&.....d..,....ox..d....`..V.r..f-.....F..<.S. ....K.Z../..Ph.L..1........[..k..)b..2..@....F..T..1CH....A.B.[9,.p.b..O_W...Y...\|.s..kP.....4......(..G.q..1.[g....C....Sp...M.7WKu.......I...e......z..5..8'F.;...M......m8.._U3s^BN.O.b....t...........fM....j...3....?...m'....J..`lc.cV.B..........x;..PK......W..^..r~..h.6...X..D.....t...z....5....e...{.~.].F...........C................n"%...G.....1z!.r.8v..z+.1...&......_....Ug.ww.7..]..ij`.C.C......Gh.....%....~..2.~D{ni....%...a.g...DU...8O.......q.......B...!s...6X..........7f7.0:.......tm....cv.J.I..".Y.@t..>O.X.,Yq..6RkI..J.\|:w.& ......O...E....~>.f....aB^1..........A."%............-~P3.l...Y.>>..t....'.c,L]6.L.t....C....ov[..+mX.H...........z....+.t.kG....:.E.n...C_..P.y....H....t0}..6....dp....j).......7...rh.G.0.VKbYun....%......v9..3.<...W.%.C...P...........,H...hh...P.......r[..W...G?..PN..h=H.j)..R.G..Nh..............3..T.u.{:.J..(.u.w\...L.......i....^m..F...1.]<.....$.CD..u.x.5..2..~m.,\...J...1...D8._.t......4..(.....r........e.Yi..2.e..:....eO.....{.a..\|N.E......I.........Zk...z(.#..?.O...N.H>`.5.....\........f..H.@.&......"<!.,c`;]m5........q......z..jd..'.jG......6.G.C]..4..0g.+.].,...j...C.....X....."G....^x..$.:...xn..DH.....W..i.7...h....>....{..B$...6.\|...h.zg.(.J:H.E.xe..P....;.....A..p.....4...6".i...J.d.B..dfw..x........E.F..@)...}%g.......-....w@:xN..Q....f..n...[.^.;U..:<vz...d..0..../P.r.../.9...=.2....D9X.6...E ..q(..A\..]...6..%..u.....If...]5\|v..f........?.C...e.Ve....D.u........i..5fz.;d.E.e.,{_...E.I.4.ken..%.u.7=...*...[ ]F..!...H..%...C`w[.........^d.F?.....S.[.,b...Vc~......N...._...$b....N....T.........4e..hq<J:b1b..\.W.p..&...7.."...=z...=VR...b.ma"%-....w.#...n,.p...^...):..r.fsdM.........g.9n..X......(1...}.0..B....N...g.u.n.&.........,....;lS.a..#..4.....{Yt....Q<..3................$..d).......	pending	755667537
File read	Path: \ROUTER Offset: 0 Length: 1568 Value: 75 64 0D F0 05 32 93 83 C3 F8 D8 A2 46 AA 03 CC E9 59 B0 F6 7D 4D EF 2E 79 D9 B3 68 CC 42 F4 42 9F 70 7D B9 0A 7C 79 5E 75 FB 6D 72 84 E4 77 92 DD C9 6A 0F E8 CC 6E 9C B5 D8 91 AB 24 D5 49 23 63 C3 A7 F2 25 B3 F6 65 8B 60 A3 67 75 2E 06 5D 84 19 C3 27 77 82 CE A7 02 2E B3 39 E1 65 F3 C3 38 15 1D 8E	success or wait	755670962
File opened	Path: C:\WINDOWS\system32\mscoree.dll Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	755677144
Section loaded	Path: C:\WINDOWS\system32\mscoree.dll Access: query and read Type: commit Baseaddress: CC0000 Size: 299008 Protection: readonly Mapped to pid: own pid	success or wait	755688566
File control set	Path: \ROUTER Control Code: 11C017 Input Buffer: ........ ...............n/S.R[...g.t..f..O.........o.g...Z.. Q..A'Mn.........(zs.\|......+.....c.i....p...[a..(/y...AS.b.. ...P.Z..T...#"..9e...;..`..^.8.&{..r..b;.......%G-w...\|pE....@...._>&.9..lS....................}..'....G.M\.7XF`.J.QO..G.v..A....l.-Z.C....0[`...@uW..?+..]......,.......@.....,.c.e....A.?........Y..h..66....../.....j..Hs_Z..M.5....H....X....i..!...Z......$.7.,..........O.%....2.3y....u..t...+U......E.6..C!....a.\..T.%....4..s.`M.kd....'.r)..."........0...........<.....M...P........6..K....Q...J.....[.7...ZGYR.PW~p..{..b..........P.ruO.]E.....Mu....`..0Bc4...%&.C4+.p-.).S...[h.e...F....p....l]..Sa.<.1Wy.$...Z0.-.f\.....y}..4...`sh~..P.o.L.n.^.H..J....H...k...A...>.<.Lm..........;..%.....)..w..._.U.c%.3zr.....1....#=x'..\|.}......@.....e..\|5......Z........m..u#.....d.H.@..7d.L.....y.eM....N.:T.........F.1...O.XW}h./[N.7=X..2.s..a9....5m.Sl-....\.....0.b....I.8...p..vBJ..[u..6F.V.Y`...P0!GZ%Vz....e..[.........t...)..;L....r.1...G..v.?....Z.JF....1.E.w..v...A%emC{......T...u......}..}.v.q.......R.u...:..z<.....e....a...C[..U W.K.....RI..(.}7.K9..._.....>....b........dv&.}..pZ..b...s4..b...2\|-.?i.:.LI.=gy../.v..N......ED...dz{..l#3z~j...V-h.f...y...&...sR..S.{..Q..X$...).....K.^^.[...a......R...._Z...$_.../.+..B..y..l.,......w4..ZI.. ,a.zJ..sJ.f,....y...Q.?.Y....t...'..2...?....=.8O.#G.$.X....k2...L.h...rzy.......0W.?........>t`...x......<... ..SJ...f.!..l{..?'..7....: ...5[...@.>.f.c.....Wf...%.1. w..E.8Z..../.Bo..4...Ml.W.&E$..Vw.t..ew...P8S!......?...S........E.`d..9.&.o.....1.D..g...$.~..%q.....~fI....1x}..i.T.6.7..f..N[..o!.......:.8U.c.wY!=H'\|....[Opo2QO..T&..G.F...r....fb...P.Z.....$$.p...h+....a...h...$.\|l1^WQ6].........{.E..f....!.../..........i..h$...+.-..8....-0..U.P.....r)..x!.(.....J!X...h..Q...V.=....8...9......O.3...s.D..z.....S.I.....+v]...7.@w..P.......Q....fZ...mI.U^{!......u1Pb.._.p4.../.V.G......a.Oe........m+lQ.l.[ ..5oay<.......Q.............J.N...pI..&...]N%.\J.......3.K.3 F..F....9j..h...............+H........../0....l..<.&3..Im...ne....8.....B....Cg._....G.sAeRI\.;IG......@..Xl.m.....u.........4...w..`.~....b.y......./.+....Je..^.a.=!J..q.`.-`.~Q]Nd..A<.I..0d....J3!.u'..au.J.v..Y(.TF....j....a....V.e...5T.1'.n.H...<....@..$......rZ%}......+.k........M!^..5..t\....ES=...~.4.h..up.L.v9.J..f....t^a..PP.p.....u.Y"... [.7s<...ah....>.....z7..d.^.....#.q....*..!....d...`..y.w.r<8..Z..H...o....vV.".....J..o.....ZLtAm.>.....,j...."..o..f...)>.:5D...7.{9..M..2WK..y.M..j.U.b......)..".S....w!......H..O.X...vgcNrf..-......&.2&.N7...?......0.2+}<x'.....'4D).4..q...C./.....7.h...I.3................$....\.....	pending	755692304
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	755698864
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableAutodial	object name not found	755700839
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableAutodial	object name not found	755726134
Mutant created	Name: \BaseNamedObjects\Local\ZonesCounterMutex	object name exists	755742465
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\IETld Name: IETldDllVersionLow	success or wait	755755585
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\IETld Name: IETldDllVersionHigh	success or wait	755765697
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	755766187
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	755766606
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	755775114
Process information queried	PID: 760 Info Class: DefaultHardErrorMode	success or wait	755775537
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\IETld Name: IETldVersionLow	success or wait	755776580
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\IETld Name: IETldVersionHigh	success or wait	755777153
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\Security Name: DisableSecuritySettingsCheck	object name not found	755787973
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security Name: DisableSecuritySettingsCheck	object name not found	755788633
Section loaded	Path: \BaseNamedObjects\Local\UrlZonesSM_Administrator Access: query and write and read Type: commit Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name exists	755797528
Mutant created	Name: \BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex	object name exists	755798138
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	755798501
Mutant created	Name: \BaseNamedObjects\Local\ZonesCacheCounterMutex	object name exists	755820386
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Name: Flags	success or wait	755821055
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Name: Flags	success or wait	755822189
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: ProxyBypass Type: dword Data: 1 Old data:	success or wait	755826914
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: IntranetName Type: dword Data: 1 Old data:	success or wait	755827207
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: UNCAsIntranet Type: dword Data: 1 Old data:	success or wait	755827496
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: AutoDetect Type: dword Data: 1 Old data:	success or wait	755827782
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Name: Flags	success or wait	755837740
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Name: Flags	success or wait	755838850
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Name: Flags	success or wait	755849454
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN Name: rundll32.exe	object name not found	755851227
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN Name: *	object name not found	755860478
Mutant created	Name: \BaseNamedObjects\Local\ZoneAttributeCacheCounterMutex	object name exists	755860859
Mutant created	Name: \BaseNamedObjects\Local\ZonesLockedCacheCounterMutex	object name exists	755861287
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 Name: Flags	success or wait	755861860
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1 Name: Flags	success or wait	755870923
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: ProxyBypass Type: dword Data: 1 Old data:	success or wait	755871559
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: IntranetName Type: dword Data: 1 Old data:	success or wait	755871851
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: UNCAsIntranet Type: dword Data: 1 Old data:	success or wait	755872140
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: AutoDetect Type: dword Data: 1 Old data:	success or wait	755872427
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2 Name: Flags	success or wait	755884083
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Name: Flags	success or wait	755885265
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4 Name: Flags	success or wait	755895831
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: CreateUriCacheSize	object name not found	755901276
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: CreateUriCacheSize	object name not found	755901684
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnablePunycode	object name not found	755902174
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnablePunycode	success or wait	755902594
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\Security Name: DisableSecuritySettingsCheck	object name not found	755904091
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Security Name: DisableSecuritySettingsCheck	object name not found	755915206
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableAutodial	object name not found	755924184
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Name: DefaultConnectionSettings	success or wait	755925283
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Name: DefaultConnectionSettings	success or wait	755925744
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: ProxyEnable Type: dword Data: 0 Old data:	success or wait	755939488
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Keyname: ProxyServer	object name not found	755948682
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Keyname: ProxyOverride	object name not found	755948946
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Keyname: AutoConfigURL	object name not found	755949191
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Name: SavedLegacySettings	success or wait	755958623
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Name: SavedLegacySettings	success or wait	755959009
Key value replaced with new	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Name: SavedLegacySettings Type: binary Data: 46 00 00 00 9D 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 10 C5 45 3D 26 AB CA 01 01 00 00 00 0A 00 02 0F 00 00 00 00 00 00 00 00 00 00 00 00 Old data: 46 00 00 00 9C 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 10 C5 45 3D 26 AB CA 01 01 00 00 00 0A 00 02 0F 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	755960363
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap Name: AutoDetect	success or wait	755971415
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3 Name: 1A10	success or wait	755972375
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableAutodial	object name not found	756021173
File opened	Path: \Device\RasAcd Access: read data or list directory and write data or add file Options: no options Attributes: normal Content Overwritten: true	success or wait	756088056
Section loaded	Path: \KnownDlls\hnetcfg.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	756097657
File opened	Path: C:\WINDOWS\system32\hnetcfg.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756098264
Section loaded	Path: C:\WINDOWS\system32\hnetcfg.dll Access: query and write and read and execute Type: image Baseaddress: 662B0000 Size: 360448 Protection: read write Mapped to pid: own pid	success or wait	756099283
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\SecurityService Name: DefaultAuthLevel	object name not found	756150139
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock\Parameters Name: Transports	success or wait	756152278
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Winsock\Parameters Name: Transports	success or wait	756152767
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock Name: Mapping	buffer overflow	756153750
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock Name: Mapping	buffer overflow	756168162
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock Name: Mapping	success or wait	756168655
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock Name: MinSockaddrLength	success or wait	756169582
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock Name: MaxSockaddrLength	success or wait	756170069
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock Name: UseDelayedAcceptance	success or wait	756170620
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Winsock Name: HelperDllName	success or wait	756174259
File opened	Path: C:\WINDOWS\System32\wshtcpip.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756175018
Section loaded	Path: C:\WINDOWS\system32\wshtcpip.dll Access: write and read and execute Type: commit Baseaddress: CE0000 Size: 20480 Protection: execute Mapped to pid: own pid	success or wait	756175948
File opened	Path: C:\WINDOWS\System32\wshtcpip.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756188773
Section loaded	Path: C:\WINDOWS\system32\wshtcpip.dll Access: query and write and read and execute Type: image Baseaddress: 71A90000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	756189764
File opened	Path: \Device\Afd\Endpoint Access: synchronize and generic read and generic write Options: no options Attributes: none Content Overwritten: true	success or wait	756207713
Thread created	PID: 760 TID: 812 EIP: 7C8106F9 EAX: 71A5D2C6 Imagepath: C:\WINDOWS\system32\rundll32.exe	success or wait	756231509
Thread resumed	TID: 812 PID: 760 Path: C:\WINDOWS\system32\rundll32.exe	success or wait	756237016
File opened	Path: \Device\Afd\AsyncConnectHlp Access: synchronize and generic read and generic write Options: no options Attributes: none Content Overwritten: true	success or wait	756237635
File other op	Path: \AsyncConnectHlp New path: Disposition: CompletionInformation Data : unknown	success or wait	756238157
System time queried	Time: 129876420449687500	success or wait	758025893
System time queried	Time: 129876420449687500	success or wait	758026147
File opened	Path: \Device\RasAcd Access: read data or list directory and write data or add file Options: no options Attributes: normal Content Overwritten: true	success or wait	820397312
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: User Agent	success or wait	820401265
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: User Agent	success or wait	820401599
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableAutodial	object name not found	820402380
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	820402893
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableAutodial	object name not found	820404767
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableAutodial	object name not found	820405565
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Internet Settings Name: EnableAutodial	object name not found	820406877
File opened	Path: \Device\Afd\Endpoint Access: synchronize and generic read and generic write Options: no options Attributes: none Content Overwritten: true	success or wait	820407467
System time queried	Time: 129876420628906250	success or wait	822180351
System time queried	Time: 129876420628906250	success or wait	822180640
Thread delayed	Time: -10800 TID: 1524	unknown	849042617
Message posted	TID: 7DC Message: C08C WParam: 0 LParam: 1120	success	898858662
Thread terminated	TID: 1120 PID: 760 Path: C:\WINDOWS\system32\rundll32.exe	unknown	898859857

Analysis File: cmd.exe PID: 868 Parent PID: 1112

General

Start time:	15:20:41
Start date:	24/07/2012
Path:	C:\WINDOWS\system32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\WINDOWS\system32\cmd.exe /c del C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp > nul
Imagebase:	0x4ad00000
File size:	389120 bytes
MD5 hash:	6D778E0F95447E6546553EEEA709D03C

File Activites

File Opened

File Path	Access	Options	Content overwritten	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\ShimEng.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\AppPatch\AcGenral.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	3	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\WINMM.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\MSACM32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\UxTheme.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\IMM32.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	3	7C90E457	KiUserApcDispatcher
\Device\KsecDD	read data or list directory and synchronize	synchronous io alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\SHELL32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Manifest	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\comctl32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	4AD043B0	FindFirstFileW
C:\DOCUME~1\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	4AD043B0	FindFirstFileW
C:\DOCUME~1\ADMINI~1\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	4AD043B0	FindFirstFileW
C:\DOCUME~1\ADMINI~1\LOCALS~1\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	4AD01B4B	FindFirstFileW
C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	read attributes and delete	non directory file and open for backup ident and open reparse point	false	success or wait	1	4AD17D07	DeleteFileW
C:\WINDOWS\AppPatch\sysmain.sdb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\AppPatch\systest.sdb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	object name not found	1	7C90E457	KiUserApcDispatcher
\Device\NamedPipe\ShimViewer	write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize	no options	true	object name not found	3	7C90E457	KiUserApcDispatcher
C:\WINDOWS\AppPatch\AcGenral.DLL	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\WindowsShell.Manifest	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	7C90E457	KiUserApcDispatcher
nul	read attributes and synchronize and generic write	synchronous io non alert and non directory file	true	success or wait	1	4AD02F12	CreateFileW

File Deleted

File Path	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp	success or wait	1	4AD17D07	DeleteFileW

File Path	Disposition	Data	Ascii Data	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1	90028	NU LL		success or wait	1	7C90E457	KiUserApcDispatcher

Section Activites

Section loaded by Windows

File Path	Access	Type	Base	Size	Mapped to pid	Protection	Completion	Count
\KnownDlls\kernel32.dll	write and read and execute	unknown	7C800000	1007616	own pid	read write	success or wait	1
unknown	query and write and read and execute and extend size	reserve	7C800000	1007616	own pid	read write	success or wait	1
\NLS\NlsSectionUnicode	read	unknown	270000	90112	own pid	readonly	success or wait	1
\NLS\NlsSectionLocale	read	unknown	290000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey	query and read	unknown	2E0000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortTbls	read	unknown	330000	24576	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\KnownDlls\msvcrt.dll	write and read and execute	unknown	77C10000	360448	own pid	read write	success or wait	1
\KnownDlls\USER32.dll	write and read and execute	unknown	7E410000	593920	own pid	read write	success or wait	1
\KnownDlls\GDI32.dll	write and read and execute	unknown	77F10000	299008	own pid	read write	success or wait	1
\KnownDlls\ShimEng.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\shimeng.dll	query and write and read and execute	image	5CB70000	155648	own pid	read write	success or wait	1
C:\WINDOWS\AppPatch\sysmain.sdb	read	commit	340000	1208320	own pid	readonly	success or wait	1
C:\WINDOWS\AppPatch\acgenral.dll	write and read and execute	commit	480000	1855488	own pid	execute	success or wait	1
C:\WINDOWS\AppPatch\acgenral.dll	write and read and execute	commit	480000	1855488	own pid	execute	success or wait	1
C:\WINDOWS\AppPatch\acgenral.dll	query and write and read and execute	image	6F880000	1875968	own pid	read write	success or wait	1
\KnownDlls\ADVAPI32.dll	write and read and execute	unknown	77DD0000	634880	own pid	read write	success or wait	1
\KnownDlls\RPCRT4.dll	write and read and execute	unknown	77E70000	602112	own pid	read write	success or wait	1
\KnownDlls\Secur32.dll	write and read and execute	unknown	77FE0000	69632	own pid	read write	success or wait	1
\KnownDlls\WINMM.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\winmm.dll	query and write and read and execute	image	76B40000	184320	own pid	read write	success or wait	1
\KnownDlls\ole32.dll	write and read and execute	unknown	774E0000	1302528	own pid	read write	success or wait	1
\KnownDlls\OLEAUT32.dll	write and read and execute	unknown	77120000	569344	own pid	read write	success or wait	1
\KnownDlls\MSACM32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msacm32.dll	query and write and read and execute	image	77BE0000	86016	own pid	read write	success or wait	1
\KnownDlls\VERSION.dll	write and read and execute	unknown	77C00000	32768	own pid	read write	success or wait	1
\KnownDlls\SHELL32.dll	write and read and execute	unknown	7C9C0000	8482816	own pid	read write	success or wait	1
\KnownDlls\SHLWAPI.dll	write and read and execute	unknown	77F60000	483328	own pid	read write	success or wait	1
\KnownDlls\USERENV.dll	write and read and execute	unknown	769C0000	737280	own pid	read write	success or wait	1
\KnownDlls\UxTheme.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\uxtheme.dll	query and write and read and execute	image	5AD70000	229376	own pid	read write	success or wait	1
\NLS\NlsSectionCType	read	unknown	490000	12288	own pid	readonly	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	410000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	410000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	query and write and read and execute	image	76390000	118784	own pid	read write	success or wait	1
C:\WINDOWS\system32\shell32.dll	read	commit	970000	8462336	own pid	readonly	success or wait	1
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	write and read and execute	commit	970000	1056768	own pid	execute	success or wait	1
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	query and write and read and execute	image	773D0000	1060864	own pid	read write	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	write and read and execute	commit	440000	4096	own pid	execute	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	query and read	commit	440000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\WindowsShell.Manifest	read	commit	440000	4096	own pid	readonly	success or wait	1
\KnownDlls\comctl32.dll	write and read and execute	unknown	5D090000	630784	own pid	read write	success or wait	1
C:\WINDOWS\system32\comctl32.dll	read	commit	970000	618496	own pid	readonly	success or wait	1

Registry Activites

Key Value Queried

Key Path	Name	Completion	Count	Source Address	Symbol
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CWDIllegalInDLLSearch	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server	TSAppCompat	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter	Installed	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	SafeDllSearchMode	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize	DisableMetaFiles	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows	AppInit_DLLs	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	LeakTrack	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	wave9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	midi9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	aux9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaProperties\PrivateProperties\Joystick\Winmm	wheel	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer2	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer3	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer4	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer5	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer6	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer7	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer8	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	mixer9	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CriticalSectionTimeout	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	RWLockResourceTimeOut	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAllForOle32	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableTypeLib	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAllForOle32	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Multimedia\Audio	SystemFormats	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.imaadpcm	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.imaadpcm	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msadpcm	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msadpcm	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg711	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg711	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msgsm610	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msgsm610	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.trspch	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.trspch	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg723	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msg723	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msaudio1	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.msaudio1	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.sl_anet	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.sl_anet	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.iac2	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.iac2	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.l3acm	buffer overflow	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32	msacm.l3acm	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	fdwSupport	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	cFormatTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	aFormatTagCache	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm	cFilterTags	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM	NoPCMConverter	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00	Priority1	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	EnableBalloonTips	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	ChkAccDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions	ProductType	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Personal	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Local Settings	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	RsopDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	RsopLogging	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	RsopLogging	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	UserEnvDebugLevel	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\ThemeManager	Compositing	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_USERS\Control Panel\Desktop	LameButtonText	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	DisableUNCCheck	object name not found	1	4AD04A2A	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	EnableExtensions	success or wait	1	4AD04A4F	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	DelayedExpansion	object name not found	1	4AD04A88	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	DefaultColor	success or wait	1	4AD04AAD	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	CompletionChar	success or wait	1	4AD04AE5	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	PathCompletionChar	success or wait	1	4AD04B37	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor	AutoRun	success or wait	1	4AD04BB8	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	DisableUNCCheck	object name not found	1	4AD04A2A	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	EnableExtensions	success or wait	1	4AD04A4F	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	DelayedExpansion	object name not found	1	4AD04A88	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	DefaultColor	success or wait	1	4AD04AAD	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	CompletionChar	success or wait	1	4AD04AE5	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	PathCompletionChar	object name not found	1	4AD04B37	RegQueryValueExW
HKEY_USERS\Software\Microsoft\Command Processor	AutoRun	object name not found	1	4AD04BB8	RegQueryValueExW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	00000409	success or wait	1	4AD056A7	setlocale
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups	1	success or wait	1	4AD056A7	setlocale
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize	DisableMetaFiles	object name not found	1	4AD04100	exit

Mutex Activites

Name	Completion	Count	Source Address	Symbol
\BaseNamedObjects\SHIMLIB_LOG_MUTEX	object name exists	1	7C90E457	KiUserApcDispatcher

Process Activites

PID	Process info class	Completion	Count	Source Address	Symbol
868	Cookie	success or wait	9	7C90E457	KiUserApcDispatcher
868	Wow64Information	success or wait	2	7C90E457	KiUserApcDispatcher
868	ImageInformation	success or wait	1	7C90E457	KiUserApcDispatcher
868	SessionInformation	success or wait	1	7C90E457	KiUserApcDispatcher
868	DefaultHardErrorMode	success or wait	3	4AD01AF9	SetErrorMode

PID	Filepath	Completion	Count	Source Address	Symbol
868	C:\WINDOWS\system32\cmd.exe	success or wait	1	4AD04100	exit

Memory Activites

Memory Allocated

PID	Filepath	Base	Length	Protection	Completion	Count	Source Address	Symbol
868	C:\WINDOWS\system32\cmd.exe	150000	13FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	150000	13FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	151000	13F7F4	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	250000	13FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	250000	13FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	260000	13F340	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	261000	13F168	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	153000	13F420	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	470000	13F0C8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	470000	13F0CC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	472000	13EB64	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	473000	13EEA8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	480000	13E978	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	480000	13E97C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	481000	13E658	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	483000	13E6FC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	4A0000	13F04C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	4A0000	13F050	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	4A1000	13ED2C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	30000	13F91C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	30000	13F920	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	31000	13F5FC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	33000	13F6B8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	154000	13F02C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	155000	13F694	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	8F0000	13F52C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	8F0000	13F528	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	156000	13F5C0	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	157000	13F170	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	158000	13F188	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	159000	13EFB0	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	440000	13F1B8	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	440000	13F1BC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	441000	13EE98	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	443000	13EF3C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	970000	13FE10	page read and write	success or wait	1	4AD04578	VirtualAlloc
868	C:\WINDOWS\system32\cmd.exe	34000	13F7D0	page read and write	success or wait	1	4AD056A7	setlocale
868	C:\WINDOWS\system32\cmd.exe	15A000	13EEB4	page read and write	success or wait	1	7C817077	unknown
868	C:\WINDOWS\system32\cmd.exe	15B000	13F1B0	page read and write	success or wait	1	7C817077	unknown

PID	Filepath	Base	Length	New Protection	Old Protection	Completion	Count	Source Address	Symbol
868	C:\WINDOWS\system32\cmd.exe	7C801000	1000	page read and write	page execute read	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	7C801000	1000	page execute read	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	4AD01000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	4AD01000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77C11000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77C11000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77F11000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77F11000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	7E411000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	7E411000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	5CB71000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	5CB71000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	6F881000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	6F881000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77DD1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77DD1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77E71000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77E71000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77FE1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77FE1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	76B41000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	76B41000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	774E1000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	774E1000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77121000	1000	page read and write	page execute read	success or wait	6	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77121000	1000	page execute read	page read and write	success or wait	6	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77BE1000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77BE1000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77C01000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77C01000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	7C9C1000	2000	page read and write	page execute read	success or wait	8	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	7C9C1000	2000	page execute read	page read and write	success or wait	8	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77F61000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	77F61000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	769C1000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	769C1000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	5AD71000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	5AD71000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	76391000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	76391000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	773D1000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	773D1000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	5D091000	1000	page read and write	page execute read	success or wait	5	7C90E457	KiUserApcDispatcher
868	C:\WINDOWS\system32\cmd.exe	5D091000	1000	page execute read	page read and write	success or wait	5	7C90E457	KiUserApcDispatcher

Memory Usage Statistics

Time	Private Usage (mb)	Workingset (mb)	Page File Usage (mb)
15:20:42	1	1	1
15:20:44	1	2	1

System Activites

System info class	Completion	Count	Source Address	Symbol
BasicInformation	success or wait	15	7C90E457	KiUserApcDispatcher
RangeStartInformation	success or wait	1	7C90E457	KiUserApcDispatcher
ProcessorInformation	success or wait	5	7C90E457	KiUserApcDispatcher

Chronological Activities

Operation	Data	Completion	Time
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CWDIllegalInDLLSearch	object name not found	756364200
System info queried	Type: BasicInformation	success or wait	756366303
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 150000 Length: 13FB14 Allocation Type: unknown Protection: page read and write	success or wait	756366567
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 150000 Length: 13FB18 Allocation Type: unknown Protection: page read and write	success or wait	756366773
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 151000 Length: 13F7F4 Allocation Type: unknown Protection: page read and write	success or wait	756367195
System info queried	Type: BasicInformation	success or wait	756367443
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 250000 Length: 13FB14 Allocation Type: unknown Protection: page read and write	success or wait	756367642
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 250000 Length: 13FB18 Allocation Type: unknown Protection: page read and write	success or wait	756367837
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	756368647
File control set	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1 Control Code: 90028 Input Buffer:	success or wait	756369534
Section loaded	Path: \KnownDlls\kernel32.dll Access: write and read and execute Type: unknown Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	756370549
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C801000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756371456
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C801000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756372669
Process information queried	PID: 868 Info Class: Cookie	success or wait	756373685
System info queried	Type: RangeStartInformation	success or wait	756373931
System info queried	Type: BasicInformation	success or wait	756374111
Section loaded	Path: unknown Access: query and write and read and execute and extend size Type: reserve Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	756374356
System info queried	Type: BasicInformation	success or wait	756375279
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 260000 Length: 13F340 Allocation Type: unknown Protection: page read and write	success or wait	756375739
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	756376820
Section loaded	Path: \NLS\NlsSectionUnicode Access: read Type: unknown Baseaddress: 270000 Size: 90112 Protection: readonly Mapped to pid: own pid	success or wait	756377790
Section loaded	Path: \NLS\NlsSectionLocale Access: read Type: unknown Baseaddress: 290000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	756378879
Section loaded	Path: \NLS\NlsSectionSortkey Access: query and read Type: unknown Baseaddress: 2E0000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	756379643
Section loaded	Path: \NLS\NlsSectionSortTbls Access: read Type: unknown Baseaddress: 330000 Size: 24576 Protection: readonly Mapped to pid: own pid	success or wait	756380379
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	756381614
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	756381854
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 261000 Length: 13F168 Allocation Type: unknown Protection: page read and write	success or wait	756382072
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 4AD01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756393059
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 4AD01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756394432
Section loaded	Path: \KnownDlls\msvcrt.dll Access: write and read and execute Type: unknown Baseaddress: 77C10000 Size: 360448 Protection: read write Mapped to pid: own pid	success or wait	756394712
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756395716
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756396161
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756396409
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756396650
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 4AD01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756396880
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 4AD01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756397382
Section loaded	Path: \KnownDlls\USER32.dll Access: write and read and execute Type: unknown Baseaddress: 7E410000 Size: 593920 Protection: read write Mapped to pid: own pid	success or wait	756397650
Section loaded	Path: \KnownDlls\GDI32.dll Access: write and read and execute Type: unknown Baseaddress: 77F10000 Size: 299008 Protection: read write Mapped to pid: own pid	success or wait	756398515
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756399489
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756399914
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756400173
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756400435
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756400690
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756401325
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756401631
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756402371
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756402602
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756403212
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756403494
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756403847
Section loaded	Path: \KnownDlls\ShimEng.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	756404283
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 153000 Length: 13F420 Allocation Type: unknown Protection: page read and write	success or wait	756404493
File opened	Path: C:\WINDOWS\system32\ShimEng.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756404977
Section loaded	Path: C:\WINDOWS\system32\shimeng.dll Access: query and write and read and execute Type: image Baseaddress: 5CB70000 Size: 155648 Protection: read write Mapped to pid: own pid	success or wait	756405726
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: TransparentEnabled	success or wait	756406213
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5CB71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756408022
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5CB71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756408969
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5CB71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756409212
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5CB71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756409451
File opened	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	756410546
Section loaded	Path: C:\WINDOWS\AppPatch\sysmain.sdb Access: read Type: commit Baseaddress: 340000 Size: 1208320 Protection: readonly Mapped to pid: own pid	success or wait	756411321
File opened	Path: C:\WINDOWS\AppPatch\systest.sdb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	object name not found	756412049
System info queried	Type: ProcessorInformation	success or wait	756412688
Process information queried	PID: 868 Info Class: Wow64Information	success or wait	756412878
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\MediaCenter Name: Installed	success or wait	756413193
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	756413782
Process information queried	PID: 868 Info Class: Wow64Information	success or wait	756414339
System info queried	Type: BasicInformation	success or wait	756414521
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 470000 Length: 13F0C8 Allocation Type: unknown Protection: page read and write	success or wait	756414730
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 470000 Length: 13F0CC Allocation Type: unknown Protection: page read and write	success or wait	756414941
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	756415508
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 472000 Length: 13EB64 Allocation Type: unknown Protection: page read and write	success or wait	756416152
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 473000 Length: 13EEA8 Allocation Type: unknown Protection: page read and write	success or wait	756417559
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	756418119
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756419408
Section loaded	Path: C:\WINDOWS\AppPatch\acgenral.dll Access: write and read and execute Type: commit Baseaddress: 480000 Size: 1855488 Protection: execute Mapped to pid: own pid	success or wait	756420146
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756421592
Section loaded	Path: C:\WINDOWS\AppPatch\acgenral.dll Access: write and read and execute Type: commit Baseaddress: 480000 Size: 1855488 Protection: execute Mapped to pid: own pid	success or wait	756422331
File opened	Path: C:\WINDOWS\AppPatch\AcGenral.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756423774
Section loaded	Path: C:\WINDOWS\AppPatch\acgenral.dll Access: query and write and read and execute Type: image Baseaddress: 6F880000 Size: 1875968 Protection: read write Mapped to pid: own pid	success or wait	756424520
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756425990
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756426386
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756426703
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756427013
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756427265
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756427509
Section loaded	Path: \KnownDlls\ADVAPI32.dll Access: write and read and execute Type: unknown Baseaddress: 77DD0000 Size: 634880 Protection: read write Mapped to pid: own pid	success or wait	756427795
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756428764
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756429213
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756429473
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756429930
Section loaded	Path: \KnownDlls\RPCRT4.dll Access: write and read and execute Type: unknown Baseaddress: 77E70000 Size: 602112 Protection: read write Mapped to pid: own pid	success or wait	756430223
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756431221
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756431905
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756432182
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756432553
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756432824
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756433116
Section loaded	Path: \KnownDlls\Secur32.dll Access: write and read and execute Type: unknown Baseaddress: 77FE0000 Size: 69632 Protection: read write Mapped to pid: own pid	success or wait	756433427
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756434468
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756434844
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756435134
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756435433
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756435721
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756436088
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756436360
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756436629
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756436884
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756437444
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756437689
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756437941
Section loaded	Path: \KnownDlls\WINMM.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	756438224
File opened	Path: C:\WINDOWS\system32\WINMM.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756438639
Section loaded	Path: C:\WINDOWS\system32\winmm.dll Access: query and write and read and execute Type: image Baseaddress: 76B40000 Size: 184320 Protection: read write Mapped to pid: own pid	success or wait	756439391
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756440795
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756441266
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756441528
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756441785
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756442046
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756442356
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756442615
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756442899
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756443158
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76B41000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756443413
Section loaded	Path: \KnownDlls\ole32.dll Access: write and read and execute Type: unknown Baseaddress: 774E0000 Size: 1302528 Protection: read write Mapped to pid: own pid	success or wait	756443699
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756444732
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756445147
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756445405
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756445676
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756445936
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756446315
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756446572
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756446835
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756447095
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756447361
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756447620
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756447982
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756448239
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756448627
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756448870
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756449301
Section loaded	Path: \KnownDlls\OLEAUT32.dll Access: write and read and execute Type: unknown Baseaddress: 77120000 Size: 569344 Protection: read write Mapped to pid: own pid	success or wait	756449581
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756450507
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756450973
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756451773
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756452043
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756452303
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756452670
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756452931
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756453198
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756453457
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756453726
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756453984
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756454238
Section loaded	Path: \KnownDlls\MSACM32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	756454523
File opened	Path: C:\WINDOWS\system32\MSACM32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756454940
Section loaded	Path: C:\WINDOWS\system32\msacm32.dll Access: query and write and read and execute Type: image Baseaddress: 77BE0000 Size: 86016 Protection: read write Mapped to pid: own pid	success or wait	756455699
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756457100
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756457507
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756457767
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756458022
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756458284
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756458533
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756480887
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756481151
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756481415
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77BE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756481673
Section loaded	Path: \KnownDlls\VERSION.dll Access: write and read and execute Type: unknown Baseaddress: 77C00000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	756481965
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756482864
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756483290
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756483557
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756483824
Section loaded	Path: \KnownDlls\SHELL32.dll Access: write and read and execute Type: unknown Baseaddress: 7C9C0000 Size: 8482816 Protection: read write Mapped to pid: own pid	success or wait	756484111
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	756485201
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	756485682
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	756485946
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	756486225
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	756486484
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	756486881
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	756487140
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	756487401
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	756487660
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	756487925
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	756488184
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	756488441
Section loaded	Path: \KnownDlls\SHLWAPI.dll Access: write and read and execute Type: unknown Baseaddress: 77F60000 Size: 483328 Protection: read write Mapped to pid: own pid	success or wait	756488738
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756489718
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756490135
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756490408
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756490692
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756490965
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756491360
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756491632
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756491903
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756492176
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756492562
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	756492816
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	756493399
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	756493657
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	756494709
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756494971
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756495401
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756495649
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 6F881000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756495891
Section loaded	Path: \KnownDlls\USERENV.dll Access: write and read and execute Type: unknown Baseaddress: 769C0000 Size: 737280 Protection: read write Mapped to pid: own pid	success or wait	756496173
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756497163
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756497660
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756497924
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756498230
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756498488
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756498747
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756499008
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756499350
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756499609
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 769C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756499868
Section loaded	Path: \KnownDlls\UxTheme.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	756500154
File opened	Path: C:\WINDOWS\system32\UxTheme.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756500572
Section loaded	Path: C:\WINDOWS\system32\uxtheme.dll Access: query and write and read and execute Type: image Baseaddress: 5AD70000 Size: 229376 Protection: read write Mapped to pid: own pid	success or wait	756501337
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756502802
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756503204
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756503466
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756503800
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756504062
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756504357
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756504617
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756504874
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756505133
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756505390
System info queried	Type: BasicInformation	success or wait	756506453
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 480000 Length: 13E978 Allocation Type: unknown Protection: page read and write	success or wait	756506691
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 480000 Length: 13E97C Allocation Type: unknown Protection: page read and write	success or wait	756506921
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 481000 Length: 13E658 Allocation Type: unknown Protection: page read and write	success or wait	756507219
Section loaded	Path: \NLS\NlsSectionCType Access: read Type: unknown Baseaddress: 490000 Size: 12288 Protection: readonly Mapped to pid: own pid	success or wait	756508776
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 483000 Length: 13E6FC Allocation Type: unknown Protection: page read and write	success or wait	756510071
Process information queried	PID: 868 Info Class: Cookie	success or wait	756510624
Process information queried	PID: 868 Info Class: Cookie	success or wait	756510844
Mutant created	Name: \BaseNamedObjects\SHIMLIB_LOG_MUTEX	object name exists	756511251
File opened	Path: \Device\NamedPipe\ShimViewer Access: write data or add file and append data or add subdirectory or create pipe instance and write ea and write attributes and read control and synchronize Options: no options Attributes: normal Content Overwritten: true	object name not found	756512511
System info queried	Type: BasicInformation	success or wait	756513037
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 4A0000 Length: 13F04C Allocation Type: unknown Protection: page read and write	success or wait	756513269
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 4A0000 Length: 13F050 Allocation Type: unknown Protection: page read and write	success or wait	756513493
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 4A1000 Length: 13ED2C Allocation Type: unknown Protection: page read and write	success or wait	756513788
System info queried	Type: BasicInformation	success or wait	756514416
System info queried	Type: ProcessorInformation	success or wait	756515051
Process information queried	PID: 868 Info Class: ImageInformation	success or wait	756516126
System info queried	Type: BasicInformation	success or wait	756519735
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 30000 Length: 13F91C Allocation Type: unknown Protection: page read and write	success or wait	756519949
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 30000 Length: 13F920 Allocation Type: unknown Protection: page read and write	success or wait	756520159
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 31000 Length: 13F5FC Allocation Type: unknown Protection: page read and write	success or wait	756520436
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 33000 Length: 13F6B8 Allocation Type: unknown Protection: page read and write	success or wait	756522314
Process information queried	PID: 868 Info Class: Cookie	success or wait	756523403
Process information queried	PID: 868 Info Class: Cookie	success or wait	756523591
System info queried	Type: BasicInformation	success or wait	756523964
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: SafeDllSearchMode	object name not found	756524998
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756525704
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 410000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	756526461
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756528005
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 410000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	756528746
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756530189
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: query and write and read and execute Type: image Baseaddress: 76390000 Size: 118784 Protection: read write Mapped to pid: own pid	success or wait	756530927
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756532348
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756532749
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756533009
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756533331
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756533590
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756533875
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756534130
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756534394
System info queried	Type: BasicInformation	success or wait	756534943
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize Name: DisableMetaFiles	object name not found	756535857
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 154000 Length: 13F02C Allocation Type: unknown Protection: page read and write	success or wait	756538620
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Name: AppInit_DLLs	success or wait	756539737
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: LeakTrack	object name not found	756540840
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 155000 Length: 13F694 Allocation Type: unknown Protection: page read and write	success or wait	756541832
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave	success or wait	756542316
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 8F0000 Length: 13F52C Allocation Type: unknown Protection: page read and write	success or wait	756542866
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 8F0000 Length: 13F528 Allocation Type: unknown Protection: page read and write	success or wait	756543103
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave	success or wait	756543482
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave1	success or wait	756544115
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave1	success or wait	756544687
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave2	object name not found	756545240
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave3	object name not found	756545787
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave4	object name not found	756546330
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave5	object name not found	756546918
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave6	object name not found	756547468
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave7	object name not found	756548016
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave8	object name not found	756548564
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: wave9	object name not found	756549109
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi	success or wait	756549655
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi	success or wait	756550218
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi1	success or wait	756550767
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi1	success or wait	756551327
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi2	object name not found	756551940
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi3	object name not found	756552534
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi4	object name not found	756553127
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi5	object name not found	756553713
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi6	object name not found	756554305
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi7	object name not found	756554900
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi8	object name not found	756555488
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: midi9	object name not found	756556077
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux	success or wait	756556669
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux	success or wait	756557268
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux1	success or wait	756557860
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux1	success or wait	756558464
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux2	object name not found	756559057
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux3	object name not found	756559641
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux4	object name not found	756560229
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux5	object name not found	756560819
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux6	object name not found	756561408
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux7	object name not found	756561996
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux8	object name not found	756562585
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: aux9	object name not found	756563188
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\MediaProperties\PrivateProperties\Joystick\Winmm Name: wheel	success or wait	756563893
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer	success or wait	756564420
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer	success or wait	756564983
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer1	success or wait	756565529
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer1	success or wait	756566122
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer2	object name not found	756566673
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer3	object name not found	756567270
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer4	object name not found	756567867
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer5	object name not found	756568521
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer6	object name not found	756569069
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer7	object name not found	756569615
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer8	object name not found	756570213
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: mixer9	object name not found	756573929
File opened	Path: \Device\KsecDD Access: read data or list directory and synchronize Options: synchronous io alert Overwritten: false	success or wait	756574812
System info queried	Type: BasicInformation	success or wait	756577833
System info queried	Type: ProcessorInformation	success or wait	756578036
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CriticalSectionTimeout	success or wait	756578420
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: RWLockResourceTimeOut	object name not found	756579003
System info queried	Type: BasicInformation	success or wait	756579510
System info queried	Type: ProcessorInformation	success or wait	756579718
System info queried	Type: BasicInformation	success or wait	756579912
System info queried	Type: ProcessorInformation	success or wait	756580119
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAll	object name not found	756580416
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAllForOle32	object name not found	756580633
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableTypeLib	object name not found	756580850
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAll	object name not found	756581320
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAllForOle32	object name not found	756581536
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 156000 Length: 13F5C0 Allocation Type: unknown Protection: page read and write	success or wait	756581949
Key value queried	Path: HKEY_USERS\Software\Microsoft\Multimedia\Audio Name: SystemFormats	success or wait	756583852
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.imaadpcm	buffer overflow	756585404
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 157000 Length: 13F170 Allocation Type: unknown Protection: page read and write	success or wait	756585641
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.imaadpcm	success or wait	756585936
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: fdwSupport	success or wait	756586521
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: cFormatTags	success or wait	756586859
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: aFormatTagCache	success or wait	756587197
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.imaadpcm Name: cFilterTags	success or wait	756587532
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msadpcm	buffer overflow	756588275
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msadpcm	success or wait	756588508
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: fdwSupport	success or wait	756589093
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: cFormatTags	success or wait	756589433
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: aFormatTagCache	success or wait	756589771
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msadpcm Name: cFilterTags	success or wait	756590106
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg711	buffer overflow	756590851
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg711	success or wait	756591089
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: fdwSupport	success or wait	756591648
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: cFormatTags	success or wait	756591984
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: aFormatTagCache	success or wait	756592323
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg711 Name: cFilterTags	success or wait	756592656
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msgsm610	buffer overflow	756593400
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msgsm610	success or wait	756593639
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: fdwSupport	success or wait	756594199
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: cFormatTags	success or wait	756594536
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: aFormatTagCache	success or wait	756594873
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msgsm610 Name: cFilterTags	success or wait	756595207
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.trspch	buffer overflow	756595953
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.trspch	success or wait	756596188
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: fdwSupport	success or wait	756596750
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: cFormatTags	success or wait	756597084
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: aFormatTagCache	success or wait	756597453
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.trspch Name: cFilterTags	success or wait	756597787
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg723	buffer overflow	756598530
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msg723	success or wait	756598770
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: fdwSupport	success or wait	756599332
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: cFormatTags	success or wait	756599669
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: aFormatTagCache	success or wait	756600007
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msg723 Name: cFilterTags	success or wait	756600343
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msaudio1	buffer overflow	756601084
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.msaudio1	success or wait	756601325
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: fdwSupport	success or wait	756601892
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: cFormatTags	success or wait	756602231
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: aFormatTagCache	success or wait	756602568
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.msaudio1 Name: cFilterTags	success or wait	756602900
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.sl_anet	buffer overflow	756603638
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.sl_anet	success or wait	756603880
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: fdwSupport	success or wait	756604446
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: cFormatTags	success or wait	756604783
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: aFormatTagCache	success or wait	756605122
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.sl_anet Name: cFilterTags	success or wait	756605456
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 158000 Length: 13F188 Allocation Type: unknown Protection: page read and write	success or wait	756606153
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.iac2	buffer overflow	756606566
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.iac2	success or wait	756606810
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: fdwSupport	success or wait	756607412
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: cFormatTags	success or wait	756607754
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: aFormatTagCache	success or wait	756608092
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.iac2 Name: cFilterTags	success or wait	756608430
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.l3acm	buffer overflow	756609172
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32 Name: msacm.l3acm	success or wait	756609411
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: fdwSupport	success or wait	756610000
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: cFormatTags	success or wait	756610339
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: aFormatTagCache	success or wait	756610676
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\AudioCompressionManager\DriverCache\msacm.l3acm Name: cFilterTags	success or wait	756611012
Key value queried	Path: HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\MSACM Name: NoPCMConverter	object name not found	756613243
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 159000 Length: 13EFB0 Allocation Type: unknown Protection: page read and write	success or wait	756613773
Key value queried	Path: HKEY_USERS\Software\Microsoft\Multimedia\Audio Compression Manager\Priority v4.00 Name: Priority1	object name not found	756615697
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	756617653
File opened	Path: C:\WINDOWS\system32\SHELL32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756619007
Section loaded	Path: C:\WINDOWS\system32\shell32.dll Access: read Type: commit Baseaddress: 970000 Size: 8462336 Protection: readonly Mapped to pid: own pid	success or wait	756619789
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	756620488
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	756621603
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	756663972
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756664972
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: write and read and execute Type: commit Baseaddress: 970000 Size: 1056768 Protection: execute Mapped to pid: own pid	success or wait	756665980
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756667387
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: query and write and read and execute Type: image Baseaddress: 773D0000 Size: 1060864 Protection: read write Mapped to pid: own pid	success or wait	756668942
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756670539
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756670889
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756671167
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756671434
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756671704
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756672041
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756672375
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756672668
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756672941
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756673259
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756673528
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756673795
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756674064
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756674394
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756676111
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: write and read and execute Type: commit Baseaddress: 440000 Size: 4096 Protection: execute Mapped to pid: own pid	success or wait	756676936
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	756678713
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: query and read Type: commit Baseaddress: 440000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	756679545
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756681044
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: read Type: commit Baseaddress: 440000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	756681847
File opened	Path: C:\WINDOWS\WindowsShell.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	756815595
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	756847353
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: EnableBalloonTips	object name not found	756848363
Section loaded	Path: \KnownDlls\comctl32.dll Access: write and read and execute Type: unknown Baseaddress: 5D090000 Size: 630784 Protection: read write Mapped to pid: own pid	success or wait	756863232
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756864255
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756864667
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756864937
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756865225
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756865489
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756865805
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756866069
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756866325
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	756866585
Memory attributes changed	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	756866960
System info queried	Type: BasicInformation	success or wait	756867852
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 440000 Length: 13F1B8 Allocation Type: unknown Protection: page read and write	success or wait	756868112
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 440000 Length: 13F1BC Allocation Type: unknown Protection: page read and write	success or wait	756868359
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 441000 Length: 13EE98 Allocation Type: unknown Protection: page read and write	success or wait	756868677
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 443000 Length: 13EF3C Allocation Type: unknown Protection: page read and write	success or wait	756869929
File opened	Path: C:\WINDOWS\system32\comctl32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756871170
Section loaded	Path: C:\WINDOWS\system32\comctl32.dll Access: read Type: commit Baseaddress: 970000 Size: 618496 Protection: readonly Mapped to pid: own pid	success or wait	756871995
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	756872772
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	756873775
Process information queried	PID: 868 Info Class: SessionInformation	success or wait	756879480
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	756880565
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	756883925
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: ChkAccDebugLevel	object name not found	756884545
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions Name: ProductType	success or wait	756885178
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Personal	success or wait	756886258
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Local Settings	success or wait	756886596
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: RsopDebugLevel	object name not found	756887389
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	756887986
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: RsopLogging	object name not found	756888317
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: UserEnvDebugLevel	object name not found	756888972
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: RsopLogging	object name not found	756889301
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	756889891
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: UserEnvDebugLevel	object name not found	756890489
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\ThemeManager Name: Compositing	object name not found	756891513
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: LameButtonText	object name not found	756892593
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: DisableUNCCheck	object name not found	756896931
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: EnableExtensions	success or wait	756897263
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: DelayedExpansion	object name not found	756897586
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: DefaultColor	success or wait	756897953
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: CompletionChar	success or wait	756898274
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: PathCompletionChar	success or wait	756898593
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Command Processor Name: AutoRun	success or wait	756898911
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: DisableUNCCheck	object name not found	756899483
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: EnableExtensions	success or wait	756899808
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: DelayedExpansion	object name not found	756900130
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: DefaultColor	success or wait	756900449
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: CompletionChar	success or wait	756900766
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: PathCompletionChar	object name not found	756901085
Key value queried	Path: HKEY_USERS\Software\Microsoft\Command Processor Name: AutoRun	object name not found	756901401
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756902491
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756903801
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756905034
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 970000 Length: 13FE10 Allocation Type: unknown Protection: page read and write	success or wait	756911898
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 00000409	success or wait	756913027
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	756913621
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 34000 Length: 13F7D0 Allocation Type: unknown Protection: page read and write	success or wait	756914313
File opened	Path: nul Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	756917204
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756918670
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 15A000 Length: 13EEB4 Allocation Type: unknown Protection: page read and write	success or wait	756920261
Process information queried	PID: 868 Info Class: DefaultHardErrorMode	success or wait	756920576
Process information queried	PID: 868 Info Class: DefaultHardErrorMode	success or wait	756920799
Process information queried	PID: 868 Info Class: DefaultHardErrorMode	success or wait	756921022
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756921600
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp Access: read attributes and delete Options: non directory file and open for backup ident and open reparse point Overwritten: false	success or wait	756922679
File deleted	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~WORDL.tmp New path: Disposition: Data :	success or wait	756923585
Memory allocated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe Base: 15B000 Length: 13F1B0 Allocation Type: unknown Protection: page read and write	success or wait	756926731
Process information queried	PID: 868 Info Class: Cookie	success or wait	756930758
Process information queried	PID: 868 Info Class: Cookie	success or wait	756930953
Process terminated	PID: 868 Path: C:\WINDOWS\system32\cmd.exe	success or wait	756931544
Process information queried	PID: 868 Info Class: Cookie	success or wait	756933469
Process information queried	PID: 868 Info Class: Cookie	success or wait	756933689
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize Name: DisableMetaFiles	object name not found	756937487

Analysis File: WINWORD.EXE PID: 900 Parent PID: 1096

General

Start time:	15:20:42
Start date:	24/07/2012
Path:	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE /n /dde
Imagebase:	0x30000000
File size:	12310368 bytes
MD5 hash:	443747857245BF90847AE396C53470A6

File Activites

File Path	Access	Options	Content overwritten	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE.2.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE.2.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	7C90E457	KiUserApcDispatcher
C:\WINDOWS\system32\IMM32.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	3	7C90E457	KiUserApcDispatcher
\Device\KsecDD	read data or list directory and synchronize	synchronous io alert	false	success or wait	1	7C90E457	KiUserApcDispatcher
C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30003071	LoadLibraryW
C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll.2.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	30003071	LoadLibraryW
C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll.2.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	30003071	LoadLibraryW
C:\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	35	8C2C95B	NlsAnsiCodePage
C:\Program Files\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	8C2C95B	NlsAnsiCodePage
C:\WINDOWS\system32\psapi.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	167F70	unknown
C:\Program Files\Microsoft Office\OFFICE11\1033\wwintl.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	FF909090	unknown
C:\WINDOWS\system32\uxtheme.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	1	unknown
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	4	30029E78	LoadLibraryW
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\Comctl32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30029E78	LoadLibraryW
C:\WINDOWS\WindowsShell.Manifest	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30029E78	LoadLibraryW
C:\WINDOWS\WindowsShell.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	30029E78	LoadLibraryW
C:\WINDOWS\system32\MSCTF.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30029D25	CreateWindowExW
C:\WINDOWS\system32\msctfime.ime	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	4	30029D25	CreateWindowExW
C:\Program Files\Common Files\Microsoft Shared\office11\1033\msointl.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6F0073	unknown
C:\WINDOWS\system32\rpcss.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	3002D684	CoInitialize
C:\Program Files\Microsoft Office\OFFICE11\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	104	3002F203	FindFirstFileW
C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	3002F203	FindFirstFileW
C:\WINDOWS\system32\SHELL32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	3163DD60	unknown
C:\WINDOWS\system32\SHELL32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	3163DD60	unknown
C:\WINDOWS\system32\SHELL32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	3163DD60	unknown
C:\WINDOWS\system32\comctl32.dll	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	success or wait	1	3163DD60	unknown
C:\WINDOWS\system32\comctl32.dll.124.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	3163DD60	unknown
C:\WINDOWS\system32\comctl32.dll.124.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	3163DD60	unknown
C:\Program Files\Common Files\Microsoft Shared\office11\riched20.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30CFCD75	unknown
C:\WINDOWS\system32\Msimtf.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	5	3002A1BB	DefWindowProcW
C:\WINDOWS\system32\CLBCATQ.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	12E854	unknown
C:\WINDOWS\system32\COMRes.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	12E854	unknown
C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Schemas\MS Word_restart.xml	read attributes and delete	non directory file and open for backup ident and open reparse point	false	object path not found	1	3163DD60	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Word\STARTUP\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	30068517	FindFirstFileW
C:\Program Files\Microsoft Office\OFFICE11\STARTUP\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	30068517	FindFirstFileW
C:\WINDOWS\system32\msi.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	30CBD13C	unknown
C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat	write attributes and synchronize	synchronous io non alert and open for backup ident and open reparse point	false	success or wait	1	310031	unknown
C:\WINDOWS\system32\SETUPAPI.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	FFFF	unknown
IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}	read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	2	FFFF	unknown
STORAGE#Volume#1&30a96598&0&SignatureF4ACF4ACOffset7E00Length3BFEFCE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}	read attributes and synchronize	synchronous io non alert and non directory file	false	success or wait	2	FFFF	unknown
C:\Documents and Settings\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	18	FFFF	unknown
C:\Documents and Settings\Administrator\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	11	FFFF	unknown
C:\Documents and Settings\Administrator\Local Settings\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	4	30CFC0DA	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	30CFC1EE	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\review.rcd	synchronize and generic read	synchronous io non alert and non directory file	false	object name not found	1	4D005C	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\adhoc.rcd	synchronize and generic read	synchronous io non alert and non directory file	false	object name not found	1	4D005C	unknown
C:\DOCUME~1\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	301A93C3	CreateFileMoniker
C:\DOCUME~1\ADMINI~1\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	301A93C3	CreateFileMoniker
C:\WINDOWS\system32\winlogon.exe	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6014A	unknown
C:\WINDOWS\system32\xpsp2res.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6014A	unknown
C:\WINDOWS\system32\MSIMG32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	30003601	LoadLibraryA
C:\Documents and Settings\Administrator\Application Data\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	9	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\iPhone 5.doc\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	object name not found	1	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\iPhone 5.doc.LNK	read attributes and delete	non directory file and open for backup ident and open reparse point	false	object name not found	1	6C0069	unknown
C:\WINDOWS\system32\LINKINFO.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6C0069	unknown
C:\WINDOWS\system32\ntshrui.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	6C0069	unknown
C:\WINDOWS\system32\ATL.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6C0069	unknown
C:\WINDOWS\system32\NETAPI32.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	6C0069	unknown
C:\WINDOWS\system32\ntshrui.dll.123.Manifest	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	6C0069	unknown
C:\WINDOWS\system32\ntshrui.dll.123.Config	read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize	synchronous io non alert and non directory file	false	object name not found	1	6C0069	unknown
C:\Documents and Settings\Administrator\Local Settings	read attributes and synchronize	synchronous io non alert and non directory file	false	file is a directory	1	6C0069	unknown
C:\Documents and Settings\Administrator\Local Settings	read attributes and synchronize	synchronous io non alert	false	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Start Menu\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	3	6C0069	unknown
C:\Documents and Settings\All Users\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	7	6C0069	unknown
C:\Documents and Settings\All Users\Start Menu\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	3	6C0069	unknown
C:\Documents and Settings\All Users\Application Data\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	3	6C0069	unknown
C:\WINDOWS\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	2	6C0069	unknown
C:\Documents and Settings\Administrator\My Documents\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	12	6C0069	unknown
C:\Documents and Settings\Administrator\My Documents\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\My Documents\My Pictures\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	6	6C0069	unknown
C:\Documents and Settings\All Users\Documents\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	12	6C0069	unknown
C:\Documents and Settings\All Users\Documents\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	3	6C0069	unknown
C:\Documents and Settings\All Users\Documents\My Pictures\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	3	6C0069	unknown
C:\Documents and Settings\All Users\Documents\My Music\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	3	6C0069	unknown
C:\Documents and Settings\All Users\Documents\My Videos\desktop.ini	synchronize and generic read	synchronous io non alert and non directory file	false	success or wait	3	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat	write attributes and synchronize	synchronous io non alert and open for backup ident and open reparse point	false	success or wait	4	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Local Settings\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	object name not found	1	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Local Settings.LNK	read attributes and delete	non directory file and open for backup ident and open reparse point	false	object name not found	1	6C0069	unknown
C:\Documents and Settings\Administrator	read attributes and synchronize	synchronous io non alert and non directory file	false	file is a directory	1	6C0069	unknown
C:\Documents and Settings\Administrator	read attributes and synchronize	synchronous io non alert	false	success or wait	1	6C0069	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	7	7D0041	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30D5D887	unknown
C:\WINDOWS\system32\WINSPOOL.DRV	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\OLEACC.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\MSVCP60.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\SXS.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\1033\stintl.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	30D5D887	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	52	3002F203	FindFirstFileW
C:\Program Files\Common Files\Microsoft Shared\PROOF\	read data or list directory and synchronize	directory file and synchronous io non alert and open for backup ident	false	success or wait	51	3002F203	FindFirstFileW
C:\Program Files\Common Files\Microsoft Shared\PROOF\mslid.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	4AFFC033	unknown
C:\Program Files\Common Files\Microsoft Shared\PROOF\MSSPELL3.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	9C0288	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC	read attributes and delete	non directory file and open for backup ident and open reparse point	false	success or wait	2	300D5696	DeleteFileW
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC	read attributes and delete	non directory file and open for backup ident and open reparse point	false	success or wait	1	300D5696	DeleteFileW
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~WRI0002	read attributes and delete and synchronize	synchronous io non alert and open for backup ident and open reparse point	false	success or wait	1	300AFF20	MoveFileW
C:\Program Files\Common Files\Microsoft Shared\PROOF\1033\MSGR3EN.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	301C8944	LoadLibraryW
C:\Documents and Settings\Administrator\My Documents	execute or traverse and synchronize	directory file and synchronous io non alert	false	success or wait	1	30072F79	GetSystemDirectoryW
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unidrvui.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7E42E442	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	52	7E42E442	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdrv.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	7E42E442	unknown
C:\WINDOWS\system32\FontSub.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	4	7E42E442	unknown
C:\WINDOWS\system32	read data or list directory and synchronize	directory file and synchronous io non alert and open for free space query	false	success or wait	1	3163DC20	unknown
C:\Program Files\Common Files\system\ado\msadox.dll	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	6D005C	unknown
C:\Program Files\Messenger\msmsgs.exe	execute or traverse and synchronize	synchronous io non alert and non directory file	false	success or wait	2	2E0073	unknown
C:\Program Files\Microsoft Office\OFFICE11\1033\wwintl.dll	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	FF909090	unknown
C:\WINDOWS\WindowsShell.Manifest	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	30029E78	LoadLibraryW
C:\WINDOWS\system32\msctfime.ime	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	30029D25	CreateWindowExW
C:\Program Files\Common Files\Microsoft Shared\office11\1033\msointl.dll	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	6F0073	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file and open no recall	true	success or wait	1	1	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dot	read attributes and synchronize and generic read and generic write	synchronous io non alert and non directory file	true	success or wait	1	1004A	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dot	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	303D211F	StgIsStorageFile
C:\WINDOWS\Registration\R000000000007.clb	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	12E854	unknown
C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\OPA11.BAK	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file and open reparse point	true	success or wait	1	310031	unknown
C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat	read attributes and synchronize and generic read	synchronous io non alert and non directory file and random access	true	success or wait	2	FFFF00F6	unknown
C:\Program Files\Microsoft Office\OFFICE11\1033\id_011.dpc	read attributes and synchronize and generic read	synchronous io non alert and non directory file and open no recall	true	success or wait	1	64002E	unknown
\pipe\lsarpc	read attributes and synchronize and generic read and generic write	non directory file	true	success or wait	4	FFFF	unknown
MountPointManager	read attributes and synchronize	synchronous io non alert and non directory file	true	success or wait	6	FFFF	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc	read attributes and synchronize and generic read and generic write	synchronous io non alert and non directory file	true	success or wait	1	124A2C	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\review.rcd	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file and open no recall	true	object name not found	1	4D005C	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\adhoc.rcd	read attributes and synchronize and generic read	sequential only and synchronous io non alert and non directory file and open no recall	true	object name not found	1	4D005C	unknown
\pipe\srvsvc	read attributes and synchronize and generic read and generic write	non directory file and open no recall	true	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Local Settings\iPhone 5.doc	read attributes and synchronize	synchronous io non alert and open for backup ident	true	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Local Settings\	read attributes and synchronize	synchronous io non alert and open for backup ident and open reparse point	true	success or wait	1	6C0069	unknown
\pipe\wkssvc	read attributes and synchronize and generic read and generic write	non directory file and open no recall	true	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat	synchronize and generic read and generic write	synchronous io non alert and non directory file	true	success or wait	4	6C0069	unknown
C:\Documents and Settings\Administrator\Local Settings	read attributes and synchronize	synchronous io non alert and open for backup ident	true	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\	read attributes and synchronize	synchronous io non alert and open for backup ident and open reparse point	true	success or wait	1	6C0069	unknown
C:\WINDOWS\system32\OLEACCRC.DLL	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	read attributes and synchronize and generic read	synchronous io non alert and non directory file and random access	true	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	read attributes and synchronize and generic read	synchronous io non alert and non directory file and random access	true	success or wait	1	30D5D887	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC	read attributes and synchronize and generic read and generic write	synchronous io non alert and non directory file	true	success or wait	4	3003D5D6	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC	read attributes and synchronize and generic read and generic write	synchronous io non alert and non directory file and open no recall	true	success or wait	5	30192330	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC	read attributes and synchronize and generic read and generic write	synchronous io non alert and non directory file and open no recall	true	success or wait	2	302EA843	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\MSSP3EN.exc	read attributes and synchronize and generic read	synchronous io non alert and non directory file and open no recall	true	object name not found	1	9C0288	unknown
C:\Program Files\Common Files\Microsoft Shared\PROOF\MSSP3EN.LEX	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	9C0288	unknown
C:\Program Files\Common Files\Microsoft Shared\PROOF\MSGR3EN.LEX	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	1	301D7B97	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD	read attributes and synchronize and generic read	synchronous io non alert and non directory file and open no recall	true	success or wait	26	7E42E442	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd	read attributes and synchronize and generic read	synchronous io non alert and non directory file and open no recall	true	success or wait	26	7E42E442	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd	read attributes and synchronize and generic read	synchronous io non alert and non directory file and open no recall	true	success or wait	26	7E42E442	unknown
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini	read attributes and synchronize and generic read	synchronous io non alert and non directory file and open no recall	true	success or wait	26	7E42E442	unknown
C:\Program Files\Common Files\system\ado\msadox.dll	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	6D005C	unknown
C:\Program Files\Messenger\msmsgs.exe	read attributes and synchronize and generic read	synchronous io non alert and non directory file	true	success or wait	2	2E0073	unknown

File Path	Access	Attributes	Options	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB064.tmp	read attributes and delete and synchronize and generic read and generic write	temporary	synchronous io non alert and non directory file and delete on close	success or wait	1	1004A	unknown
C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRS0001.tmp	read attributes and synchronize and generic read and generic write	normal	synchronous io non alert and non directory file and open no recall	success or wait	1	30192330	unknown
C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat	read attributes and delete and synchronize and generic write	archive	sequential only and synchronous io non alert and non directory file	object name collision	1	310031	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB5D9.tmp	read attributes and delete and synchronize and generic read and generic write	temporary	synchronous io non alert and non directory file and delete on close	success or wait	1	124A2C	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\~$hone 5.doc	read attributes and synchronize and generic write	hidden	synchronous io non alert and non directory file and open no recall	success or wait	1	3018D96F	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\iPhone 5.doc.LNK	read attributes and synchronize and generic read and generic write	none	synchronous io non alert and non directory file	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Local Settings.LNK	read attributes and synchronize and generic read and generic write	none	synchronous io non alert and non directory file	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC	read attributes and synchronize and generic read and generic write	normal	synchronous io non alert and non directory file and open no recall	success or wait	1	302EA953	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC	read attributes and synchronize and generic write	hidden	synchronous io non alert and non directory file and open no recall	success or wait	2	302EA768	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~WRI0002	read attributes and synchronize and generic read and generic write	normal	synchronous io non alert and non directory file and open no recall	success or wait	1	3000C7C6	unknown

File Deleted

File Path	Completion	Count	Source Address	Symbol
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC	success or wait	2	300D5696	DeleteFileW
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC	success or wait	1	300D5696	DeleteFileW

File Moved

Old File Path	New File Path	Completion	Count	Source Address	Symbol
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~WRI0002	C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC	success or wait	1	300AFF20	MoveFileW

File Written

File Path	Offset	Length	Value	Completion	Count	Source Address	Symbol
\lsarpc	0	72	05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	4	FFFF	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\~$hone 5.doc	unknown	54	0D 48 61 6E 75 65 6C 65 20 42 61 73 65 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	30041F40	WriteFile
C:\DOCUME~1\ADMINI~1\LOCALS~1\~$hone 5.doc	unknown	108	0D 00 48 00 61 00 6E 00 75 00 65 00 6C 00 65 00 20 00 42 00 61 00 73 00 65 00 72 00 00 00 00 00 16 00 00 00 F8 00 06 00 3E 01 0A 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 02 00 00 00 00 00 00 00 74 47 0C 00 FF FF FF FF FF FF 0C 00 5C 00 00 00 03 00 00 00 04 00 00 00 08 00 00 00 04 00 00 00	success or wait	1	30041F40	WriteFile
\srvsvc	0	72	05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	1	6C0069	unknown
\wkssvc	0	72	05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\iPhone 5.doc.LNK	unknown	737	4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 8B 00 00 00 20 00 00 00 1E EF 1E 83 EA 69 CD 01 50 40 95 84 EA 69 CD 01 78 51 21 83 EA 69 CD 01 00 54 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6D 01 14 00 1F 50 E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D 19 00	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat	77	27	5B 64 6F 63 5D 0D 0A 69 50 68 6F 6E 65 20 35 2E 64 6F 63 2E 4C 4E 4B 3D 30 0D 0A	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Local Settings.LNK	unknown	622	4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 8B 00 00 00 12 00 00 00 8A FF 93 68 2F 42 CA 01 8C 0C 4E 91 EA 69 CD 01 60 60 E0 90 EA 69 CD 01 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 01 14 00 1F 50 E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D 19 00	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat	54	72	4C 6F 63 61 6C 20 53 65 74 74 69 6E 67 73 2E 4C 4E 4B 3D 30 0D 0A 5B 70 70 74 5D 0D 0A 74 65 73 74 2E 70 70 74 2E 4C 4E 4B 3D 30 0D 0A 5B 64 6F 63 5D 0D 0A 69 50 68 6F 6E 65 20 35 2E 64 6F 63 2E 4C 4E 4B 3D 30 0D 0A	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC	unknown	54	0D 48 61 6E 75 65 6C 65 20 42 61 73 65 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	2	30041F40	WriteFile
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC	unknown	108	0D 00 48 00 61 00 6E 00 75 00 65 00 6C 00 65 00 20 00 42 00 61 00 73 00 65 00 72 00 00 00 00 00 20 00 00 00 00 00 00 00 04 00 00 00 04 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 00 00 03 00 01 00 0C 00 5C 00 00 00 03 00 00 00 04 00 00 00 08 00 00 00 04 00 00 00	success or wait	2	30041F40	WriteFile

File Path	Offset	Length	Value	Completion	Count	Source Address	Symbol
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip	unknown	12	19 00 04 00 19 00 19 00 8C 06 00 00	success or wait	1	1	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip	unknown	1676	68 00 00 00 88 05 00 00 80 06 00 00 88 06 00 00 E7 69 CD 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	1	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dot	0	24	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	303D211F	StgIsStorageFile
C:\WINDOWS\Registration\R000000000007.clb	unknown	22512	43 4F 4D 2B 01 00 00 00 01 00 12 00 24 00 00 00 00 01 01 00 63 00 00 00 00 00 00 01 01 00 00 00 00 01 10 00 00 00 00 00 C0 00 00 00 00 00 00 46 0E 00 00 00 30 01 00 00 A0 03 00 00 33 5F 30 00 D0 04 00 00 0C 00 00 00 33 5F 31 00 DC 04 00 00 88 02 00 00 33 5F 32 00 64 07 00 00 3C 00 00 00 33 5F 33 00	success or wait	1	12E854	unknown
C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat	unknown	8200	02 AB 1B 8F D1 D4 FE 68 A2 DB EA C7 E5 28 02 7E DB 3B 1F FA FD 11 53 96 8F 67 D0 D6 29 AF 27 91 64 6F 5D 8C 2B A8 2B F1 E9 6A 6C A5 A1 29 47 81 8C 0A 60 4C 01 C6 73 F4 B9 77 78 55 29 29 48 32 A9 19 BD 20 AE 2F FD AC 6D 17 DB FA B4 9D 92 58 A9 B6 71 A2 0E 8F 20 8A 6F 51 91 92 32 B2 33 BE 60 30 4B F8	success or wait	2	FFFF00F6	unknown
C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat	unknown	6	0E AB 1B 8F C2 D4	success or wait	1	30CE081C	unknown
C:\Program Files\Microsoft Office\OFFICE11\1033\ID_011.DPC	unknown	575	4D 10 B1 97 70 ED 41 A7 18 C6 A0 30 FA E4 CA 9C 8B 05 18 82 F8 0F FE CF CF FB A8 BA 01 1E 74 D0 91 F9 C1 07 18 87 24 9A DE 4A 61 67 12 00 63 63 64 87 E3 11 82 80 0F 0E 75 EF E7 44 3D 12 8E 09 50 E2 3A 7D CB 9B EE B9 1B 52 A8 34 CF E6 7D BC CA 68 CC E3 38 34 82 28 9D 21 A3 C7 A8 89 7D EF 88 1B EC 8B	success or wait	1	64002E	unknown
\lsarpc	0	1024	00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	pending	1	FFFF	unknown
\lsarpc	0	1024	05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	pending	2	FFFF	unknown
C:\Documents and Settings\Administrator\Application Data\desktop.ini	unknown	62	5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	9	6C0069	unknown
\srvsvc	0	1024	05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 35 18 00 38 35 18 00 10 00 00 00 00 00 00 00 0F 00 00 00 48 00 41 00 4E 00 55 00 45 00 4C 00 45 00 2D 00 42 00 43 00 36 00 30 00 37 00 32 00 30 00 00 00	pending	1	6C0069	unknown
\lsarpc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 32 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 A4 C6 1C 00 00 00 00 00 00 00 00 00 00 00 00 00 A8 C6 1C 00 00 00 00 80 B8 C6 1C 00	success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Start Menu\desktop.ini	unknown	62	5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 36 0D 0A	success or wait	3	6C0069	unknown
C:\Documents and Settings\All Users\Start Menu\desktop.ini	unknown	272	5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 36 0D 0A 5B 4C 6F 63 61 6C 69 7A 65 64 46 69 6C 65 4E 61 6D 65 73 5D 0D 0A 57 69 6E 64 6F 77 73 20 43 61 74 61 6C 6F 67 2E	success or wait	3	6C0069	unknown
C:\Documents and Settings\All Users\Application Data\desktop.ini	unknown	62	5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	3	6C0069	unknown
C:\Documents and Settings\Administrator\My Documents\desktop.ini	unknown	84	5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	12	6C0069	unknown
C:\Documents and Settings\Administrator\My Documents\My Pictures\Desktop.ini	unknown	191	5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 33 39 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 50 69 63 74 75 72 65 73 0D 0A 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F	success or wait	6	6C0069	unknown
C:\Documents and Settings\All Users\Documents\desktop.ini	unknown	62	5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	12	6C0069	unknown
C:\Documents and Settings\All Users\Documents\My Pictures\Desktop.ini	unknown	150	5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 49 6E 66 6F 54 69 70 3D 40 53 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 31 32 36 38 38 0D 0A 49 63 6F 6E 46 69 6C 65 3D 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 6D 79 64 6F 63 73 2E 64 6C 6C 0D 0A 49 63 6F 6E 49 6E 64 65 78	success or wait	3	6C0069	unknown
\wkssvc	0	1024	05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 77 18 00 00 0D 00 5C 50 49 50 45 5C 77 6B 73 73 76 63 00 80 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 0E 00 00 00 00 00 00 00 0E 00 00 00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 20 00 73 00 68 00	success or wait	1	6C0069	unknown
C:\Documents and Settings\All Users\Documents\My Music\Desktop.ini	unknown	151	5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 49 6E 66 6F 54 69 70 3D 40 53 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 31 32 36 38 39 0D 0A 49 63 6F 6E 46 69 6C 65 3D 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 53 48 45 4C 4C 33 32 2E 64 6C 6C 0D 0A 49 63 6F 6E 49 6E 64 65	success or wait	3	6C0069	unknown
C:\Documents and Settings\All Users\Documents\My Videos\Desktop.ini	unknown	151	5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 49 6E 66 6F 54 69 70 3D 40 53 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 31 32 36 39 30 0D 0A 49 63 6F 6E 46 69 6C 65 3D 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 53 48 45 4C 4C 33 32 2E 64 6C 6C 0D 0A 49 63 6F 6E 49 6E 64 65	success or wait	3	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat	unknown	77	5B 66 6F 6C 64 65 72 73 5D 0D 0A 54 65 6D 70 6C 61 74 65 73 2E 4C 4E 4B 3D 30 0D 0A 61 6C 6C 2E 4C 4E 4B 3D 30 0D 0A 44 65 73 6B 74 6F 70 2E 4C 4E 4B 3D 30 0D 0A 5B 70 70 74 5D 0D 0A 74 65 73 74 2E 70 70 74 2E 4C 4E 4B 3D 30 0D 0A	success or wait	2	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat	unknown	104	5B 66 6F 6C 64 65 72 73 5D 0D 0A 54 65 6D 70 6C 61 74 65 73 2E 4C 4E 4B 3D 30 0D 0A 61 6C 6C 2E 4C 4E 4B 3D 30 0D 0A 44 65 73 6B 74 6F 70 2E 4C 4E 4B 3D 30 0D 0A 5B 70 70 74 5D 0D 0A 74 65 73 74 2E 70 70 74 2E 4C 4E 4B 3D 30 0D 0A 5B 64 6F 63 5D 0D 0A 69 50 68 6F 6E 65 20 35 2E 64 6F 63 2E 4C 4E 4B	success or wait	3	4D005C	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat	unknown	126	5B 66 6F 6C 64 65 72 73 5D 0D 0A 54 65 6D 70 6C 61 74 65 73 2E 4C 4E 4B 3D 30 0D 0A 61 6C 6C 2E 4C 4E 4B 3D 30 0D 0A 44 65 73 6B 74 6F 70 2E 4C 4E 4B 3D 30 0D 0A 4C 6F 63 61 6C 20 53 65 74 74 69 6E 67 73 2E 4C 4E 4B 3D 30 0D 0A 5B 70 70 74 5D 0D 0A 74 65 73 74 2E 70 70 74 2E 4C 4E 4B 3D 30 0D 0A 5B	success or wait	1	4D005C	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	64	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 01 00 00	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	4	50 45 00 00	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	20	4C 01 05 00 05 AC 27 46 00 00 00 00 00 00 00 00 E0 00 0E 21	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	40	2E 74 65 78 74 00 00 00 F7 82 01 00 00 10 00 00 00 84 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	40	2E 64 61 74 61 00 00 00 01 2B 00 00 00 A0 01 00 00 14 00 00 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	40	2E 63 64 61 74 61 00 00 04 00 00 00 00 D0 01 00 00 02 00 00 00 9C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	40	2E 72 73 72 63 00 00 00 20 21 00 00 00 E0 01 00 00 22 00 00 00 9E 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 02 00 01 00	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	8	E8 00 00 80 28 00 00 80	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	2	08 00	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	8	FA 00 00 80 40 00 00 80	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	2	07 00	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	14	54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	2	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	8	01 00 00 00 88 00 00 80	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	8	09 04 00 00 C8 00 00 00	success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	unknown	16	48 E8 01 00 D4 18 00 00 00 00 00 00 00 00 00 00	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	64	4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	4	50 45 00 00	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	20	4C 01 01 00 CE 29 02 48 00 00 00 00 00 00 00 00 E0 00 0F 21	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	40	2E 72 73 72 63 00 00 00 60 3E 00 00 00 10 00 00 00 40 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	8	A0 00 00 80 20 00 00 80	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	2	07 00	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	14	54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	16	00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	2	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	8	01 00 00 00 50 00 00 80	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	8	09 04 00 00 80 00 00 00	success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	unknown	16	B0 10 00 00 40 3A 00 00 00 00 00 00 00 00 00 00	success or wait	1	30D5D887	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC	0	512	00 00 00 00 31 00 2D 00 35 00 2D 00 31 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	end of file	3	3003D5D6	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC	unknown	4	B0 FF 12 00	end of file	1	69004D	unknown

Other File Operations

File Path	Disposition	Data	Ascii Data	Completion	Count	Source Address	Symbol
C:\DOCUME~1\ADMINI~1\LOCALS~1	90028	NU LL		success or wait	1	7C90E457	KiUserApcDispatcher
\lsarpc	11C017	05 00 00 03 10 00 00 00 40 00 00 00 01 00 00 00 28 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 0C 00 00 00 02 00 01 00 00 08 00 00	........@.......(.....,.........................................	pending	3	FFFF	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 6A 00 00 00 02 00 00 00 52 00 00 00 00 00 1F 00 00 00 00 00 13 A8 AE 8E 4B CF 64 4C BF 59 F3 51 AE 4B 1A D9 2A 00 2C 00 00 00 02 00 16 00 00 00 00 00 00 00 15 00 00 00 53 00 65 00 4C 00 6F 00 61 00 64 00 44 00 72 00 69 00 76 00 65 00 72 00 50 00 72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 00	........j.......R...............K.dL.Y.Q.K..*.,.................S.e.L.o.a.d.D.r.i.v.e.r.P.r.i.v.i.l.e.g.e.	pending	1	FFFF	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 13 A8 AE 8E 4B CF 64 4C BF 59 F3 51 AE 4B 1A D9	........,.......................K.dL.Y.Q.K..	pending	1	FFFF	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 62 00 00 00 02 00 00 00 4A 00 00 00 00 00 1F 00 00 00 00 00 0C D6 08 E7 34 02 CB 48 BA 86 C8 5B 67 F9 43 EF 22 00 24 00 00 00 02 00 12 00 00 00 00 00 00 00 11 00 00 00 53 00 65 00 55 00 6E 00 64 00 6F 00 63 00 6B 00 50 00 72 00 69 00 76 00 69 00 6C 00 65 00 67 00 65 00	........b.......J...............4..H...[g.C.".$.................S.e.U.n.d.o.c.k.P.r.i.v.i.l.e.g.e.	pending	1	FFFF	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 0C D6 08 E7 34 02 CB 48 BA 86 C8 5B 67 F9 43 EF	........,.......................4..H...[g.C.	pending	1	FFFF	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 74 00 00 00 02 00 00 00 5C 00 00 00 00 00 39 00 00 00 00 00 31 77 8C 2B 4D 67 9B 4F 93 90 3B D2 93 38 6B C0 01 00 00 00 00 00 02 00 01 00 00 00 04 00 02 00 05 00 00 00 01 05 00 00 00 00 00 05 15 00 00 00 FD 43 46 1E 81 77 D9 74 43 17 0A 32 F4 01 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 02 00 00 00	........t.......\.....9.....1w.+Mg.O..;..8k..................................CF..w.tC..2............................	pending	1	6014A	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 03 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 31 77 8C 2B 4D 67 9B 4F 93 90 3B D2 93 38 6B C0	........,...................1w.+Mg.O..;..8k.	pending	1	6014A	unknown
\srvsvc	11C017	05 00 00 03 10 00 00 00 38 00 00 00 01 00 00 00 20 00 00 00 00 00 0F 00 00 00 00 00 F6 01 00 00 F6 01 00 00 00 00 02 00 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00	........8....... .......................................	pending	1	6C0069	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 38 00 00 00 01 00 00 00 20 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00	........8....... .....,.................................	pending	1	6C0069	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2E 00 00 00 02 00 00 00 16 00 00 00 00 00 2E 00 00 00 00 00 B0 A7 26 DE AD 61 6F 4E 8E B1 EB 56 AB A2 4A 6E 0C 00	..............................&..aoN...V..Jn..	pending	1	6C0069	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2E 00 00 00 03 00 00 00 16 00 00 00 00 00 07 00 00 00 00 00 B0 A7 26 DE AD 61 6F 4E 8E B1 EB 56 AB A2 4A 6E 05 00	..............................&..aoN...V..Jn..	pending	1	6C0069	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 04 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 B0 A7 26 DE AD 61 6F 4E 8E B1 EB 56 AB A2 4A 6E	........,.....................&..aoN...V..Jn	pending	1	6C0069	unknown
\srvsvc	11C017	05 00 00 03 10 00 00 00 44 00 00 00 02 00 00 00 2C 00 00 00 00 00 10 00 00 00 02 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 4A 6E 03 00 00 00 00 00 00 00 03 00 00 00 43 00 24 00 00 00 08 00 F5 01 00 00	........D.......,.........................Jn............C.$.........	pending	1	6C0069	unknown
C:\Documents and Settings\Administrator\Local Settings\iPhone 5.doc	900C0	NU LL		success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Local Settings	get reparse point	NU LL		not a reparse point	1	6C0069	unknown
\wkssvc	11C017	05 00 00 03 10 00 00 00 20 00 00 00 01 00 00 00 08 00 00 00 00 00 14 00 00 00 00 00 00 00 00 00	........ .......................	pending	1	6C0069	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 38 00 00 00 05 00 00 00 20 00 00 00 00 00 2C 00 00 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00	........8....... .....,.................................	pending	1	6C0069	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2E 00 00 00 06 00 00 00 16 00 00 00 00 00 2E 00 00 00 00 00 58 86 38 84 43 68 B6 4C 95 E4 12 2C F3 CB 85 CA 0C 00	............................X.8.Ch.L...,......	pending	1	6C0069	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2E 00 00 00 07 00 00 00 16 00 00 00 00 00 07 00 00 00 00 00 58 86 38 84 43 68 B6 4C 95 E4 12 2C F3 CB 85 CA 05 00	............................X.8.Ch.L...,......	pending	1	6C0069	unknown
\lsarpc	11C017	05 00 00 03 10 00 00 00 2C 00 00 00 08 00 00 00 14 00 00 00 00 00 00 00 00 00 00 00 58 86 38 84 43 68 B6 4C 95 E4 12 2C F3 CB 85 CA	........,...................X.8.Ch.L...,....	pending	1	6C0069	unknown
\srvsvc	11C017	05 00 00 03 10 00 00 00 44 00 00 00 03 00 00 00 2C 00 00 00 00 00 10 00 00 00 02 00 01 00 00 00 00 00 00 00 01 00 00 00 00 00 85 CA 03 00 00 00 00 00 00 00 03 00 00 00 43 00 24 00 00 00 08 00 F5 01 00 00	........D.......,.......................................C.$.........	pending	1	6C0069	unknown
C:\Documents and Settings\Administrator\Local Settings	900C0	NU LL		success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator	get reparse point	NU LL		not a reparse point	1	6C0069	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB064.tmp	PositionInformation	Offset: 512		success or wait	1	1004A	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB064.tmp	EndOfFileInformation	unknown		success or wait	1	1004A	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB064.tmp	AllocationInformation	unknown		success or wait	1	1004A	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB064.tmp	PositionInformation	Offset: 0		success or wait	1	1004A	unknown
C:\WINDOWS\Registration\R000000000007.clb	PositionInformation	Offset: 22512		success or wait	1	12E854	unknown
C:\WINDOWS\Registration\R000000000007.clb	PositionInformation	Offset: 0		success or wait	1	12E854	unknown
C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: archive and temporary		success or wait	1	310031	unknown
C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat	PositionInformation	Offset: 0		success or wait	2	FFFF00F6	unknown
C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat	PositionInformation	Offset: 8200		success or wait	1	30CE081C	unknown
\lsarpc	PipeInformation	unknown		success or wait	4	FFFF	unknown
\lsarpc	CompletionInformation	unknown		success or wait	4	FFFF	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB5D9.tmp	PositionInformation	Offset: 512		success or wait	1	124A2C	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB5D9.tmp	EndOfFileInformation	unknown		success or wait	1	124A2C	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB5D9.tmp	AllocationInformation	unknown		success or wait	1	124A2C	unknown
C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB5D9.tmp	PositionInformation	Offset: 0		success or wait	1	124A2C	unknown
\srvsvc	PipeInformation	unknown		success or wait	1	6C0069	unknown
\srvsvc	CompletionInformation	unknown		success or wait	1	6C0069	unknown
\wkssvc	PipeInformation	unknown		success or wait	1	6C0069	unknown
\wkssvc	CompletionInformation	unknown		success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat	EndOfFileInformation	unknown		success or wait	1	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat	BasicInformation	Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: directory and archive and temporary		success or wait	2	6C0069	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat	EndOfFileInformation	unknown		success or wait	1	6C0069	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 0		success or wait	2	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 312		success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 560		success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 720		success or wait	6	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 105984		success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 106008		success or wait	2	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 106216		success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 106016		success or wait	2	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 106234		success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 106048		success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 106064		success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 106120		success or wait	1	30D5D887	unknown
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	PositionInformation	Offset: 106184		success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 0		success or wait	2	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 192		success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 440		success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 480		success or wait	6	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 512		success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 536		success or wait	2	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 672		success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 544		success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 560		success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 592		success or wait	1	30D5D887	unknown
C:\WINDOWS\system32\stdole2.tlb	PositionInformation	Offset: 640		success or wait	1	30D5D887	unknown
C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC	PositionInformation	Offset: 0		success or wait	4	301E47C6	SetFilePointer

Section Activites

Section loaded by Windows

File Path	Access	Type	Base	Size	Mapped to pid	Protection	Completion	Count
\KnownDlls\kernel32.dll	write and read and execute	unknown	7C800000	1007616	own pid	read write	success or wait	1
unknown	query and write and read and execute and extend size	reserve	7C800000	1007616	own pid	read write	success or wait	1
\NLS\NlsSectionUnicode	read	unknown	260000	90112	own pid	readonly	success or wait	1
\NLS\NlsSectionLocale	read	unknown	280000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey	query and read	unknown	2D0000	266240	own pid	readonly	success or wait	1
\NLS\NlsSectionSortTbls	read	unknown	320000	24576	own pid	readonly	success or wait	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\NLS\NlsSectionSortkey00000409	read	unknown	unknown	unknown	unknown	unknown	object name not found	1
\KnownDlls\ADVAPI32.dll	write and read and execute	unknown	77DD0000	634880	own pid	read write	success or wait	1
\KnownDlls\RPCRT4.dll	write and read and execute	unknown	77E70000	602112	own pid	read write	success or wait	1
\KnownDlls\Secur32.dll	write and read and execute	unknown	77FE0000	69632	own pid	read write	success or wait	1
\KnownDlls\GDI32.dll	write and read and execute	unknown	77F10000	299008	own pid	read write	success or wait	1
\KnownDlls\USER32.dll	write and read and execute	unknown	7E410000	593920	own pid	read write	success or wait	1
\KnownDlls\ole32.dll	write and read and execute	unknown	774E0000	1302528	own pid	read write	success or wait	1
\KnownDlls\msvcrt.dll	write and read and execute	unknown	77C10000	360448	own pid	read write	success or wait	1
\KnownDlls\VERSION.dll	write and read and execute	unknown	77C00000	32768	own pid	read write	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	410000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	write and read and execute	commit	410000	110592	own pid	execute	success or wait	1
C:\WINDOWS\system32\imm32.dll	query and write and read and execute	image	76390000	118784	own pid	read write	success or wait	1
\NLS\NlsSectionCType	read	unknown	850000	12288	own pid	readonly	success or wait	1
\KnownDlls\psapi.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\psapi.dll	query and write and read and execute	image	76BF0000	45056	own pid	read write	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\1033\WWINTL.DLL	write and read and execute	commit	8D0000	778240	own pid	execute	success or wait	1
C:\Program Files\Microsoft Office\OFFICE11\1033\WWINTL.DLL	query and read	commit	8D0000	778240	own pid	readonly	success or wait	1
\BaseNamedObjects\Local\Mso97SharedDg19211108172	query and write and read and execute and extend size	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\Mso97SharedDg19211108172	query and write and read	reserve	A20000	126976	own pid	read write	success or wait	1
\KnownDlls\uxtheme.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\uxtheme.dll	query and write and read and execute	image	5AD70000	229376	own pid	read write	success or wait	1
C:\WINDOWS\system32\msctf.dll	write and read and execute	commit	A60000	299008	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctf.dll	query and write and read and execute	image	74720000	311296	own pid	read write	success or wait	1
\BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-507921405-1960408961-839522115-500	query and write and read	commit	unknown	unknown	unknown	unknown	object name exists	1
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500SFM.DefaultS-1-5-21-507921405-1960408961-839522115-500	query and write and read and execute and extend size	unknown	A60000	262144	own pid	read write	success or wait	1
C:\WINDOWS\system32\msctfime.ime	write and read and execute	commit	AA0000	180224	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctfime.ime	query and read	commit	AA0000	180224	own pid	readonly	success or wait	1
C:\WINDOWS\system32\msctfime.ime	write and read and execute	commit	AA0000	180224	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctfime.ime	query and read	commit	AA0000	180224	own pid	readonly	success or wait	1
C:\WINDOWS\system32\msctfime.ime	write and read and execute	commit	AA0000	180224	own pid	execute	success or wait	1
C:\WINDOWS\system32\msctfime.ime	query and write and read and execute	image	755C0000	188416	own pid	read write	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\1033\MSOINTL.DLL	write and read and execute	commit	AB0000	1757184	own pid	execute	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\1033\MSOINTL.DLL	query and read	commit	AB0000	1757184	own pid	readonly	success or wait	1
\BaseNamedObjects\Local\Mso97SharedDg20321108172	query and write and read and execute and extend size	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\Mso97SharedDg20321108172	query and write and read	reserve	C60000	126976	own pid	read write	success or wait	1
C:\WINDOWS\system32\rpcss.dll	write and read and execute	commit	CF0000	401408	own pid	execute	success or wait	1
\KnownDlls\SHELL32.dll	write and read and execute	unknown	7C9C0000	8482816	own pid	read write	success or wait	1
C:\WINDOWS\system32\shell32.dll	read	commit	CF0000	8462336	own pid	readonly	success or wait	1
\KnownDlls\comctl32.dll	write and read and execute	unknown	5D090000	630784	own pid	read write	success or wait	1
C:\WINDOWS\system32\comctl32.dll	read	commit	CF0000	618496	own pid	readonly	success or wait	1
\BaseNamedObjects\DfSharedHeap3B051	query and write and read	reserve	DA0000	4194304	own pid	read write	success or wait	1
\BaseNamedObjects\DFMap0-241752	query and write and read	commit	D10000	524288	own pid	read write	success or wait	1
\BaseNamedObjects\DfRoot00003B051	query and write and read	commit	11A0000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\DFMap0-241775	query and write and read	commit	11B0000	524288	own pid	read write	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\RICHED20.DLL	write and read and execute	commit	1240000	1105920	own pid	execute	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\RICHED20.DLL	query and write and read and execute	image	39700000	1097728	own pid	read write	success or wait	1
\KnownDlls\OLEAUT32.dll	write and read and execute	unknown	77120000	569344	own pid	read write	success or wait	1
C:\WINDOWS\system32\msimtf.dll	write and read and execute	commit	1300000	159744	own pid	execute	success or wait	1
C:\WINDOWS\system32\msimtf.dll	write and read and execute	commit	1300000	159744	own pid	execute	success or wait	1
C:\WINDOWS\system32\msimtf.dll	write and read and execute	commit	1300000	159744	own pid	execute	success or wait	1
C:\WINDOWS\system32\msimtf.dll	write and read and execute	commit	1300000	159744	own pid	execute	success or wait	1
\BaseNamedObjects\CTF.AsmListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500	query and write and read and execute and extend size	unknown	1300000	4096	own pid	read write	success or wait	1
\KnownDlls\CLBCATQ.DLL	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\clbcatq.dll	query and write and read and execute	image	76FD0000	520192	own pid	read write	success or wait	1
\KnownDlls\COMRes.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\comres.dll	query and write and read and execute	image	77050000	806912	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF..CJJCD	query and write and read	commit	1330000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.Shared.SFM.MNH	query and write and read and execute and extend size	unknown	1340000	524288	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF.B.CJJCD	query and write and read	commit	1330000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF.C.CJJCD	query and write and read	commit	13C0000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF.D.CJJCD	query and write and read	commit	13D0000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF.E.CJJCD	query and write and read	commit	1330000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\Local\Mso97SharedDg19521108172	query and write and read and execute and extend size	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\Mso97SharedDg19521108172	query and write and read	reserve	13E0000	126976	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF.F.AMJCD	query and write and read	commit	1330000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\Local\Mso97SharedDg19521108172	query and write and read and execute and extend size	unknown	1400000	126976	own pid	read write	success or wait	1
\BaseNamedObjects\Local\Mso97SharedDg19531108172	query and write and read and execute and extend size	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\Mso97SharedDg19531108172	query and write and read	reserve	1400000	126976	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF.G.ANJCD	query and write and read	commit	1330000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MNH.FB.ANJCD	query and write and read and execute and extend size	unknown	1330000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MNH.GB.ANJCD	query and write and read and execute and extend size	unknown	1330000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MNH.HB.ANJCD	query and write and read and execute and extend size	unknown	1330000	4096	own pid	read write	success or wait	1
\KnownDlls\msi.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msi.dll	query and write and read and execute	image	7D1E0000	2867200	own pid	read write	success or wait	1
\KnownDlls\SETUPAPI.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\setupapi.dll	query and write and read and execute	image	77920000	995328	own pid	read write	success or wait	1
\BaseNamedObjects\DfSharedHeap3B5CC	query and write and read	reserve	1420000	4194304	own pid	read write	success or wait	1
\BaseNamedObjects\DFMap0-243156	query and write and read	commit	1820000	524288	own pid	read write	success or wait	1
\BaseNamedObjects\DfRoot00003B5CC	query and write and read	commit	13D0000	4096	own pid	read write	success or wait	1
\BaseNamedObjects\DFMap0-243174	query and write and read	commit	18A0000	524288	own pid	read write	success or wait	1
\KnownDlls\USERENV.dll	write and read and execute	unknown	769C0000	737280	own pid	read write	success or wait	1
\BaseNamedObjects\Local\MSO_Formal11108172_S-1-5-21-507921405-1960408961-839522115-500	query and write and read and execute and extend size	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\MSO_Formal11108172_S-1-5-21-507921405-1960408961-839522115-500	query and write and read	commit	1920000	8192	own pid	read write	success or wait	1
\BaseNamedObjects\Local\MSO_AdHoc11108172_S-1-5-21-507921405-1960408961-839522115-500	query and write and read and execute and extend size	unknown	unknown	unknown	unknown	unknown	object name not found	1
\BaseNamedObjects\Local\MSO_AdHoc11108172_S-1-5-21-507921405-1960408961-839522115-500	query and write and read	commit	1930000	8192	own pid	read write	success or wait	1
C:\WINDOWS\system32\msimtf.dll	write and read and execute	commit	1980000	159744	own pid	execute	success or wait	1
\BaseNamedObjects\Global\RotHintTable	read	unknown	1980000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\winlogon.exe	write and read and execute	commit	1990000	507904	own pid	execute	success or wait	1
\KnownDlls\xpsp2res.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\xpsp2res.dll	query and write and read and execute	image	1990000	2904064	own pid	read write	conflicting addresses	1
\KnownDlls\LINKINFO.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\linkinfo.dll	query and write and read and execute	image	76980000	32768	own pid	read write	success or wait	1
\KnownDlls\ntshrui.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\ntshrui.dll	query and write and read and execute	image	76990000	151552	own pid	read write	success or wait	1
\KnownDlls\ATL.DLL	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\atl.dll	query and write and read and execute	image	76B20000	69632	own pid	read write	success or wait	1
\KnownDlls\NETAPI32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\netapi32.dll	query and write and read and execute	image	5B860000	348160	own pid	read write	success or wait	1
C:\WINDOWS\system32\ntshrui.dll	read	commit	1E70000	143360	own pid	readonly	success or wait	1
unknown	query and write and read	commit	1E70000	4096	own pid	read write	success or wait	1
unknown	query and write and read	commit	1E70000	4096	own pid	read write	success or wait	1
unknown	query and write and read	commit	1E70000	4096	own pid	read write	success or wait	1
unknown	query and write and read	commit	1E70000	4096	own pid	read write	success or wait	1
unknown	query and write and read	commit	1E70000	4096	own pid	read write	success or wait	1
unknown	query and write and read	commit	1E70000	4096	own pid	read write	success or wait	1
unknown	query and write and read	commit	1E70000	4096	own pid	read write	success or wait	1
unknown	query and write and read	commit	1E70000	4096	own pid	read write	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	write and read and execute	commit	1E70000	131072	own pid	execute	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	query and write and read and execute	image	37320000	143360	own pid	read write	success or wait	1
\KnownDlls\WINSPOOL.DRV	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\winspool.drv	query and write and read and execute	image	73000000	155648	own pid	read write	success or wait	1
\KnownDlls\OLEACC.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\oleacc.dll	query and write and read and execute	image	74C80000	180224	own pid	read write	success or wait	1
\KnownDlls\MSVCP60.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\msvcp60.dll	query and write and read and execute	image	76080000	413696	own pid	read write	success or wait	1
C:\WINDOWS\system32\oleaccrc.dll	query and read	commit	1E80000	20480	own pid	readonly	success or wait	1
\KnownDlls\SXS.DLL	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1
C:\WINDOWS\system32\sxs.dll	query and write and read and execute	image	7E720000	720896	own pid	read write	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL	query and read	commit	1FB0000	49152	own pid	readonly	success or wait	1
C:\WINDOWS\system32\stdole2.tlb	query and read	commit	1FC0000	16384	own pid	readonly	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\1033\STINTL.DLL	write and read and execute	commit	1FD0000	24576	own pid	execute	success or wait	1
C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\1033\STINTL.DLL	query and write and read and execute	image	374B0000	24576	own pid	read write	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\PROOF\MSLID.DLL	write and read and execute	commit	21F0000	536576	own pid	execute	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\PROOF\MSLID.DLL	query and write and read and execute	image	507C0000	540672	own pid	read write	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\PROOF\MSSPELL3.DLL	write and read and execute	commit	2600000	86016	own pid	execute	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\PROOF\MSSPELL3.DLL	query and write and read and execute	image	3F000000	86016	own pid	read write	success or wait	1
\BaseNamedObjects\DfSharedHeap3C40F	query and write and read	reserve	2610000	4194304	own pid	read write	success or wait	1
\BaseNamedObjects\DfSharedHeap3C42C	query and write and read	reserve	2610000	4194304	own pid	read write	success or wait	1
\BaseNamedObjects\DfSharedHeap3C440	query and write and read	reserve	2610000	4194304	own pid	read write	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\PROOF\MSSP3EN.LEX	query and read	commit	2610000	462848	own pid	readonly	success or wait	1
C:\Program Files\Common Files\Microsoft Shared\PROOF\MSGR3EN.LEX	query and read	commit	2830000	3788800	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll	write and read and execute	commit	2ED0000	745472	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll	query and write and read and execute	image	7E5A0000	761856	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2ED0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2EE0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2EE0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2ED0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2EE0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2EE0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2ED0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2EE0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2EE0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll	write and read and execute	commit	2ED0000	765952	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll	query and write and read and execute	image	3F500000	786432	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2EE0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2EF0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2EF0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	2EE0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	2EF0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	2EF0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\fontsub.dll	write and read and execute	commit	32E0000	81920	own pid	execute	success or wait	1
C:\WINDOWS\system32\fontsub.dll	query and write and read and execute	image	69310000	94208	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\fontsub.dll	write and read and execute	commit	32E0000	81920	own pid	execute	success or wait	1
C:\WINDOWS\system32\fontsub.dll	query and write and read and execute	image	69310000	94208	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD	query and read	commit	32E0000	61440	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini	query and read	commit	32F0000	4096	own pid	readonly	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	write and read and execute	commit	32F0000	200704	own pid	execute	success or wait	1
C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll	query and write and read and execute	image	3F960000	212992	own pid	read write	success or wait	1
C:\Program Files\Common Files\System\ado\msadox.dll	write and read and execute	commit	2CB0000	200704	own pid	execute	success or wait	1
C:\Program Files\Common Files\System\ado\msadox.dll	query and read	commit	2CB0000	200704	own pid	readonly	success or wait	1
C:\Program Files\Common Files\System\ado\msadox.dll	write and read and execute	commit	2CB0000	200704	own pid	execute	success or wait	1
C:\Program Files\Common Files\System\ado\msadox.dll	query and read	commit	2CB0000	200704	own pid	readonly	success or wait	1
C:\Program Files\Messenger\msmsgs.exe	write and read and execute	commit	2EE0000	1695744	own pid	execute	success or wait	1
C:\Program Files\Messenger\msmsgs.exe	query and read	commit	2EE0000	1695744	own pid	readonly	success or wait	1
C:\Program Files\Messenger\msmsgs.exe	write and read and execute	commit	2EE0000	1695744	own pid	execute	success or wait	1
C:\Program Files\Messenger\msmsgs.exe	query and read	commit	2EE0000	1695744	own pid	readonly	success or wait	1

Section loaded by Program

File Path	Access	Type	Base	Size	Mapped to pid	Protection	Completion	Count	Source Address
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	write and read and execute	commit	860000	12259328	own pid	execute	success or wait	1	30003071
C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL	query and write and read and execute	image	30C90000	12304384	own pid	read write	success or wait	1	30003071
\BaseNamedObjects\ShimSharedMemory	write	unknown	870000	57344	own pid	read write	success or wait	1	30003071
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	write and read and execute	commit	A40000	1056768	own pid	execute	success or wait	1	30029E78
C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll	query and write and read and execute	image	773D0000	1060864	own pid	read write	success or wait	1	30029E78
\KnownDlls\SHLWAPI.dll	write and read and execute	unknown	77F60000	483328	own pid	read write	success or wait	1	30029E78
C:\WINDOWS\WindowsShell.Manifest	write and read and execute	commit	A40000	4096	own pid	execute	success or wait	1	30029E78
C:\WINDOWS\WindowsShell.Manifest	query and read	commit	A40000	4096	own pid	readonly	success or wait	1	30029E78
C:\WINDOWS\WindowsShell.Manifest	read	commit	A40000	4096	own pid	readonly	success or wait	1	30029E78
\BaseNamedObjects\PrimaryWord11SharedMemoryArea	read	unknown	unknown	unknown	unknown	unknown	object name not found	1	3002AA90
\BaseNamedObjects\PrimaryWord11SharedMemoryArea	query and write and read	commit	AA0000	4096	own pid	read write	success or wait	1	3002AAA7
\KnownDlls\MSIMG32.dll	write and read and execute	unknown	unknown	unknown	unknown	unknown	object name not found	1	30003601
C:\WINDOWS\system32\msimg32.dll	query and write and read and execute	image	76380000	20480	own pid	read write	success or wait	1	30003601
C:\Program Files\Common Files\Microsoft Shared\PROOF\1033\MSGR3EN.DLL	write and read and execute	commit	26D0000	3166208	own pid	execute	success or wait	1	301C8944
C:\Program Files\Common Files\Microsoft Shared\PROOF\1033\MSGR3EN.DLL	query and write and read and execute	image	3F100000	3166208	own pid	read write	success or wait	1	301C8944

Registry Activites

Key Path	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	success or wait	2	74497075	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery\32CCF	success or wait	1	3018E365	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications	success or wait	1	9D95BC	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp	success or wait	1	9D95BC	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#stockticker	success or wait	1	1408C8	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#date	success or wait	1	1408C8	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar	success or wait	1	3	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar	success or wait	1	3	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0	success or wait	1	3	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033	success or wait	1	3	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 0	success or wait	1	77DDEC0E	RegSetValueExA
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 1	success or wait	1	77DDEC0E	RegSetValueExA

Key Path	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	success or wait	2	1	unknown

Key Path	Key Value Name	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	'(	success or wait	1	307C3F7C	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	'	success or wait	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	+	success or wait	1	3018E1E0	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp	NoLabelOption	object name not found	1	9D95BC	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp	NoSaveOption	object name not found	1	9D95BC	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp	NoButtonOption	object name not found	1	9D95BC	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp	NoIndicatorOption	object name not found	1	9D95BC	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}	Status	success or wait	1	1408C8	unknown

Key Path	Name	Type	Data	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	'	binary	7F 27 03 00 84 03 00 00 01 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	74497075	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	'(	binary	27 28 03 00 84 03 00 00 04 00 00 00 00 00 00 00 BE 00 00 00 01 00 00 00 B6 00 00 00 57 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 41 00 70 00 70 00 6C 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20 00 44 00 61 00 74 00 61 00 5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 5C 00 54 00 65 00 6D 00 70 00 6C 00 61 00 74 00 65 00 73 00 5C 00 4E 00 6F 00 72 00 6D 00 61 00 6C 00 2E 00 64 00 6F 00 74 00 00 00 00 00 00 00	success or wait	1	303CE628	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	binary	03 00 00 00 27 00 00 00 7B 39 30 31 31 30 34 30 39 2D 36 30 30 30 2D 31 31 44 33 2D 38 43 46 45 2D 30 31 35 30 30 34 38 33 38 33 43 39 7D 00 56 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 4F 00 66 00 66 00 69 00 63 00 65 00 20 00 50 00 72 00 6F 00 66 00 65 00 73 00 73 00 69 00 6F 00 6E 00 61 00 6C 00 20 00 45 00 64 00 69 00 74 00 69 00 6F 00 6E 00 20 00 32 00 30 00 30 00 33 00 00 00	success or wait	1	30D014AB	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	+	binary	19 2B 03 00 84 03 00 00 06 00 00 00 01 00 00 00 66 00 00 00 02 00 00 00 56 00 00 00 04 00 00 00 63 00 3A 00 5C 00 64 00 6F 00 63 00 75 00 6D 00 65 00 7E 00 31 00 5C 00 61 00 64 00 6D 00 69 00 6E 00 69 00 7E 00 31 00 5C 00 6C 00 6F 00 63 00 61 00 6C 00 73 00 7E 00 31 00 5C 00 69 00 70 00 68 00 6F 00 6E 00 65 00 20 00 35 00 2E 00 64 00 6F 00 63 00 00 00 00 00 00 00	success or wait	1	3018D7E2	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery\32CCF	32CCF	binary	04 00 00 00 84 03 00 00 2A 00 00 00 43 00 3A 00 5C 00 44 00 4F 00 43 00 55 00 4D 00 45 00 7E 00 31 00 5C 00 41 00 44 00 4D 00 49 00 4E 00 49 00 7E 00 31 00 5C 00 4C 00 4F 00 43 00 41 00 4C 00 53 00 7E 00 31 00 5C 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 2E 00 64 00 6F 00 63 00 08 00 00 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 00 00 00 00 01 00 00 00 00 00 00 00 78 51 21 83 EA 69 CD 01 CF 2C 03 00 CF 2C 03 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	3018E365	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	dword	1	success or wait	1	690073	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp	FriendlyName	unicode	Microsoft Word 11.0	success or wait	1	9D95BC	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp	LabelText	binary	01 00 00 00	success or wait	1	9D95BC	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp	Save	binary	01 00 00 00	success or wait	1	9D95BC	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp	ShowButtons	binary	01 00 00 00	success or wait	1	9D95BC	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp	ShowIndicators	binary	01 00 00 00	success or wait	1	9D95BC	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#stockticker	OpusApp	dword	1	success or wait	1	1408C8	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#phone	OpusApp	dword	1	success or wait	1	1408C8	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#date	XLMAIN	dword	1	success or wait	1	1408C8	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag	migratedBitValues	binary	01 00 00 00	success or wait	1	30070AE5	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	dword	1089994753	success or wait	1	18	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033	Options Version	dword	1	success or wait	1	3	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 0	Name	unicode	Grammar & Style	success or wait	1	77DDEC0E	RegSetValueExA
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 0	Data	binary	01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 00 01 01 01 02 02 02	success or wait	1	77DDEC0E	RegSetValueExA
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 1	Name	unicode	Grammar Only	success or wait	1	77DDEC0E	RegSetValueExA
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 1	Data	binary	01 01 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 02	success or wait	1	77DDEC0E	RegSetValueExA

Key Path	Name	Type	Old Data	New Data	Completion	Count	Source Address	Symbol
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery\2A9B4	2A9B4	binary	04 00 00 00 88 04 00 00 44 00 00 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 2E 00 64 00 6F 00 63 00 10 00 00 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 00 00 00 00 01 00 00 00 00 00 00 00 C5 C4 CB 7C AB 7B CD 01 B4 A9 02 00 B4 A9 02 00 00 00 00 00 00 00 00 00 00 00 00 00	04 00 00 00 84 03 00 00 44 00 00 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 2E 00 64 00 6F 00 63 00 10 00 00 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 00 00 00 00 01 00 00 00 00 00 00 00 C5 C4 CB 7C AB 7B CD 01 B4 A9 02 00 B4 A9 02 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	310063CD	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	2055	unicode	Off	On	success or wait	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	2055	unicode	On	Off	success or wait	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	MTTT	binary	88 04 00 00 8C 88 76 79 EA 69 CD 01 00 00 00 00	88 04 00 00 8C 88 76 79 EA 69 CD 01 00 00 00 00 84 03 00 00 1C A7 E3 8F EA 69 CD 01 00 00 00 00	success or wait	1	3	ZwDeleteAtom
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery\2A9B4	2A9B4	binary	04 00 00 00 84 03 00 00 44 00 00 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 2E 00 64 00 6F 00 63 00 10 00 00 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 00 00 00 00 01 00 00 00 00 00 00 00 C5 C4 CB 7C AB 7B CD 01 B4 A9 02 00 B4 A9 02 00 00 00 00 00 00 00 00 00 00 00 00 00	04 00 00 00 84 03 00 00 44 00 00 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 2E 00 64 00 6F 00 63 00 10 00 00 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 00 00 00 00 01 00 00 00 00 00 00 00 C5 C4 CB 7C AB 7B CD 01 B4 A9 02 00 B4 A9 02 00 01 00 00 00 00 00 00 00 00 00 00 00	success or wait	1	3163DD60	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	WORDFiles	dword	1089994760	1089994761	success or wait	1	30CBE8B7	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	WordName	binary		4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 57 00 6F 00 72 00 64 00 00 00	success or wait	1	17AE38	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	ProductFiles	dword	1089994755	1089994756	success or wait	1	30002	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	dword	1089994753	1089994754	success or wait	1	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	dword	1089994754	1089994755	success or wait	1	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	dword	1089994755	1089994756	success or wait	1	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	dword	1089994756	1089994757	success or wait	1	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	dword	1089994757	1089994758	success or wait	1	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	dword	1089994758	1089994759	success or wait	1	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	dword	1089994759	1089994760	success or wait	1	2A3E	unknown

Key Value Queried

Key Path	Name	Completion	Count	Source Address	Symbol
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CWDIllegalInDLLSearch	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server	TSAppCompat	success or wait	3	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server	TSUserEnabled	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	LeakTrack	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	SafeDllSearchMode	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers	TransparentEnabled	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize	DisableMetaFiles	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows	AppInit_DLLs	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager	CriticalSectionTimeout	success or wait	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	RWLockResourceTimeOut	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableAllForOle32	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface	InterfaceHelperDisableTypeLib	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAll	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046}	InterfaceHelperDisableAllForOle32	object name not found	1	7C90E457	KiUserApcDispatcher
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	CommonFilesDir	success or wait	1	3000303D	RegQueryValueExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mso.dll	CheckAppHelp	success or wait	1	30003071	LoadLibraryW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility	DisableAppCompat	object name not found	1	30003071	LoadLibraryW
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	'	object name not found	1	74497075	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\General	InstalledOnWin2k	success or wait	1	220065	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	UserData	success or wait	1	220065	unknown
HKEY_USERS\Software\Microsoft\Office\Common	QMStrMax	object name not found	1	30CBAD8F	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	QMStudyID	object name not found	1	30CBB599	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	UserData	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\LanguageResources	SKULanguage	success or wait	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	InstallLanguage	success or wait	1	30CB0CC3	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	UILanguage	success or wait	1	30CB0CC3	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	HelpLanguage	success or wait	1	30CB0CC3	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	ExeMode	object name not found	1	30CB0CC3	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	WinXPLanguagePatch	success or wait	1	30CB0CC3	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	PreviousInstallLanguage	success or wait	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	WebLocale	success or wait	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	LangTuneUp	success or wait	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Shared	OfficeUILanguage	success or wait	2	30CBC948	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	InstallFonts	object name not found	1	FF909090	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	UILanguage	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	00000401	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	0000040D	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	0000041E	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	0000042A	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	00000439	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	00000420	success or wait	1	220065	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	00000429	success or wait	1	220065	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ASKFORPRINTERPICTURE	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	CACHESIZE	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	UserTemplates	object name not found	1	3000BBC8	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	AppData	success or wait	1	30CBDDB1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	Templates	success or wait	1	3000BBC8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc	MaxRpcSize	object name not found	1	130000	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\ThemeManager	Compositing	object name not found	1	1	unknown
HKEY_USERS\Control Panel\Desktop	LameButtonText	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Internet Explorer\Settings	Anchor Color	success or wait	1	30CC700B	unknown
HKEY_USERS\Software\Microsoft\Internet Explorer\Settings	Anchor Color Visited	success or wait	1	30CC700B	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoClearTypeNW	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	FontInfoCache	buffer overflow	3	240	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	FontInfoCache	success or wait	1	240	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	UseOfficeUIFont	object name not found	1	240	unknown
HKEY_USERS\Control Panel\International	iCountry	success or wait	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseNTWordDefPgSzBehavior	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseAlternateTOCDelimiter	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UpdateAllNumpages	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AlternateReplaceAllMethodBehaviour	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	WordPartialProtectDocTableResize	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FieldCalcSecurityLevel	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Wizards	PageSize	success or wait	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Control Panel\International	iMeasure	success or wait	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Control Panel\International	iTimePrefix	success or wait	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DOC-EXTENSION	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DOT-EXTENSION	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BAK-EXTENSION	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BitmapMemory	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	MessageBeeps	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	EnableSubDocPutSaved	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FavorWord97ListIndents	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DoNotConfirmConverterSecurity	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	WordRTFOutPathPref	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	CalcDataFieldOnOpen	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	SlowShading	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	HideFileNotSavedDlg	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NumberingGapUL	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AlternateRevisionStepThrough	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BlockDocCloseDuringCmdExec	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	EnsurePrintLongVertCell	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AlternativeLongTablesLayout	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BulletProofOnCorruption	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UpdateHeaderFooter	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	EnsureFlagsOfProtectedDocForVbaSel	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	RestoreXmlEvents	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseLocalBiDiStyle	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AlternateBreakThroughTab	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UpdateWwdVBAUponToggleXML	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	SpecialFieldsProtHandling	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	WriteUrlWithSubitemAsBinary	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ForceGrayscalePrint	object name not found	1	565308EC	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoSmartTagRecognition	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoSmartTagActions	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DefaultFormat	object name not found	1	300271B0	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BackgroundSave	object name not found	1	300271C0	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BackgroundOpen	object name not found	1	300271E2	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	BackgroundPrint	object name not found	1	300271F2	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	PlainTextAutoFormat	object name not found	1	30027202	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Outlook\Options\Calendar	Text Direction	success or wait	1	30027211	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Outlook\Options\Calendar	Text Direction	success or wait	1	30027211	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	NoTrack	object name not found	1	30027219	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	Bidi Spelling	object name not found	1	30027229	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AutoSpell	object name not found	1	30027238	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AutoGrammar	object name not found	1	30027253	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoLiveScrolling	object name not found	1	30027281	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoFontMRUList	object name not found	1	30CBDDB1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	InsertFloating	object name not found	1	3002731A	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoRecentDocsHistory	object name not found	1	300273E7	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	DisableScalingUpForHighDPI	object name not found	1	30029111	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	WordName	success or wait	1	12FFB0	unknown
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	30029E78	LoadLibraryW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	EnableBalloonTips	object name not found	1	30029E78	LoadLibraryW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared	CUAS	success or wait	1	30029D25	CreateWindowExW
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	30029D25	CreateWindowExW
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	30029D25	CreateWindowExW
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	30029D25	CreateWindowExW
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	30029D25	CreateWindowExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF	EnableAnchorContext	object name not found	1	30029D25	CreateWindowExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM	Ime File	success or wait	1	30029D25	CreateWindowExW
HKEY_USERS\Software\Microsoft\CTF	Disable Thread Input Manager	object name not found	1	30029D25	CreateWindowExW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared	CUAS	success or wait	1	30029D25	CreateWindowExW
HKEY_USERS\Software\Microsoft\Office\11.0\Common	ScreenReaderPresent	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	UseAlternateShowUIMethodForFtpSession	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	MaxCachedStreamSize	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	ShowOtherTablesInDataSrc	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	HypAlternateResolveToRel	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	RepairSmartTags	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	AddressBookNameMax4096	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	ShowDispNameInToolTip	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	AllowConsecutiveSlashesInUrlPathComponent	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	UseCaseInsensitivePathForHyperlink	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	LastUILang	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	LastUILang	object name not found	1	565308EC	unknown
HKEY_USERS\Software\Microsoft\Shared	OfficeUILanguage	success or wait	2	565308EC	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	AcbControl	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	AcbOn	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	CurrentProvider	success or wait	1	7C90F668	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	MaxWords	object name not found	1	7C90F668	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	MaxWordsJapan	object name not found	1	7C90F668	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	UseOnline	object name not found	1	7C90F668	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	PreferOffline	object name not found	1	7C90F668	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	PreferOffline	object name not found	1	90909090	RegOpenKeyExW
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation	UseMT	object name not found	1	7C90F668	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	RestrictRun	object name not found	1	30CCCBEE	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	Sound	object name not found	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	MTTT	success or wait	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	MTTT	success or wait	2	3	ZwDeleteAtom
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	5C16D44	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	30CDC2A5	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC2A5	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	ProInfo	success or wait	1	30CDDE95	unknown
HKEY_USERS\Control Panel\International	NumShape	success or wait	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\UserInfo	UserInfo	buffer overflow	3	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\UserInfo	UserInfo	success or wait	1	1	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows	Device	success or wait	1	3002B963	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices	Microsoft XPS Document Writer	success or wait	1	3002B963	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	ScreenReaderPresent	object name not found	1	1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Messaging Subsystem	MAPIX	object name not found	2	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoRereg	object name not found	1	3002D9A9	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32	NULL	success or wait	1	30CBDDB1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document\CurVer	NULL	success or wait	1	30CBDDB1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	GlobalDotName	object name not found	1	3163DD60	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	3163DD60	unknown
HKEY_USERS\Control Panel\Desktop	SmoothScroll	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ScriptAnchorVis	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools	FormatConsistencyWavyUnderlineColor	object name not found	1	3163DD60	unknown
HKEY_USERS\Control Panel\International	NumShape	success or wait	1	616D	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	GlobalDotName	object name not found	1	30CBDDB1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	'(	object name not found	1	303CE628	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Cache	success or wait	1	D800D8	unknown
HKEY_USERS\Software\Microsoft\CTF	Disable Thread Input Manager	object name not found	1	7C90F661	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000409\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}	Enable	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000807\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}	Enable	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}	Enable	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale	00000409	success or wait	1	16FED0	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups	1	success or wait	94	16FED0	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC19F	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	30CDC2A5	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC2A5	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	ProInfo	success or wait	1	30CDDE95	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail	NULL	success or wait	1	30CBDDB1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Outlook Express\Envelope\CLSID	NULL	success or wait	1	30D048F1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC19F	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	30CDC2A5	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC2A5	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	ProInfo	success or wait	1	30CDDE95	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseAlternateForegroundWindowDetectionMethod	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseSpaceAsTextDelimiter	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AlternateTableHeightLayout	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AdjustSdtCaSmart	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	MMDataSrcHeuristic	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DontJumpForegroundInDDEExec	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DisableODSOUIInDataSrc	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseTempCopyForNonLocDoc	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	KeepUISpecModeAtVbaEnd	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UseAlternatePageNumberFormat	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DontUpdateSmartDocAtInsert	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ShowFileNameOnlyInIconCaption	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	AlternateStyleCopyPasteNoOverwrite	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DontShowDocActionsPaneAtOpen	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FastTableRenderOnIMETS	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	MntrSynchronize1stTabCell	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoLinkBltinCharStyles	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoDocChangeEventOnStoryRange	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	TreatLocationReferenceAsLocal	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ForceSetCopyCount	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ListDefaultDictForAllLanFirst	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	MailMergeFastSetPrintOrient	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	SuppressPrinterIconEnum	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	NoActivateOleLinkObjAtOpen	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	CheckDupAddin4ShellLoad	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	CleanupOldHyphBeforeHyphenate	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	KeepDocActPaneWhileInReviewPane	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FireSelChangeEventInTableCell	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	UpdateHdrFtrOnVBAFldUpdate	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	ForceUpdateToolbarAtInit	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	AddIns	success or wait	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\Word\Addins\WebPage.Connect	LoadBehavior	success or wait	1	30CE4063	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	Com+Enabled	success or wait	1	12E854	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	MinimumFreeMemPercentageToCreateProcess	object name not found	1	12E854	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	MinimumFreeMemPercentageToCreateObject	object name not found	1	12E854	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	Com+Enabled	success or wait	1	12E854	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	12E854	unknown
HKEY_USERS\Software\Microsoft\Office\Word\Addins\WebPage.Connect	FileName	object name not found	1	630069	unknown
HKEY_USERS\Software\Microsoft\Office\Word\Addins\WordEEFonts.Connect	LoadBehavior	success or wait	1	30CE4063	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3	REGDBVersion	success or wait	1	12E854	unknown
HKEY_USERS\Software\Microsoft\Office\Word\Addins\WordEEFonts.Connect	FileName	object name not found	1	630069	unknown
HKEY_USERS\Software\Microsoft\CTF	Disable Thread Input Manager	object name not found	1	7C90F661	RtlNtStatusToDosError
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d}	Enable	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000409\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}	Enable	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000807\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}	Enable	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB}	Enable	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	QuickPreview	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Local AppData	success or wait	1	1	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	STARTUP-PATH	object name not found	1	12DF58	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	Startup	success or wait	1	440020	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	VolumePref	object name not found	1	3163DD60	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FirstRun	success or wait	1	220065	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\UserInfo	UserName	success or wait	1	30AA1BC4	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\UserInfo	UserInitials	success or wait	1	30AA1BC4	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\UserInfo	Company	success or wait	1	30AA1BC4	unknown
HKEY_USERS\Software\Microsoft\Office\Common	QMEnable	success or wait	1	220065	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	DisableFontLinking	object name not found	1	30CC80D9	unknown
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	3006A390	DispatchMessageA
HKEY_USERS\Keyboard Layout\Toggle	Language Hotkey	success or wait	1	3006A390	DispatchMessageA
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	3006A390	DispatchMessageA
HKEY_USERS\Keyboard Layout\Toggle	Layout Hotkey	success or wait	1	3006A390	DispatchMessageA
HKEY_USERS\Software\Microsoft\Internet Explorer\Settings	Anchor Color	success or wait	1	30CC700B	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC19F	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	30CDC2A5	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	30CDC2A5	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	ProInfo	success or wait	1	30CDDE95	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	DelayLV	object name not found	1	30D285D6	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet	DoNotCheckIfOfficeIsHTMLEditor	object name not found	1	17A308	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.htm		success or wait	1	17A308	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command		success or wait	1	17A308	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command		success or wait	1	73006D	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\11		success or wait	4	5C0065	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mht		success or wait	1	73006D	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command		success or wait	1	73006D	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command		success or wait	1	73006D	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	8458BEC	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	8458BEC	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer	DisableUserInstalls	object name not found	1	30CBD8D8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer	Debug	object name not found	1	30CBD8D8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\InstallProperties	WindowsInstaller	success or wait	1	30CBD8D8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9}	DigitalProductID	buffer overflow	5	30CBD6F1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9}	DigitalProductID	success or wait	5	30CBD6F1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\InstallProperties	WindowsInstaller	success or wait	1	30CBD8D8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	WORDFiles	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	WORDFiles	buffer overflow	4	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	WORDFiles	success or wait	2	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C	9040110900063D11C8EF10054038389C	success or wait	2	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A453DD12EE71CEF49A4EB2A8684FB83A	9040110900063D11C8EF10054038389C	success or wait	2	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5861C19D5F3D8C8439408F306F31034A	9040110900063D11C8EF10054038389C	success or wait	2	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\311714883E93F274A838DDB012991F9D	9040110900063D11C8EF10054038389C	success or wait	2	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72E940125B15C02498F17C8F91EADC14	9040110900063D11C8EF10054038389C	success or wait	2	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16EFE5D0815A2D11A92E0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	2	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41AE703BF87339947BDCC4715F97EFED	9040110900063D11C8EF10054038389C	success or wait	2	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProductFiles	buffer overflow	22	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProductFiles	success or wait	11	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687	9040110900063D11C8EF10054038389C	success or wait	11	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10	9040110900063D11C8EF10054038389C	buffer overflow	11	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10	9040110900063D11C8EF10054038389C	success or wait	11	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662	9040110900063D11C8EF10054038389C	success or wait	11	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357	9040110900063D11C8EF10054038389C	success or wait	11	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA	9040110900063D11C8EF10054038389C	buffer overflow	11	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA	9040110900063D11C8EF10054038389C	success or wait	11	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382	9040110900063D11C8EF10054038389C	success or wait	11	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C	9040110900063D11C8EF10054038389C	success or wait	11	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2	9040110900063D11C8EF10054038389C	success or wait	2	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213	9040110900063D11C8EF10054038389C	success or wait	11	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	WORDFiles	success or wait	1	30CBE8B7	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\General	Data	success or wait	1	30CBDDB1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	740073	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	740073	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	WORDFiles	success or wait	1	30CD908B	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	1	30CD908B	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	1	30CD908B	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	30CD908B	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	1	30CD908B	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	1	30CD908B	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\9040110900063D11C8EF10054038389C	ProductName	success or wait	1	30CE0FD1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\General	AuditMode	object name not found	1	64002E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\General	AuditMode	object name not found	1	13C0AD2	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	30D013E2	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\InstallProperties	WindowsInstaller	success or wait	1	500020	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9}	WordName	success or wait	1	30D021E4	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	WordName	success or wait	1	30CBC340	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	WordName	success or wait	1	17AE38	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word	WordName	success or wait	1	500020	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	Viewer	object name not found	1	13D0212	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	Authorized	success or wait	1	30D285D6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9}	EULADis	success or wait	1	30D285D6	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	300CE56E	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	NoTrack	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoNetHood	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoNetHood	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoPropertiesMyComputer	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoPropertiesMyComputer	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoInternetIcon	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoInternetIcon	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoCommonGroups	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoCommonGroups	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Desktop	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoControlPanel	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoControlPanel	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoSetFolders	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoSetFolders	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32	NULL	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemSetupInProgress	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SYSTEM\WPA\PnP	seed	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	OsLoaderPath	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	OsLoaderPath	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemPartition	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SYSTEM\Setup	SystemPartition	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	SourcePath	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	SourcePath	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackSourcePath	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackSourcePath	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackCachePath	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	ServicePackCachePath	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	DriverCachePath	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	DriverCachePath	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	DevicePath	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogLevel	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogLevel	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup	LogPath	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Hostname	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters	Domain	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f}	Data	buffer overflow	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f}	Data	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f}	Generation	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Data	buffer overflow	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Data	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	DontShowSuperHidden	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	DontShowSuperHidden	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer	ShellState	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer	ShellState	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	ForceActiveDesktopOn	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	ForceActiveDesktopOn	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoActiveDesktop	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoActiveDesktop	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoWebView	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoWebView	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	ClassicShell	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	ClassicShell	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	SeparateProcess	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	SeparateProcess	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoNetCrawling	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoNetCrawling	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoSimpleStartMenu	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoSimpleStartMenu	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	Hidden	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	ShowCompColor	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	DontPrettyPath	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	ShowInfoTip	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideIcons	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	MapNetDrvBtn	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	WebView	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	Filter	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	ShowSuperHidden	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	SeparateProcess	success or wait	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	NoNetCrawling	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	DocObject	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	BrowseInPlace	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	IsShortcut	object name not found	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	AlwaysShowExt	success or wait	1	FFFF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory	NeverShowExt	object name not found	1	FFFF	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	30CFC0DA	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	30CFC0DA	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	AllowFileCLSIDJunctions	object name not found	1	30CFC0DA	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	AllowFileCLSIDJunctions	object name not found	1	30CFC0DA	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	+	object name not found	1	3018D7E2	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	300CE56E	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools	SpellingWavyUnderlineColor	object name not found	1	3018DB1A	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools	GrammarWavyUnderlineColor	object name not found	1	3018DB1A	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	NoTrack	object name not found	1	3018DB1A	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	MaxPropsStreamSize	object name not found	1	3018DB1A	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Recent	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	ChkAccDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions	ProductType	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Personal	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Local Settings	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	RsopDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	RsopLogging	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	UserEnvDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	RsopLogging	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon	UserEnvDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System	UserEnvDebugLevel	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	ProfileImagePath	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dot	Progid	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dot	Application	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dot	NULL	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dot	PerceivedType	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8	DocObject	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot	DocObject	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8	BrowseInPlace	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot	BrowseInPlace	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8\CLSID	NULL	success or wait	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8	IsShortcut	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot	IsShortcut	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8	AlwaysShowExt	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot	AlwaysShowExt	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8	NeverShowExt	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot	NeverShowExt	object name not found	1	3004F1C1	SHGetFileInfoW
HKEY_USERS\Software\Microsoft\Office\11.0\Common\ReviewCycle	ReviewToken	success or wait	1	124020	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	DoNotDismissFileNewTaskPane	object name not found	1	30D2DF29	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet	PixelsPerInch	object name not found	1	500F0	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet	PixelsPerInch	object name not found	1	500F0	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	300CE56E	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	300CE56E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	MaximumAllowedAllocationSize	object name not found	1	301A93C3	CreateFileMoniker
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole	DefaultAccessPermission	object name not found	1	6014A	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	6014A	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced	HideFileExt	success or wait	1	300CE56E	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Outlook\Security	OutlookSecureTempFolder	object name not found	1	3018E3D7	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag	DisableDocumentAssemblies	object name not found	1	3018D48A	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	object name not found	1	1CD69EA	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot	InstallCount	success or wait	1	30CDC2A5	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	buffer overflow	2	30CDC2A5	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing	1EBDE4BC9A514630B5412561FA45CCC5	success or wait	1	30CDC2A5	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BDAB17EF6C1EC5848A53E114D327F3CA	9040110900063D11C8EF10054038389C	success or wait	2	690073	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	ProInfo	success or wait	1	690073	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	NoTTP	object name not found	1	300034A2	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet	UseOnlineContent	success or wait	1	300034A2	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	success or wait	1	12E954	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoRecentDocsHistory	object name not found	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	RecentFiles	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	UseDesktopIniCache	object name not found	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	UseDesktopIniCache	object name not found	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Recent	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	ProfileImagePath	success or wait	2	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc	Progid	object name not found	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc	Application	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc	NULL	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc	PerceivedType	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8	DocObject	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc	DocObject	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8	BrowseInPlace	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc	BrowseInPlace	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\CLSID	NULL	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8	IsShortcut	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc	IsShortcut	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8	AlwaysShowExt	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc	AlwaysShowExt	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8	NeverShowExt	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc	NeverShowExt	object name not found	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Recent	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	ProfileImagePath	success or wait	2	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	2	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Network\SharingHandler	NULL	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions	ProductType	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\DefaultSecurity	SrvsvcDefaultShareInfo	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	2	6C0069	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	CompareJunctionness	object name not found	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	CompareJunctionness	object name not found	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Start Menu	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Common Start Menu	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Common Desktop	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Common AppData	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	AppData	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	My Pictures	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Personal	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	ProgramFilesDir (x86)	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	ProgramFilesDir	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	CommonPictures	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList	ProfilesDirectory	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList	AllUsersProfile	success or wait	2	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	3	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Common Documents	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\InProcServer32	NULL	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer	NoSharedDocuments	object name not found	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoSharedDocuments	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	CommonMusic	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList	ProfilesDirectory	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList	AllUsersProfile	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	CommonVideo	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList	ProfilesDirectory	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	2	6C0069	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	RecentFiles	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoRecentDocsHistory	object name not found	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	RecentFiles	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Recent	object name not found	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f}	Generation	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Recent	object name not found	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Fonts	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Network\SharingHandler	NULL	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Recent	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500	ProfileImagePath	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\DefaultSecurity	SrvsvcDefaultShareInfo	object name not found	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName	ComputerName	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	6C0069	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9}	DriveMask	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	RecentFiles	success or wait	1	6C0069	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Wizards	Assistant Time Stamp	object name not found	1	131483C	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Assistant	AsstState	object name not found	1	131483C	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common	ScreenReaderPresent	object name not found	1	131483C	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9B92EB61-CBC1-11D3-8C2D-00A0CC37B591}\1.2\0\win32	NULL	buffer overflow	1	780000	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9B92EB61-CBC1-11D3-8C2D-00A0CC37B591}\1.2\0\win32	NULL	success or wait	1	780000	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag	migratedBitValues	object name not found	1	30070AE5	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}	Status	success or wait	1	1408C8	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}	Status	object name not found	1	1408C8	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A}	Status	object name not found	1	C	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A}	Status	object name not found	1	C	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}	Status	object name not found	1	C	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}	Status	object name not found	1	C	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F}	Status	object name not found	1	C	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD}	Status	object name not found	1	C	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A}	Managed	object name not found	1	7D0041	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A}	Managed	object name not found	1	7D0041	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{339361CD-6723-455D-A40B-C95F1F91FF8A}\InprocServer32		success or wait	1	7D0041	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{339361CD-6723-455D-A40B-C95F1F91FF8A}\InprocServer32		success or wait	1	7D0041	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A}	OpusApp	object name not found	1	7D0041	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A}	defaultStatus	object name not found	1	7D0041	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A}	Solution	object name not found	1	7D0041	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}	Managed	object name not found	1	7D0044	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}\InprocServer32		success or wait	1	7D0044	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}\InprocServer32		success or wait	1	7D0044	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}	OpusApp	object name not found	1	7D0044	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}	defaultStatus	object name not found	1	7D0044	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}	Solution	object name not found	1	7D0044	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}	Managed	object name not found	1	7D0036	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\InprocServer32		success or wait	1	7D0036	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\InprocServer32		success or wait	1	7D0036	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}	OpusApp	object name not found	1	7D0036	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}	defaultStatus	object name not found	1	7D0036	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}	Solution	object name not found	1	7D0036	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F}	Managed	object name not found	1	7D0046	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3754D1A-04D3-4085-8CFB-97705B57A98F}\InprocServer32		success or wait	1	7D0046	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3754D1A-04D3-4085-8CFB-97705B57A98F}\InprocServer32		success or wait	1	7D0046	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F}	OpusApp	object name not found	1	7D0046	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F}	defaultStatus	object name not found	1	7D0046	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F}	Solution	object name not found	1	7D0046	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD}	Managed	object name not found	1	7D0044	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F114AE61-1331-4238-92C9-BBE330AF25FD}\InprocServer32		success or wait	1	7D0044	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F114AE61-1331-4238-92C9-BBE330AF25FD}\InprocServer32		success or wait	1	7D0044	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD}	OpusApp	object name not found	1	7D0044	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD}	defaultStatus	object name not found	1	7D0044	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD}	Solution	object name not found	1	7D0044	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}	Managed	object name not found	1	7D0036	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\InprocServer32		success or wait	1	7D0036	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\InprocServer32		success or wait	1	7D0036	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}	OpusApp	success or wait	1	7D0036	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}	Solution	object name not found	1	7D0036	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}	Managed	object name not found	1	7D0038	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}\InprocServer32		success or wait	1	7D0038	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}\InprocServer32		success or wait	1	7D0038	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}	OpusApp	object name not found	1	7D0038	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}	defaultStatus	object name not found	1	7D0038	unknown
HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}	Solution	object name not found	1	7D0038	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CF607698-2145-4FF6-9175-719D9CA8898C}\2.0\0\win32	NULL	success or wait	2	30D5D887	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32	NULL	success or wait	1	30D5D887	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687	9040110900063D11C8EF10054038389C	success or wait	1	30002	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	1	30002	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	1	30002	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	1	30002	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	1	30002	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	1	30002	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2	9040110900063D11C8EF10054038389C	success or wait	9	30002	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	ProductFiles	success or wait	1	30002	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	TOOLS-PATH	object name not found	1	3000BBC8	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	Proof	success or wait	1	30CC84C3	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools Location	proof	object name not found	1	30CBDDB1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	CommonFilesDir	success or wait	1	30CBDDB1	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	2	21CC4A8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A	9\Normal	object name not found	6	30CB062A	unknown
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups	5	success or wait	14	30177B8A	EnumSystemLocalesA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups	2	success or wait	12	30177B8A	EnumSystemLocalesA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups	4	success or wait	1	30177B8A	EnumSystemLocalesA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups	6	success or wait	3	30177B8A	EnumSystemLocalesA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups	3	success or wait	3	30177B8A	EnumSystemLocalesA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups	d	success or wait	1	30177B8A	EnumSystemLocalesA
HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups	f	success or wait	3	30177B8A	EnumSystemLocalesA
HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources	ShowDates	success or wait	1	613	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	FixReadabilityStatistics	object name not found	1	740830AF	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A	1033\Normal	buffer overflow	2	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A	1033\Normal	success or wait	2	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	SpellingAndGrammarFiles_1033	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	SpellingAndGrammarFiles_1033	buffer overflow	16	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	SpellingAndGrammarFiles_1033	success or wait	8	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\122BC46DF1D81D118A6000AA00740998	9040110900063D11C8EF10054038389C	success or wait	8	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69	9040110900063D11C8EF10054038389C	success or wait	8	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020	9040110900063D11C8EF10054038389C	buffer overflow	10	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020	9040110900063D11C8EF10054038389C	success or wait	10	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BE92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	8	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13608793E82C1D11FB5B000A9CF0828A	9040110900063D11C8EF10054038389C	success or wait	8	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3BE92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	10	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProofingToolsFiles_1033	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProofingToolsFiles_1033	success or wait	8	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProofingToolsFiles_1033	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	8	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProofingParent	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProofingParent	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProofingParent	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	SHAREDFiles	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	SHAREDFiles	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	SHAREDFiles	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	4	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	object name not found	1	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	success or wait	1	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\D3BE92CC2CB71D119A12000A9CE1A22A	1033\Normal	buffer overflow	2	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\D3BE92CC2CB71D119A12000A9CE1A22A	1033\Normal	success or wait	2	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BE92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	2	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	success or wait	1	18	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	success or wait	1	18	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries	1	success or wait	1	410041	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	Proof	success or wait	1	410041	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries	2	object name not found	1	410041	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries	3	object name not found	1	410041	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries	4	object name not found	1	410041	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries	5	object name not found	1	410041	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries	6	object name not found	1	410041	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries	7	object name not found	1	410041	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries	8	object name not found	1	410041	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries	9	object name not found	1	410041	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries	10	object name not found	1	410041	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	Proof	success or wait	1	4C2FF	RtlNtStatusToDosError
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	Proof	success or wait	1	9C0288	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A	1033\9	object name not found	2	30CB062A	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A	9\9	object name not found	2	30CB062A	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A	1033\9	object name not found	2	30CBE388	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A	1036\9	object name not found	4	30CBE388	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A	2057\9	object name not found	4	30CBE388	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A	3081\9	object name not found	4	30CBE388	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A	3082\9	object name not found	4	30CBE388	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A	3084\9	object name not found	4	30CBE388	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A	4105\9	object name not found	4	30CBE388	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A	1033\9	object name not found	4	30CB062A	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	success or wait	1	12E654	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A	1033\1033	buffer overflow	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A	1033\1033	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	SpellingAndGrammarFiles_1033	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProofingToolsFiles_1033	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProofingToolsFiles_1033	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProofingParent	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProofingParent	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProofingParent	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	SHAREDFiles	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	SHAREDFiles	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	SHAREDFiles	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	2	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	success or wait	1	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	success or wait	1	8	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\C18EB3B85D045C14AA95785DC1D767B1	1033	buffer overflow	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\C18EB3B85D045C14AA95785DC1D767B1	1033	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	SpellingAndGrammarFiles_1033	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProofingToolsFiles_1033	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProofingToolsFiles_1033	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProofingParent	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProofingParent	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	ProofingParent	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	SHAREDFiles	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	SHAREDFiles	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features	SHAREDFiles	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C	ProductFiles	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A	9040110900063D11C8EF10054038389C	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25	9040110900063D11C8EF10054038389C	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0	9040110900063D11C8EF10054038389C	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492	9040110900063D11C8EF10054038389C	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69	9040110900063D11C8EF10054038389C	success or wait	2	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	success or wait	1	2A3E	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage	SpellingAndGrammarFiles_1033	success or wait	1	2A3E	unknown
HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033	Options Version	object name not found	1	3	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite	1EBDE4BC9A514630B5412561FA45CCC5	success or wait	1	12E954	unknown
HKEY_USERS\Software\Microsoft\CTF	Disable Thread Input Manager	object name not found	1	1050	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared	CUAS	success or wait	1	1050	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options	DOC-PATH	object name not found	1	1050	unknown
HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders	Personal	success or wait	1	30CBDDB1	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows	Device	success or wait	1	30CFAD48	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices	Microsoft XPS Document Writer	success or wait	1	7E42E442	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows	Device	success or wait	1	7E42E442	unknown
HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices	Microsoft XPS Document Writer	success or wait	1	7E42E442	unknown
HKEY_USERS\Software\Microsoft\Office\Common	QMEnable	success or wait	1	30D285D6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	LastProduct	success or wait	1	132	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9}	InstallType	success or wait	1	132	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9}	SourceType	success or wait	1	132	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9}	Upgrade	success or wait	1	132	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9}	OODS	success or wait	1	132	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9}	Location	success or wait	1	132	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9}	PIDKEY	success or wait	1	132	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9}	LocalCache	success or wait	1	132	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Excel\InstallRoot	Path	success or wait	1	132	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\PowerPoint\InstallRoot	Path	success or wait	1	132	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Word\InstallRoot	Path	success or wait	1	132	unknown
HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	~MHz	success or wait	1	30D285D6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate	BytesPerSec	object name not found	1	30D285D6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer	Build	success or wait	1	30D285D6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer	Version	success or wait	1	30D285D6	unknown
HKEY_USERS\Software\Microsoft\Office\Common	QMEnable	success or wait	1	4A004A	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.htm	NULL	success or wait	1	30D285D6	unknown
HKEY_USERS\Software\Microsoft\Office\Common	QMInternalUID	object name not found	1	30D285D6	unknown
HKEY_USERS\Control Panel\International\Geo	Nation	success or wait	1	30D285D6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion	CommonFilesDir	success or wait	1	30D0C43E	unknown
HKEY_USERS\Software\Microsoft\Office\Common	QmIMID	object name not found	1	30D285D6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MessengerService	InstallationDirectory	success or wait	1	30D3D2A6	unknown
HKEY_USERS\Software\Microsoft\Office\11.0\Common\General	CustomizableAlertBaseURL	object name not found	1	30D285D6	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9}	ProductID	success or wait	1	440031	unknown
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion	ProInfo	success or wait	1	32002D	unknown

Mutex Activites

Name	Completion	Count	Source Address	Symbol
\BaseNamedObjects\Local\Mutex_MSOSharedMem	success or wait	1	3163BFAC	unknown
\BaseNamedObjects\Local\Mso97SharedDg19211108172Mutex	success or wait	1	12F2F4	unknown
\BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	30029D25	CreateWindowExW
\BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	30029D25	CreateWindowExW
\BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	30029D25	CreateWindowExW
\BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	30029D25	CreateWindowExW
\BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	30029D25	CreateWindowExW
\BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500MUTEX.DefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	1	30029D25	CreateWindowExW
\BaseNamedObjects\Local\Mso97SharedDg20321108172Mutex	success or wait	1	30CC1FFC	unknown
\BaseNamedObjects\MSCTF.Shared.MUTEX.MNH	object name exists	1	3006A390	DispatchMessageA
\BaseNamedObjects\Local\Mso97SharedDg19521108172Mutex	success or wait	1	FF8B9090	unknown
\BaseNamedObjects\Local\Mso97SharedDg19531108172Mutex	success or wait	1	30CC1FFC	unknown
unknown	success or wait	3	FFFF	unknown
\BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-507921405-1960408961-839522115-500	success or wait	1	30E5AE51	unknown
\BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-507921405-1960408961-839522115-500	success or wait	1	4D005C	unknown
\BaseNamedObjects\OfficeAssistantStateMutex	success or wait	1	131483C	unknown
\BaseNamedObjects\oleacc-msaa-loaded	success or wait	1	30D5D887	unknown

Process Activites

Process Queried

PID	Process info class	Completion	Count	Source Address	Symbol
900	Cookie	success or wait	1096	7C90E457	KiUserApcDispatcher
900	ImageInformation	success or wait	1	7C90E457	KiUserApcDispatcher
900	DefaultHardErrorMode	success or wait	229	8C2C95B	NlsAnsiCodePage
1160	BasicInformation	success or wait	1	167F70	unknown
900	Times	success or wait	5	30CBAD74	unknown
900	QuotaLimits	success or wait	10	30007F87	GlobalMemoryStatusEx
900	VmCounters	success or wait	10	30007F87	GlobalMemoryStatusEx
900	DeviceMap	success or wait	140	3000C508	GetDriveTypeW
900	Wow64Information	success or wait	107	30029D25	CreateWindowExW
1160	Times	success or wait	1	1	unknown
900	SessionInformation	success or wait	1	3163DD60	unknown

Thread Activites

Thread Created

TID	PID	EIP	EAX (Usermode EIP)	Filepath	Completion	Count	Source Address	Symbol
1332	900	7C8106F9	77E76C7D	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	6014A	unknown
1608	900	7C8106F9	774FE4DF	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	6014A	unknown
1556	900	7C8106F9	30D5CF6C	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	30D5BD8D	unknown
1328	900	7C8106F9	30072A95	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	30072974	CreateThread
1780	900	7C8106F9	30072A95	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	30072974	CreateThread
180	900	7C8106F9	77E76C7D	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	7C80B729	unknown

Thread Execution Resumed

TID	PID	Path	Completion	Count	Source Address	Symbol
1332	900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	6014A	unknown
1608	900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	6014A	unknown
1556	900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	30D5BD8D	unknown
1328	900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	30072996	ResumeThread
1780	900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	30072996	ResumeThread
180	900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	1	7C80B729	unknown

TID	Delay	Completion	Count	Source Address	Symbol
1608	-60s	success or wait	1	7C80B729	unknown

TID	PID	Completion	Count	Source Address	Symbol
1328	900	unknown	1	7C80B72F	unknown
1780	900	unknown	1	7C80B72F	unknown

Memory Activites

PID	Filepath	Base	Length	Value	Completion	Count	Source Address	Symbol
1160	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7FFD8008	4	00 00 00 00	process is terminating	1	167F70	unknown

PID	Filepath	Base	Length	Protection	Completion	Count	Source Address	Symbol
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	140000	12FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	140000	12FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	141000	12F7F4	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	240000	12FB14	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	240000	12FB18	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	250000	12F340	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	143000	12F21C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	251000	12F168	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	144000	12F894	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	840000	12F91C	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	840000	12F920	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	841000	12F5FC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	843000	12F6A0	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	166000	12F5BC	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	167000	12E640	page read and write	success or wait	1	30003071	LoadLibraryW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	880000	12F8B8	page no access	success or wait	1	1475FFEC	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	880000	12F8B8	page read and write	success or wait	1	1475FFEC	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	890000	12F864	page no access	success or wait	1	30CB0865	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	890000	12F864	page read and write	success or wait	1	30CB088C	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	168000	12F424	page read and write	success or wait	1	31466373	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8A0000	12F8CC	page no access	success or wait	1	30CB0865	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8A0000	12F8CC	page read and write	success or wait	1	30CB088C	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8A1000	12F85C	page read and write	success or wait	1	3FFE1000	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8B0000	12F888	page no access	success or wait	1	30CBBA65	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8B0000	12F888	page read and write	success or wait	1	30CBBA7A	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8C0000	12F810	page no access	success or wait	1	30CB0865	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8C0000	12F810	page read and write	success or wait	1	30CB088C	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	990000	12F45C	page read and write	success or wait	1	30007B07	AddAtomA
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	990000	12F458	page read and write	success or wait	1	30007B07	AddAtomA
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9B0000	12F164	page no access	success or wait	1	30CB0865	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9B0000	12F164	page read and write	success or wait	1	30CB088C	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8C1000	12F114	page read and write	success or wait	1	3FFD1000	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8C2000	12F0DC	page read and write	success or wait	1	3FFD2000	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8C3000	12F084	page read and write	success or wait	1	3FFD3000	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8C4000	12F0C4	page read and write	success or wait	1	3FFD4000	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9C0000	12F110	page no access	success or wait	1	30CBBA65	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9C0000	12F110	page read and write	success or wait	1	30CBBA7A	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9D0000	12F114	page no access	success or wait	1	30CB0865	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9D0000	12F114	page read and write	success or wait	1	30CB088C	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9E0000	12F258	page no access	success or wait	1	30CBBA65	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9E0000	12F258	page read and write	success or wait	1	30CBBA7A	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9D1000	12F0F8	page read and write	success or wait	1	3FFB1000	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	A00000	12F258	page no access	success or wait	1	30CBBA65	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	A00000	12F258	page read and write	success or wait	1	30CBBA7A	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9D2000	12F208	page read and write	success or wait	1	3FFB2000	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	9D3000	12EC38	page read and write	success or wait	1	3FFB3000	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8C5000	12EC98	page read and write	success or wait	1	3FFD5000	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	A10000	12B1A0	page no access	success or wait	1	30CB0865	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	A10000	12B1A0	page read and write	success or wait	1	30CB088C	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	8C6000	127988	page read and write	success or wait	1	3FFD6000	unknown

Memory Protection Changed

PID	Filepath	Base	Length	New Protection	Old Protection	Completion	Count	Source Address	Symbol
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7C801000	1000	page read and write	page execute read	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7C801000	1000	page execute read	page read and write	success or wait	1	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77DD1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77DD1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77E71000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77E71000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77FE1000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77FE1000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30001000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30001000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77F11000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77F11000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7E411000	1000	page read and write	page execute read	success or wait	3	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7E411000	1000	page execute read	page read and write	success or wait	3	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	774E1000	1000	page read and write	page execute read	success or wait	7	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	774E1000	1000	page execute read	page read and write	success or wait	7	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77C11000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77C11000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77C01000	1000	page read and write	page execute read	success or wait	2	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77C01000	1000	page execute read	page read and write	success or wait	2	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	76391000	1000	page read and write	page execute read	success or wait	4	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	76391000	1000	page execute read	page read and write	success or wait	4	7C90E457	KiUserApcDispatcher
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30B81000	1000	page readonly	page read and write	success or wait	1	30001C81	VirtualProtect
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30C91000	1000	page read and write	page execute read	success or wait	7	30003071	LoadLibraryW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	30C91000	1000	page execute read	page read and write	success or wait	7	30003071	LoadLibraryW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	3165E000	1000	page readonly	page read and write	success or wait	1	30003071	LoadLibraryW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	76BF1000	1000	page read and write	page execute read	success or wait	2	167F70	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	76BF1000	1000	page execute read	page read and write	success or wait	2	167F70	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	5AD71000	1000	page read and write	page execute read	success or wait	5	1	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	5AD71000	1000	page execute read	page read and write	success or wait	5	1	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	773D1000	1000	page read and write	page execute read	success or wait	7	30029E78	LoadLibraryW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	773D1000	1000	page execute read	page read and write	success or wait	7	30029E78	LoadLibraryW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77F61000	1000	page read and write	page execute read	success or wait	5	30029E78	LoadLibraryW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77F61000	1000	page execute read	page read and write	success or wait	5	30029E78	LoadLibraryW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	74721000	1000	page read and write	page execute read	success or wait	5	30029D25	CreateWindowExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	74721000	1000	page execute read	page read and write	success or wait	5	30029D25	CreateWindowExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	755C1000	1000	page read and write	page execute read	success or wait	6	30029D25	CreateWindowExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	755C1000	1000	page execute read	page read and write	success or wait	6	30029D25	CreateWindowExW
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7C9C1000	2000	page read and write	page execute read	success or wait	8	3163DD60	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	7C9C1000	2000	page execute read	page read and write	success or wait	8	3163DD60	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	5D091000	1000	page read and write	page execute read	success or wait	5	3163DD60	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	5D091000	1000	page execute read	page read and write	success or wait	5	3163DD60	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	397EE000	1000	page read and write	page readonly	success or wait	4	30CFCD75	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	397EE000	1000	page readonly	page read and write	success or wait	4	30CFCD75	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77121000	1000	page read and write	page execute read	success or wait	6	30CFCD75	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77121000	1000	page execute read	page read and write	success or wait	6	30CFCD75	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	76FD1000	1000	page read and write	page execute read	success or wait	6	12E854	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	76FD1000	1000	page execute read	page read and write	success or wait	6	12E854	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77051000	1000	page read and write	page execute read	success or wait	1	12E854	unknown
900	C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	77051000	1000	page execute read	page read and write	success or wait	1	12E854	unknown

Memory Usage Statistics

Time	Private Usage (mb)	Workingset (mb)	Page File Usage (mb)
15:20:42	0	0	0
15:20:43	2	7	2
15:20:44	3	10	3
15:20:45	3	11	3
15:20:46	4	12	4
15:20:47	7	17	7
15:20:48	7	17	7
15:20:49	7	17	7
15:20:54	7	17	7
15:21:44	7	17	7

System Activites

System info class	Completion	Count	Source Address	Symbol
BasicInformation	success or wait	58	7C90E457	KiUserApcDispatcher
RangeStartInformation	success or wait	1	7C90E457	KiUserApcDispatcher
ProcessorInformation	success or wait	11	7C90E457	KiUserApcDispatcher
PerformanceInformation	success or wait	10	30007F87	GlobalMemoryStatusEx
CurrentTimeZoneInformation	success or wait	2	3F39072C	unknown

Timing Activites

Time	Completion	Count	Source Address	Symbol
129876420428906250	success or wait	1	130000	unknown

Windows UI Activites

Window Created

Window name	Class name	HWND	Completion	Count	Source Address	Symbol
OpusApp	OpusApp	6014A	success	1	30029D25	CreateWindowExW
IPTR	IPTR	6012E	success	1	1	unknown
IPTR	IPTR	50134	success	1	1	unknown
IPTR	IPTR	50138	success	1	3002D684	CoInitialize
_WwC	_WwC	50132	success	1	30054A32	CreateWindowExA
IPTR	IPTR	4011C	success	1	3163DD60	unknown
IPTR	IPTR	5011A	success	1	3163DD60	unknown
IPTR	IPTR	B0118	success	1	3163DD60	unknown
IPTR	IPTR	8010C	success	1	3163DD60	unknown
IPTR	IPTR	6010A	success	1	340046	unknown
IPTR	IPTR	60108	success	1	30CE9DFD	unknown
IPTR	IPTR	500FA	success	1	30CE9DFD	unknown
_WwF	_WwF	900F4	success	1	30054A32	CreateWindowExA
MSCTFIME UI	MSCTFIME UI	500F2	success	1	3002A1BB	DefWindowProcW
CicMarshalWndClass	CicMarshalWndClass	70112	success	1	3163DD60	unknown
IPTR	IPTR	60134	success	1	3163DD60	unknown
bosa_sdm_Microsoft Office Word 11.0	bosa_sdm_Microsoft Office Word 11.0	800FC	success	1	170002	RtlFreeHeap
6.0.2600.6028!ScrollBar	SCROLLBAR	A0152	success	1	1000	unknown
IPTR	IPTR	A00FE	success	1	30AA1BC4	unknown
IPTR	IPTR	60124	success	1	1	unknown
_WwB	_WwB	600F8	success	1	30029D25	CreateWindowExW
_WwB	_WwB	500F0	success	1	30029D25	CreateWindowExW
_WwG	_WwG	500EE	success	1	30029D25	CreateWindowExW
6.0.2600.6028!ScrollBar	SCROLLBAR	500EA	success	1	30054A32	CreateWindowExA
_WwC	_WwC	500E8	success	1	30054A32	CreateWindowExA
IPTR	IPTR	500E6	success	1	500F0	unknown
6.0.2600.6028!ScrollBar	SCROLLBAR	500E0	success	1	30054A32	CreateWindowExA
IPTR	IPTR	500D8	success	1	500F0	unknown
_WwC	_WwC	A0058	success	1	30054A32	CreateWindowExA
_WwC	_WwC	6012C	success	1	30054A32	CreateWindowExA
_WwC	_WwC	500D6	success	1	30054A32	CreateWindowExA
File Open Message Window	File Open Message Window	60154	success	1	1050	unknown

Window UIs Enumerated

Window name	Class name	HWND of window	Completion	Count	Source Address	Symbol
NULL	MSOBALLOON	0	error	1	30063D12	FindWindowA
NULL	MsoHelp10	0	error	1	30063D27	FindWindowA
NULL	AgentAnim	0	error	1	30063D40	FindWindowA
NULL	Shell_TrayWnd	1005E	success	1	3163DD60	unknown

Window UI Destroyed

HWND	Completion	Count	Source Address	Symbol
50134	success	1	3163DD60	unknown
600F8	success	1	3067CF46	NtUserDestroyWindow

Window UIs Enumerated

Parent HWND	Enum Childrens	TID	Window Handles	Completion	Count	Source Address	Symbol
1005E	true	0	10064, 10066, 10068, 1006A, 1006C, 1006E, 10078, 10084, 10088, 1, 88000000, 88000000, 88000000, 88000000, 88000000	success or wait	1	3163DD60	unknown
0	false	5D4	50134, 6014A, 6012E, 500F2, 8013C, 1, 10078, 10084, 10088, 1, 88000000, 88000000, 88000000, 88000000, 88000000	success or wait	1	3163DD60	unknown
0	false	5D4	6014A, 6012E, 500F2, 8013C, 1, 1, 10078, 10084, 10088, 1, 88000000, 88000000, 88000000, 88000000, 88000000	success or wait	1	3067D66A	KiUserApcDispatcher

Information about Foreground Window Queried

HWND	Completion	Count	Source Address	Symbol
1008C	success	1	300037BB	NtUserGetForegroundWindow
0	error	1	3163DD60	unknown
6014A	success	24	30063CEF	NtUserGetForegroundWindow

Window UI Shown

HWND	Command	Completion	Count	Source Address	Symbol
50134	show no activate	error	1	1	unknown
50132	show normal	error	1	3005545D	NtUserShowWindow
5011A	show no activate	error	1	3163DD60	unknown
5011A	show no activate	success	1	3163DD60	unknown
6014A	show maximized	error	1	3002CCA5	NtUserShowWindow
50132	show normal	success	4	3005545D	NtUserShowWindow
A0152	shown a	error	1	1000	unknown
4011C	show no activate	error	1	CFAFCC	unknown
60124	show	error	1	1	unknown
800FC	show	success	1	1	unknown
500EA	show normal	error	1	300747CC	NtUserShowWindow
500E0	show normal	error	1	300747CC	NtUserShowWindow
500D8	show normal	error	1	300747CC	NtUserShowWindow
500E6	show normal	error	1	300747CC	NtUserShowWindow
6012C	show normal	error	1	300747CC	NtUserShowWindow
500D6	show normal	error	1	300747CC	NtUserShowWindow
500EA	show normal	success	3	300747CC	NtUserShowWindow
500E0	show normal	success	3	300747CC	NtUserShowWindow
500D8	show normal	success	3	300747CC	NtUserShowWindow
500E6	show normal	success	3	300747CC	NtUserShowWindow
6012C	show normal	success	3	300747CC	NtUserShowWindow
500D6	show normal	success	3	300747CC	NtUserShowWindow
500F0	show normal	error	1	3006A9F5	NtUserShowWindow
500EE	show normal	error	1	30074BAC	NtUserShowWindow
6012C	show	success	1	30074BC1	NtUserShowWindow
500D6	show	success	1	30074BD6	NtUserShowWindow

Window UI Placement Queried

HWND	Command	Completion	Count	Source Address	Symbol
6014A	show maximized	success	1	3006ADB8	NtUserGetWindowPlacement

Message Posted to Windows UI

HWND	Message	LParam	WParam	Completion	Count	Source Address	Symbol
6014A	D00	37	0	success	2	3163DD60	unknown
6014A	45F	0	0	success	1	30003B2E	PostMessageA
A013E	DDE_ACK	393464	1878224	success	1	3067D00E	PostMessageA
A013E	DDE_TERMINATE	393464	0	success	1	3067D00E	PostMessageA
6014A	NCCREATE	0	1239824	success	1	3002A1BB	DefWindowProcW
8013C	NCCREATE	0	1239796	success	1	30029D25	CreateWindowExW
6014A	NCCALCSIZE	0	1239864	error	1	3002A1BB	DefWindowProcW
6014A	WINDOWPOSCHANGING	0	1239844	error	1	3002A83F	DefWindowProcA
6014A	NCCALCSIZE	1	1239800	error	1	3002A1BB	DefWindowProcW
6012E	NCCREATE	0	1239976	success	1	1	unknown
6012E	NCCALCSIZE	0	1240016	error	1	1	unknown
50138	NCCREATE	0	1239144	success	1	3002D684	CoInitialize
50138	NCCALCSIZE	0	1239184	error	1	3002D684	CoInitialize
50132	NCCREATE	0	1238664	success	1	30054C56	DefWindowProcA
4011C	NCCREATE	0	1238952	success	4	3163DD60	unknown
4011C	NCCALCSIZE	0	1238992	error	4	3163DD60	unknown
6010A	NCCREATE	0	1237660	success	3	340046	unknown
6010A	NCCALCSIZE	0	1237700	error	3	340046	unknown
6010A	SETTEXT	0	8912904	success	5	340046	unknown
8010C	WINDOWPOSCHANGING	0	1240492	error	4	3163DD60	unknown
8010C	NCCALCSIZE	1	1240448	error	4	3163DD60	unknown
500FA	NCCALCSIZE	1	1240312	error	1	3163DD60	unknown
6010A	NCCALCSIZE	1	1240368	error	2	3163DD60	unknown
50132	WINDOWPOSCHANGING	0	1240240	error	1	30054C56	DefWindowProcA
8010C	WINDOWPOSCHANGING	0	1240328	error	4	3163DD60	unknown
5011A	NCCALCSIZE	1	1240284	error	3	3163DD60	unknown
900F4	NCCREATE	0	1238704	success	1	300631FF	DefWindowProcA
900F4	NCCALCSIZE	0	1238756	error	1	300631FF	DefWindowProcA
6014A	WINDOWPOSCHANGING	0	1240708	error	1	3002A83F	DefWindowProcA
6014A	NCCALCSIZE	1	1240664	error	1	3002A1BB	DefWindowProcW
6014A	NCACTIVATE	1	0	success	2	3002A1BB	DefWindowProcW
500F2	NCCREATE	0	1234616	success	1	3002A1BB	DefWindowProcW
500F2	NCCALCSIZE	0	1234656	error	1	3002A1BB	DefWindowProcW
70112	NCCREATE	0	1238464	success	1	3163DD60	unknown
70112	NCCALCSIZE	0	1238528	error	1	3163DD60	unknown
6014A	NCPAINT	1	0	error	7	3002A1BB	DefWindowProcW
900F4	NCPAINT	1	0	error	19	300631FF	DefWindowProcA
6014A	SETICON	1	590459	error	1	3002A1BB	DefWindowProcW
6014A	SETICON	0	262655	error	1	3002A1BB	DefWindowProcW
60134	NCCREATE	0	1237644	success	1	3163DD60	unknown
60134	NCCALCSIZE	0	1237684	error	1	3163DD60	unknown
800FC	NCCREATE	0	1236572	success	1	170002	RtlFreeHeap
800FC	NCCALCSIZE	0	1236692	error	1	170002	RtlFreeHeap
800FC	SETTEXT	0	10322604	success	1	170002	RtlFreeHeap
A0152	NCCREATE	0	1236984	success	1	1000	unknown
A0152	NCCALCSIZE	0	1237052	error	1	1000	unknown
800FC	WINDOWPOSCHANGING	0	1238752	error	1	1000	unknown
800FC	NCCALCSIZE	1	1238708	error	1	1000	unknown
A00FE	NCCREATE	0	1236580	success	1	30AA1BC4	unknown
A00FE	NCCALCSIZE	0	1236620	error	1	30AA1BC4	unknown
A00FE	NCCALCSIZE	1	1238624	error	1	CFAFCC	unknown
900F4	WINDOWPOSCHANGING	0	1238484	error	1	300631FF	DefWindowProcA
900F4	NCCALCSIZE	1	1238440	error	1	300631FF	DefWindowProcA
900F4	PAINT	0	0	error	4	300631FF	DefWindowProcA

TID	Message	LParam	WParam	Completion	Count	Source Address	Symbol
5D4	C087	17	393546	success	1	7C90E473	KiUserApcDispatcher
61C	C087	1	0	success	1	3163DD60	unknown
5D4	C087	0	0	success	1	3163DD60	unknown
7DC	C088	0	0	success	3	3163DD60	unknown
7DC	C0C3	0	1492	success	4	3006A390	DispatchMessageA
5D4	C087	17	327918	success	1	7C90E473	KiUserApcDispatcher
7DC	C08C	0	1328	success	1	7C80B72F	unknown
7DC	C08C	0	1780	success	1	7C80B72F	unknown

Window UIs Hook Set

Module	Thread id	Hook code	Completion	Count	Source Address	Symbol
C:\WINDOWS\system32\MSCTF.dll	1492	keyboard	success	1	30029D25	CreateWindowExW
C:\WINDOWS\system32\MSCTF.dll	1492	mouse	success	1	30029D25	CreateWindowExW
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	1492	FFFFFFFF	success	1	30007EF6	SetWindowsHookExW
C:\WINDOWS\system32\MSCTF.dll	1780	keyboard	success	1	1050	unknown
C:\WINDOWS\system32\MSCTF.dll	1780	mouse	success	1	1050	unknown

Process Token Activites

Status	Privilege	Completion	Count	Source Address	Symbol
on	Load Driver	success or wait	2	FFFF	unknown

Chronological Activities

Operation	Data	Completion	Time
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CWDIllegalInDLLSearch	object name not found	749873692
System info queried	Type: BasicInformation	success or wait	749875248
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 140000 Length: 12FB14 Allocation Type: unknown Protection: page read and write	success or wait	749875508
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 140000 Length: 12FB18 Allocation Type: unknown Protection: page read and write	success or wait	749875715
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 141000 Length: 12F7F4 Allocation Type: unknown Protection: page read and write	success or wait	749876136
System info queried	Type: BasicInformation	success or wait	749878857
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 240000 Length: 12FB14 Allocation Type: unknown Protection: page read and write	success or wait	749879056
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 240000 Length: 12FB18 Allocation Type: unknown Protection: page read and write	success or wait	749879251
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	749880075
File control set	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1 Control Code: 90028 Input Buffer:	success or wait	749881449
Section loaded	Path: \KnownDlls\kernel32.dll Access: write and read and execute Type: unknown Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	749886317
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C801000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749887488
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C801000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749888719
Process information queried	PID: 900 Info Class: Cookie	success or wait	749889742
System info queried	Type: RangeStartInformation	success or wait	749897328
System info queried	Type: BasicInformation	success or wait	749897510
Section loaded	Path: unknown Access: query and write and read and execute and extend size Type: reserve Baseaddress: 7C800000 Size: 1007616 Protection: read write Mapped to pid: own pid	success or wait	749897758
System info queried	Type: BasicInformation	success or wait	749898637
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 250000 Length: 12F340 Allocation Type: unknown Protection: page read and write	success or wait	749899202
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	749904230
Section loaded	Path: \NLS\NlsSectionUnicode Access: read Type: unknown Baseaddress: 260000 Size: 90112 Protection: readonly Mapped to pid: own pid	success or wait	749905199
Section loaded	Path: \NLS\NlsSectionLocale Access: read Type: unknown Baseaddress: 280000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	749908552
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 143000 Length: 12F21C Allocation Type: unknown Protection: page read and write	success or wait	749909582
Section loaded	Path: \NLS\NlsSectionSortkey Access: query and read Type: unknown Baseaddress: 2D0000 Size: 266240 Protection: readonly Mapped to pid: own pid	success or wait	749909941
Section loaded	Path: \NLS\NlsSectionSortTbls Access: read Type: unknown Baseaddress: 320000 Size: 24576 Protection: readonly Mapped to pid: own pid	success or wait	749912779
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	749914305
Section loaded	Path: \NLS\NlsSectionSortkey00000409 Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	749914550
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 251000 Length: 12F168 Allocation Type: unknown Protection: page read and write	success or wait	749916743
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE.2.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	749918880
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE.2.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	749920799
Section loaded	Path: \KnownDlls\ADVAPI32.dll Access: write and read and execute Type: unknown Baseaddress: 77DD0000 Size: 634880 Protection: read write Mapped to pid: own pid	success or wait	749951274
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749954665
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749955252
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749955503
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749955957
Section loaded	Path: \KnownDlls\RPCRT4.dll Access: write and read and execute Type: unknown Baseaddress: 77E70000 Size: 602112 Protection: read write Mapped to pid: own pid	success or wait	749956314
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749959423
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749960101
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749960359
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749960791
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749965446
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749965722
Section loaded	Path: \KnownDlls\Secur32.dll Access: write and read and execute Type: unknown Baseaddress: 77FE0000 Size: 69632 Protection: read write Mapped to pid: own pid	success or wait	749966544
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749968566
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749968923
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749969197
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749970081
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77FE1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749972914
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77FE1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749973266
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749973519
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77E71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749973770
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77DD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749974011
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77DD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749974594
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749977751
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749978140
Section loaded	Path: \KnownDlls\GDI32.dll Access: write and read and execute Type: unknown Baseaddress: 77F10000 Size: 299008 Protection: read write Mapped to pid: own pid	success or wait	749978415
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749979677
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749982543
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749982791
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749983041
Section loaded	Path: \KnownDlls\USER32.dll Access: write and read and execute Type: unknown Baseaddress: 7E410000 Size: 593920 Protection: read write Mapped to pid: own pid	success or wait	749983325
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749986404
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749987153
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749987417
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749987719
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7E411000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749987977
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7E411000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749988604
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749991695
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749992316
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749992548
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749992852
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749993088
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749994195
Section loaded	Path: \KnownDlls\ole32.dll Access: write and read and execute Type: unknown Baseaddress: 774E0000 Size: 1302528 Protection: read write Mapped to pid: own pid	success or wait	749994472
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749997503
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749997904
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749998150
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749998403
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	749998647
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	749999087
Section loaded	Path: \KnownDlls\msvcrt.dll Access: write and read and execute Type: unknown Baseaddress: 77C10000 Size: 360448 Protection: read write Mapped to pid: own pid	success or wait	750001964
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750003188
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750003643
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C11000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750003972
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C11000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750006218
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750006461
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750007206
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750008954
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750009206
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750009450
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750010344
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750010587
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 774E1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750010996
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750012858
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750013335
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750013569
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750013940
Section loaded	Path: \KnownDlls\VERSION.dll Access: write and read and execute Type: unknown Baseaddress: 77C00000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	750014209
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750018640
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750019051
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C01000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750019302
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77C01000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750019557
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750020656
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750020891
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750021129
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30001000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750022207
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 144000 Length: 12F894 Allocation Type: unknown Protection: page read and write	success or wait	750022898
Process information queried	PID: 900 Info Class: ImageInformation	success or wait	750025230
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	750028729
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSAppCompat	success or wait	750034628
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Terminal Server Name: TSUserEnabled	success or wait	750038546
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: LeakTrack	object name not found	750039413
System info queried	Type: BasicInformation	success or wait	750040306
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: SafeDllSearchMode	object name not found	750043656
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750044473
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 410000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	750045220
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750049121
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: write and read and execute Type: commit Baseaddress: 410000 Size: 110592 Protection: execute Mapped to pid: own pid	success or wait	750049867
File opened	Path: C:\WINDOWS\system32\IMM32.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750053681
Section loaded	Path: C:\WINDOWS\system32\imm32.dll Access: query and write and read and execute Type: image Baseaddress: 76390000 Size: 118784 Protection: read write Mapped to pid: own pid	success or wait	750054429
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers Name: TransparentEnabled	success or wait	750054926
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750060322
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750060718
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750060979
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750063164
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750063431
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750063713
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750063970
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76391000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750064236
System info queried	Type: BasicInformation	success or wait	750064787
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize Name: DisableMetaFiles	object name not found	750069346
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Name: AppInit_DLLs	success or wait	750072763
System info queried	Type: BasicInformation	success or wait	750074517
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 840000 Length: 12F91C Allocation Type: unknown Protection: page read and write	success or wait	750074739
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 840000 Length: 12F920 Allocation Type: unknown Protection: page read and write	success or wait	750079250
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 841000 Length: 12F5FC Allocation Type: unknown Protection: page read and write	success or wait	750079537
Section loaded	Path: \NLS\NlsSectionCType Access: read Type: unknown Baseaddress: 850000 Size: 12288 Protection: readonly Mapped to pid: own pid	success or wait	750080533
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 843000 Length: 12F6A0 Allocation Type: unknown Protection: page read and write	success or wait	750081999
Process information queried	PID: 900 Info Class: Cookie	success or wait	750233796
Process information queried	PID: 900 Info Class: Cookie	success or wait	750233990
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 166000 Length: 12F5BC Allocation Type: unknown Protection: page read and write	success or wait	750234502
File opened	Path: \Device\KsecDD Access: read data or list directory and synchronize Options: synchronous io alert Overwritten: false	success or wait	750242981
System info queried	Type: BasicInformation	success or wait	750246039
System info queried	Type: ProcessorInformation	success or wait	750246243
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager Name: CriticalSectionTimeout	success or wait	750246632
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: RWLockResourceTimeOut	object name not found	750251250
System info queried	Type: BasicInformation	success or wait	750251760
System info queried	Type: ProcessorInformation	success or wait	750251968
System info queried	Type: BasicInformation	success or wait	750252164
System info queried	Type: ProcessorInformation	success or wait	750252369
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAll	object name not found	750256700
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableAllForOle32	object name not found	750256925
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface Name: InterfaceHelperDisableTypeLib	object name not found	750257144
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAll	object name not found	750257618
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{00020400-0000-0000-C000-000000000046} Name: InterfaceHelperDisableAllForOle32	object name not found	750257836
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30B81000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	750261376
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: CommonFilesDir	success or wait	750262109
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750262851
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Access: write and read and execute Type: commit Baseaddress: 860000 Size: 12259328 Protection: execute Mapped to pid: own pid	success or wait	750263674
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750269014
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL Access: query and write and read and execute Type: image Baseaddress: 30C90000 Size: 12304384 Protection: read write Mapped to pid: own pid	success or wait	750269836
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll.2.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	750275931
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\mso.dll.2.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	750276852
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750307576
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750308223
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750311918
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750312349
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750312595
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750313168
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750313413
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750313812
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750316340
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750316740
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750316983
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750317230
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750317470
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 30C91000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750317823
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mso.dll Name: CheckAppHelp	success or wait	750320360
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager\AppCompatibility Name: DisableAppCompat	object name not found	750321661
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 167000 Length: 12E640 Allocation Type: unknown Protection: page read and write	success or wait	750322144
Section loaded	Path: \BaseNamedObjects\ShimSharedMemory Access: write Type: unknown Baseaddress: 870000 Size: 57344 Protection: read write Mapped to pid: own pid	success or wait	750325362
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 3165E000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	750327289
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	750328160
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	750328571
File opened	Path: C:\Program Files\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	750332053
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	750333316
Mutant created	Name: \BaseNamedObjects\Local\Mutex_MSOSharedMem	success or wait	750334302
System info queried	Type: BasicInformation	success or wait	750336133
System info queried	Type: ProcessorInformation	success or wait	750339027
Process information queried	PID: 900 Info Class: Cookie	success or wait	750341814
Process information queried	PID: 900 Info Class: Cookie	success or wait	750342069
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 880000 Length: 12F8B8 Allocation Type: unknown Protection: page no access	success or wait	750345996
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 880000 Length: 12F8B8 Allocation Type: unknown Protection: page read and write	success or wait	750346287
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	success or wait	750346722
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Name: '	object name not found	750350981
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Name: ' Type: binary Data: 7F 27 03 00 84 03 00 00 01 00 00 00 00 00 00 00 00 00 00 00 Old data:	success or wait	750352420
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 890000 Length: 12F864 Allocation Type: unknown Protection: page no access	success or wait	750353031
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 890000 Length: 12F864 Allocation Type: unknown Protection: page read and write	success or wait	750354568
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 168000 Length: 12F424 Allocation Type: unknown Protection: page read and write	success or wait	750359999
Section loaded	Path: \KnownDlls\psapi.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	750362117
File opened	Path: C:\WINDOWS\system32\psapi.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750363128
Section loaded	Path: C:\WINDOWS\system32\psapi.dll Access: query and write and read and execute Type: image Baseaddress: 76BF0000 Size: 45056 Protection: read write Mapped to pid: own pid	success or wait	750365789
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76BF1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750371833
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76BF1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750372238
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76BF1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750372578
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76BF1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750372840
Process information queried	PID: 1160 Info Class: BasicInformation	success or wait	750377617
Memory read	PID: 1160 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7FFD8008 Length: 4 Value: 00 00 00 00	process is terminating	750379589
Key value replaced with new	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery\2A9B4 Name: 2A9B4 Type: binary Data: 04 00 00 00 84 03 00 00 44 00 00 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 2E 00 64 00 6F 00 63 00 10 00 00 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 00 00 00 00 01 00 00 00 00 00 00 00 C5 C4 CB 7C AB 7B CD 01 B4 A9 02 00 B4 A9 02 00 00 00 00 00 00 00 00 00 00 00 00 00 Old data: 04 00 00 00 88 04 00 00 44 00 00 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 2E 00 64 00 6F 00 63 00 10 00 00 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 00 00 00 00 01 00 00 00 00 00 00 00 C5 C4 CB 7C AB 7B CD 01 B4 A9 02 00 B4 A9 02 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	750394000
Foreground Window Got	HWND: 1008C	success	750394899
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	750397475
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	750397670
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\General Name: InstalledOnWin2k	success or wait	750400820
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: UserData	success or wait	750403076
Process information queried	PID: 900 Info Class: Times	success or wait	750403381
Process information queried	PID: 900 Info Class: Times	success or wait	750403571
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common Name: QMStrMax	object name not found	750403932
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8A0000 Length: 12F8CC Allocation Type: unknown Protection: page no access	success or wait	750406971
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8A0000 Length: 12F8CC Allocation Type: unknown Protection: page read and write	success or wait	750407170
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: QMStudyID	object name not found	750407480
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8A1000 Length: 12F85C Allocation Type: unknown Protection: page read and write	success or wait	750407791
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8B0000 Length: 12F888 Allocation Type: unknown Protection: page no access	success or wait	750408043
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8B0000 Length: 12F888 Allocation Type: unknown Protection: page read and write	success or wait	750408237
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8C0000 Length: 12F810 Allocation Type: unknown Protection: page no access	success or wait	750410478
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8C0000 Length: 12F810 Allocation Type: unknown Protection: page read and write	success or wait	750410676
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: UserData	success or wait	750411415
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\LanguageResources Name: SKULanguage	success or wait	750411936
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: InstallLanguage	success or wait	750412493
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: UILanguage	success or wait	750412816
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: HelpLanguage	success or wait	750415032
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: ExeMode	object name not found	750415362
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: WinXPLanguagePatch	success or wait	750415688
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: PreviousInstallLanguage	success or wait	750417440
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: WebLocale	success or wait	750420124
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: LangTuneUp	success or wait	750420530
Key value replaced with new	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: 2055 Type: unicode Data: On Old data: Off	success or wait	750421467
Key value replaced with new	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: 2055 Type: unicode Data: Off Old data: On	success or wait	750426855
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Name: OfficeUILanguage	success or wait	750428381
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Name: OfficeUILanguage	success or wait	750428693
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: InstallFonts	object name not found	750429026
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\1033\wwintl.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750432099
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\1033\WWINTL.DLL Access: write and read and execute Type: commit Baseaddress: 8D0000 Size: 778240 Protection: execute Mapped to pid: own pid	success or wait	750432930
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\1033\wwintl.dll Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	750434686
Section loaded	Path: C:\Program Files\Microsoft Office\OFFICE11\1033\WWINTL.DLL Access: query and read Type: commit Baseaddress: 8D0000 Size: 778240 Protection: readonly Mapped to pid: own pid	success or wait	750444338
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: UILanguage	success or wait	750449145
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 00000401	success or wait	750449854
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 0000040D	success or wait	750492448
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 0000041E	success or wait	750492990
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 0000042A	success or wait	750493530
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 00000439	success or wait	750494062
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 00000420	success or wait	750494597
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 00000429	success or wait	750495125
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 990000 Length: 12F45C Allocation Type: unknown Protection: page read and write	success or wait	750503526
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 990000 Length: 12F458 Allocation Type: unknown Protection: page read and write	success or wait	750503737
System info queried	Type: PerformanceInformation	success or wait	750504022
Process information queried	PID: 900 Info Class: QuotaLimits	success or wait	750505192
Process information queried	PID: 900 Info Class: VmCounters	success or wait	750505387
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9B0000 Length: 12F164 Allocation Type: unknown Protection: page no access	success or wait	750505731
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9B0000 Length: 12F164 Allocation Type: unknown Protection: page read and write	success or wait	750507771
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ASKFORPRINTERPICTURE	object name not found	750514381
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8C1000 Length: 12F114 Allocation Type: unknown Protection: page read and write	success or wait	750514915
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8C2000 Length: 12F0DC Allocation Type: unknown Protection: page read and write	success or wait	750515279
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8C3000 Length: 12F084 Allocation Type: unknown Protection: page read and write	success or wait	750515628
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8C4000 Length: 12F0C4 Allocation Type: unknown Protection: page read and write	success or wait	750516037
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9C0000 Length: 12F110 Allocation Type: unknown Protection: page no access	success or wait	750518767
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9C0000 Length: 12F110 Allocation Type: unknown Protection: page read and write	success or wait	750518969
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9D0000 Length: 12F114 Allocation Type: unknown Protection: page no access	success or wait	750519450
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9D0000 Length: 12F114 Allocation Type: unknown Protection: page read and write	success or wait	750519899
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: CACHESIZE	object name not found	750520214
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9E0000 Length: 12F258 Allocation Type: unknown Protection: page no access	success or wait	750520542
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9E0000 Length: 12F258 Allocation Type: unknown Protection: page read and write	success or wait	750522914
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9D1000 Length: 12F0F8 Allocation Type: unknown Protection: page read and write	success or wait	750523199
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: A00000 Length: 12F258 Allocation Type: unknown Protection: page no access	success or wait	750523456
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: A00000 Length: 12F258 Allocation Type: unknown Protection: page read and write	success or wait	750523652
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9D2000 Length: 12F208 Allocation Type: unknown Protection: page read and write	success or wait	750524280
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 9D3000 Length: 12EC38 Allocation Type: unknown Protection: page read and write	success or wait	750524899
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8C5000 Length: 12EC98 Allocation Type: unknown Protection: page read and write	success or wait	750528528
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: UserTemplates	object name not found	750529503
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: AppData	success or wait	750530415
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: Templates	success or wait	750531017
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	750532612
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: A10000 Length: 12B1A0 Allocation Type: unknown Protection: page no access	success or wait	750533026
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: A10000 Length: 12B1A0 Allocation Type: unknown Protection: page read and write	success or wait	750533225
Memory allocated	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 8C6000 Length: 127988 Allocation Type: unknown Protection: page read and write	success or wait	750534452
System info queried	Type: BasicInformation	success or wait	750603686
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc Name: MaxRpcSize	object name not found	750604155
System time queried	Time: 129876420428906250	success or wait	750607937
System info queried	Type: PerformanceInformation	success or wait	750609012
Process information queried	PID: 900 Info Class: QuotaLimits	success or wait	750614181
Process information queried	PID: 900 Info Class: VmCounters	success or wait	750614384
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19211108172 Access: query and write and read and execute and extend size Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	750615512
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19211108172 Access: query and write and read Type: reserve Baseaddress: A20000 Size: 126976 Protection: read write Mapped to pid: own pid	success or wait	750615755
Mutant created	Name: \BaseNamedObjects\Local\Mso97SharedDg19211108172Mutex	success or wait	750625082
Section loaded	Path: \KnownDlls\uxtheme.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	750626238
File opened	Path: C:\WINDOWS\system32\uxtheme.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750626926
Section loaded	Path: C:\WINDOWS\system32\uxtheme.dll Access: query and write and read and execute Type: image Baseaddress: 5AD70000 Size: 229376 Protection: read write Mapped to pid: own pid	success or wait	750630457
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750632235
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750632648
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750635430
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750635786
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750636048
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750636386
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750636645
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750636905
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750639961
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5AD71000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750640230
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\ThemeManager Name: Compositing	object name not found	750641461
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: LameButtonText	object name not found	750645640
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\Settings Name: Anchor Color	success or wait	750653078
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\Settings Name: Anchor Color Visited	success or wait	750653411
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoClearTypeNW	object name not found	750653902
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: FontInfoCache	buffer overflow	750655309
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: FontInfoCache	buffer overflow	750660881
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: FontInfoCache	buffer overflow	750661279
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: FontInfoCache	success or wait	750661879
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: UseOfficeUIFont	object name not found	750663956
Key value queried	Path: HKEY_USERS\Control Panel\International Name: iCountry	success or wait	750671008
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseNTWordDefPgSzBehavior	object name not found	750671339
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseAlternateTOCDelimiter	object name not found	750671662
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UpdateAllNumpages	object name not found	750671980
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AlternateReplaceAllMethodBehaviour	object name not found	750674870
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: WordPartialProtectDocTableResize	object name not found	750675194
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FieldCalcSecurityLevel	object name not found	750675513
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Wizards Name: PageSize	success or wait	750675933
Key value queried	Path: HKEY_USERS\Control Panel\International Name: iMeasure	success or wait	750676396
Key value queried	Path: HKEY_USERS\Control Panel\International Name: iTimePrefix	success or wait	750676833
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DOC-EXTENSION	object name not found	750680494
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DOT-EXTENSION	object name not found	750681077
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BAK-EXTENSION	object name not found	750681651
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BitmapMemory	object name not found	750684309
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: MessageBeeps	object name not found	750684715
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: EnableSubDocPutSaved	object name not found	750685212
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FavorWord97ListIndents	object name not found	750685532
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DoNotConfirmConverterSecurity	object name not found	750690098
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: WordRTFOutPathPref	object name not found	750690429
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: CalcDataFieldOnOpen	object name not found	750690754
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: SlowShading	object name not found	750691171
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: HideFileNotSavedDlg	object name not found	750691669
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NumberingGapUL	object name not found	750694178
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AlternateRevisionStepThrough	object name not found	750694502
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BlockDocCloseDuringCmdExec	object name not found	750694822
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: EnsurePrintLongVertCell	object name not found	750695140
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AlternativeLongTablesLayout	object name not found	750695460
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BulletProofOnCorruption	object name not found	750695779
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UpdateHeaderFooter	object name not found	750701515
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: EnsureFlagsOfProtectedDocForVbaSel	object name not found	750701846
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: RestoreXmlEvents	object name not found	750702171
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseLocalBiDiStyle	object name not found	750702493
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AlternateBreakThroughTab	object name not found	750702815
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UpdateWwdVBAUponToggleXML	object name not found	750703137
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: SpecialFieldsProtHandling	object name not found	750705543
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: WriteUrlWithSubitemAsBinary	object name not found	750705869
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ForceGrayscalePrint	object name not found	750706192
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoSmartTagRecognition	object name not found	750706779
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoSmartTagActions	object name not found	750707100
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DefaultFormat	object name not found	750707417
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BackgroundSave	object name not found	750709873
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BackgroundOpen	object name not found	750710190
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: BackgroundPrint	object name not found	750710507
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: PlainTextAutoFormat	object name not found	750710821
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Outlook\Options\Calendar Name: Text Direction	success or wait	750711386
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Outlook\Options\Calendar Name: Text Direction	success or wait	750711751
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: NoTrack	object name not found	750714154
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: Bidi Spelling	object name not found	750714479
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AutoSpell	object name not found	750714794
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AutoGrammar	object name not found	750715108
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoLiveScrolling	object name not found	750715422
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoFontMRUList	object name not found	750715831
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: InsertFloating	object name not found	750718378
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoRecentDocsHistory	object name not found	750718877
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: DisableScalingUpForHighDPI	object name not found	750719411
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: WordName	success or wait	750722241
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	750723296
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\Comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750724297
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: write and read and execute Type: commit Baseaddress: A40000 Size: 1056768 Protection: execute Mapped to pid: own pid	success or wait	750725305
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\Comctl32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750728600
Section loaded	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll Access: query and write and read and execute Type: image Baseaddress: 773D0000 Size: 1060864 Protection: read write Mapped to pid: own pid	success or wait	750729608
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750733478
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750733812
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750734075
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750734329
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750734584
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750737936
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750738264
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750738543
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750738798
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750739097
Section loaded	Path: \KnownDlls\SHLWAPI.dll Access: write and read and execute Type: unknown Baseaddress: 77F60000 Size: 483328 Protection: read write Mapped to pid: own pid	success or wait	750739389
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750741923
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750745283
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750745556
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750745832
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750746099
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750746491
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750746757
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750747849
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750748122
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77F61000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750748505
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750750681
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750751059
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750751313
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 773D1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750751617
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750755682
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: write and read and execute Type: commit Baseaddress: A40000 Size: 4096 Protection: execute Mapped to pid: own pid	success or wait	750759449
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	750761350
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: query and read Type: commit Baseaddress: A40000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	750762321
File opened	Path: C:\WINDOWS\WindowsShell.Manifest Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750767693
Section loaded	Path: C:\WINDOWS\WindowsShell.Manifest Access: read Type: commit Baseaddress: A40000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	750768490
File opened	Path: C:\WINDOWS\WindowsShell.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	750769289
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	750804407
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: EnableBalloonTips	object name not found	750806500
Window created	Window Name: OpusApp Class Name: OpusApp HWND: 6014A	success	750812220
File opened	Path: C:\WINDOWS\system32\MSCTF.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750812737
Section loaded	Path: C:\WINDOWS\system32\msctf.dll Access: write and read and execute Type: commit Baseaddress: A60000 Size: 299008 Protection: execute Mapped to pid: own pid	success or wait	750813497
File opened	Path: C:\WINDOWS\system32\MSCTF.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750817434
Section loaded	Path: C:\WINDOWS\system32\msctf.dll Access: query and write and read and execute Type: image Baseaddress: 74720000 Size: 311296 Protection: read write Mapped to pid: own pid	success or wait	750818182
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750823527
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750823936
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750824203
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750824467
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750824731
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750828311
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750828577
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750828834
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750829097
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 74721000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750829353
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	750830253
Section loaded	Path: \BaseNamedObjects\CiceroSharedMemDefaultS-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read Type: commit Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name exists	750834138
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared Name: CUAS	success or wait	750834910
Mutant created	Name: \BaseNamedObjects\CTF.LBES.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	750835617
Mutant created	Name: \BaseNamedObjects\CTF.Compart.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	750838544
Mutant created	Name: \BaseNamedObjects\CTF.Asm.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	750838824
Mutant created	Name: \BaseNamedObjects\CTF.Layouts.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	750839102
Mutant created	Name: \BaseNamedObjects\CTF.TMD.MutexDefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	750839378
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	750839795
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	750840238
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	750850454
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	750850820
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF Name: EnableAnchorContext	object name not found	750852731
Mutant created	Name: \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500MUTEX.DefaultS-1-5-21-507921405-1960408961-839522115-500	object name exists	750853693
Section loaded	Path: \BaseNamedObjects\CTF.TimListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500SFM.DefaultS-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read and execute and extend size Type: unknown Baseaddress: A60000 Size: 262144 Protection: read write Mapped to pid: own pid	success or wait	750856756
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 1492 Hook ID: keyboard	success	750857788
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 1492 Hook ID: mouse	success	750858019
Message sent	HWND: 6014A Message: NCCREATE WParam: 0 LParam: 1239824	success	750861261
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IMM Name: Ime File	success or wait	750861966
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	750862539
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750863018
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: write and read and execute Type: commit Baseaddress: AA0000 Size: 180224 Protection: execute Mapped to pid: own pid	success or wait	750863820
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	750867943
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: query and read Type: commit Baseaddress: AA0000 Size: 180224 Protection: readonly Mapped to pid: own pid	success or wait	750869252
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	750872730
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	750877057
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750877540
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: write and read and execute Type: commit Baseaddress: AA0000 Size: 180224 Protection: execute Mapped to pid: own pid	success or wait	750878344
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	750889703
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: query and read Type: commit Baseaddress: AA0000 Size: 180224 Protection: readonly Mapped to pid: own pid	success or wait	750890506
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	750891844
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750904759
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: write and read and execute Type: commit Baseaddress: AA0000 Size: 180224 Protection: execute Mapped to pid: own pid	success or wait	750906014
File opened	Path: C:\WINDOWS\system32\msctfime.ime Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750916454
Section loaded	Path: C:\WINDOWS\system32\msctfime.ime Access: query and write and read and execute Type: image Baseaddress: 755C0000 Size: 188416 Protection: read write Mapped to pid: own pid	success or wait	750917249
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750918988
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750922032
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750922336
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750922976
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750924698
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750924995
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750925288
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750925607
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750925902
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750926419
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	750928680
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 755C1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	750928975
Message sent	HWND: 8013C Message: NCCREATE WParam: 0 LParam: 1239796	success	750930951
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF Name: Disable Thread Input Manager	object name not found	750931503
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared Name: CUAS	success or wait	750935689
Message sent	HWND: 6014A Message: NCCALCSIZE WParam: 0 LParam: 1239864	error	750941364
Message sent	HWND: 6014A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1239844	error	750941728
Message sent	HWND: 6014A Message: NCCALCSIZE WParam: 1 LParam: 1239800	error	750942070
Section loaded	Path: \BaseNamedObjects\PrimaryWord11SharedMemoryArea Access: read Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	750942875
Section loaded	Path: \BaseNamedObjects\PrimaryWord11SharedMemoryArea Access: query and write and read Type: commit Baseaddress: AA0000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	750943999
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\1033\msointl.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	750947465
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\1033\MSOINTL.DLL Access: write and read and execute Type: commit Baseaddress: AB0000 Size: 1757184 Protection: execute Mapped to pid: own pid	success or wait	750948320
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\1033\msointl.dll Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	750950120
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\1033\MSOINTL.DLL Access: query and read Type: commit Baseaddress: AB0000 Size: 1757184 Protection: readonly Mapped to pid: own pid	success or wait	750952851
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: ScreenReaderPresent	object name not found	750955740
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg20321108172 Access: query and write and read and execute and extend size Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	750956112
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg20321108172 Access: query and write and read Type: reserve Baseaddress: C60000 Size: 126976 Protection: read write Mapped to pid: own pid	success or wait	750956356
Mutant created	Name: \BaseNamedObjects\Local\Mso97SharedDg20321108172Mutex	success or wait	750959910
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: UseAlternateShowUIMethodForFtpSession	object name not found	750960973
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: MaxCachedStreamSize	object name not found	750961307
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: ShowOtherTablesInDataSrc	object name not found	750961702
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: HypAlternateResolveToRel	object name not found	750963801
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: RepairSmartTags	object name not found	750968045
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: AddressBookNameMax4096	object name not found	750968379
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: ShowDispNameInToolTip	object name not found	750968708
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: AllowConsecutiveSlashesInUrlPathComponent	object name not found	750969077
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: UseCaseInsensitivePathForHyperlink	object name not found	750972329
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: LastUILang	object name not found	750972679
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: LastUILang	object name not found	750973000
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Name: OfficeUILanguage	success or wait	750973320
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Name: OfficeUILanguage	success or wait	750973634
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: AcbControl	object name not found	750974053
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: AcbOn	object name not found	750979810
System info queried	Type: PerformanceInformation	success or wait	750980195
Process information queried	PID: 900 Info Class: QuotaLimits	success or wait	750980572
Process information queried	PID: 900 Info Class: VmCounters	success or wait	750980761
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: CurrentProvider	success or wait	750983965
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: MaxWords	object name not found	750984301
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: MaxWordsJapan	object name not found	750984626
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: UseOnline	object name not found	750984950
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: PreferOffline	object name not found	750985272
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: PreferOffline	object name not found	750985586
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Research\Translation Name: UseMT	object name not found	750987377
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	750988403
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: RestrictRun	object name not found	750989695
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file and open no recall Attributes: none Content Overwritten: true	success or wait	750990190
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip Offset: unknown Length: 12 Value: 19 00 04 00 19 00 19 00 8C 06 00 00	success or wait	750991194
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Word11.pip Offset: unknown Length: 1676 Value: 68 00 00 00 88 05 00 00 80 06 00 00 88 06 00 00 E7 69 CD 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	750997967
Window created	Window Name: IPTR Class Name: IPTR HWND: 6012E	success	751022675
Message sent	HWND: 6012E Message: NCCREATE WParam: 0 LParam: 1239976	success	751023518
Message sent	HWND: 6012E Message: NCCALCSIZE WParam: 0 LParam: 1240016	error	751023761
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: Sound	object name not found	751025249
Process information queried	PID: 900 Info Class: Times	success or wait	751027841
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: MTTT	success or wait	751028066
Process information queried	PID: 1160 Info Class: Times	success or wait	751030527
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: MTTT	success or wait	751033779
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: MTTT	success or wait	751036037
Key value replaced with new	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: MTTT Type: binary Data: 88 04 00 00 8C 88 76 79 EA 69 CD 01 00 00 00 00 84 03 00 00 1C A7 E3 8F EA 69 CD 01 00 00 00 00 Old data: 88 04 00 00 8C 88 76 79 EA 69 CD 01 00 00 00 00	success or wait	751036439
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	751038377
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	751038992
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	751039545
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: ProInfo	success or wait	751042720
Key value queried	Path: HKEY_USERS\Control Panel\International Name: NumShape	success or wait	751043054
Window created	Window Name: IPTR Class Name: IPTR HWND: 50134	success	751078662
Window shown	HWND: 50134 CMD: show no activate	error	751081202
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\UserInfo Name: UserInfo	buffer overflow	751087782
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\UserInfo Name: UserInfo	buffer overflow	751088170
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\UserInfo Name: UserInfo	buffer overflow	751088520
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\UserInfo Name: UserInfo	success or wait	751088953
Windows hook set	Module: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE TID: 1492 Hook ID: FFFFFFFF	success	751090439
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows Name: Device	success or wait	751094221
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices Name: Microsoft XPS Document Writer	success or wait	751094683
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: ScreenReaderPresent	object name not found	751095208
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Messaging Subsystem Name: MAPIX	object name not found	751096091
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows Messaging Subsystem Name: MAPIX	object name not found	751096416
File opened	Path: C:\WINDOWS\system32\rpcss.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751103718
Section loaded	Path: C:\WINDOWS\system32\rpcss.dll Access: write and read and execute Type: commit Baseaddress: CF0000 Size: 401408 Protection: execute Mapped to pid: own pid	success or wait	751104469
System info queried	Type: BasicInformation	success or wait	751106300
System info queried	Type: BasicInformation	success or wait	751110791
System info queried	Type: BasicInformation	success or wait	751111015
Window created	Window Name: IPTR Class Name: IPTR HWND: 50138	success	751138503
Message sent	HWND: 50138 Message: NCCREATE WParam: 0 LParam: 1239144	success	751140020
Message sent	HWND: 50138 Message: NCCALCSIZE WParam: 0 LParam: 1239184	error	751140250
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoRereg	object name not found	751141147
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020906-0000-0000-C000-000000000046}\LocalServer32 Name: NULL	success or wait	751150464
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	751150781
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	751151176
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	751156254
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	751156653
File opened	Path: C:\Program Files\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	751157889
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	751159064
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document\CurVer Name: NULL	success or wait	751163809
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: GlobalDotName	object name not found	751164299
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	751165877
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	751169311
Section loaded	Path: \KnownDlls\SHELL32.dll Access: write and read and execute Type: unknown Baseaddress: 7C9C0000 Size: 8482816 Protection: read write Mapped to pid: own pid	success or wait	751173644
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	751175003
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	751175497
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	751175752
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	751178743
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	751179002
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	751179418
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	751179674
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	751179933
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	751180185
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	751183006
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	751183302
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	751183559
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	751187036
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	751187431
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page read and write New Protection: page execute read	success or wait	751187682
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 7C9C1000 Length: 2000 New Protection: page execute read New Protection: page read and write	success or wait	751188229
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	751190215
File opened	Path: C:\WINDOWS\system32\SHELL32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751195578
Section loaded	Path: C:\WINDOWS\system32\shell32.dll Access: read Type: commit Baseaddress: CF0000 Size: 8462336 Protection: readonly Mapped to pid: own pid	success or wait	751196364
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	751199920
File opened	Path: C:\WINDOWS\system32\SHELL32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	751201076
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	751246631
Section loaded	Path: \KnownDlls\comctl32.dll Access: write and read and execute Type: unknown Baseaddress: 5D090000 Size: 630784 Protection: read write Mapped to pid: own pid	success or wait	751247768
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751251627
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751252066
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751252363
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751252675
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751252963
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751256681
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751256978
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751257467
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751257760
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 5D091000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751259213
System info queried	Type: BasicInformation	success or wait	751264382
File opened	Path: C:\WINDOWS\system32\comctl32.dll Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751267512
Section loaded	Path: C:\WINDOWS\system32\comctl32.dll Access: read Type: commit Baseaddress: CF0000 Size: 618496 Protection: readonly Mapped to pid: own pid	success or wait	751282458
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	751283317
File opened	Path: C:\WINDOWS\system32\comctl32.dll.124.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	751284355
Process information queried	PID: 900 Info Class: SessionInformation	success or wait	751295655
Key value queried	Path: HKEY_USERS\Control Panel\Desktop Name: SmoothScroll	object name not found	751298538
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ScriptAnchorVis	object name not found	751316937
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools Name: FormatConsistencyWavyUnderlineColor	object name not found	751317991
Key value queried	Path: HKEY_USERS\Control Panel\International Name: NumShape	success or wait	751353077
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: GlobalDotName	object name not found	751362053
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	751363372
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	751374512
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Name: '(	object name not found	751377455
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Name: '( Type: binary Data: 27 28 03 00 84 03 00 00 04 00 00 00 00 00 00 00 BE 00 00 00 01 00 00 00 B6 00 00 00 57 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 41 00 70 00 70 00 6C 00 69 00 63 00 61 00 74 00 69 00 6F 00 6E 00 20 00 44 00 61 00 74 00 61 00 5C 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 5C 00 54 00 65 00 6D 00 70 00 6C 00 61 00 74 00 65 00 73 00 5C 00 4E 00 6F 00 72 00 6D 00 61 00 6C 00 2E 00 64 00 6F 00 74 00 00 00 00 00 00 00 Old data:	success or wait	751380981
Section loaded	Path: \BaseNamedObjects\DfSharedHeap3B051 Access: query and write and read Type: reserve Baseaddress: DA0000 Size: 4194304 Protection: read write Mapped to pid: own pid	success or wait	751388724
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\Normal.dot Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	751390215
System info queried	Type: PerformanceInformation	success or wait	751391165
Process information queried	PID: 900 Info Class: QuotaLimits	success or wait	751392036
Process information queried	PID: 900 Info Class: VmCounters	success or wait	751395394
Section loaded	Path: \BaseNamedObjects\DFMap0-241752 Access: query and write and read Type: commit Baseaddress: D10000 Size: 524288 Protection: read write Mapped to pid: own pid	success or wait	751395657
Section loaded	Path: \BaseNamedObjects\DfRoot00003B051 Access: query and write and read Type: commit Baseaddress: 11A0000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	751397138
File created	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB064.tmp Access: read attributes and delete and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and delete on close Attributes: temporary Content Overwritten: true	success or wait	751401138
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB064.tmp New path: Disposition: PositionInformation Data : Offset: 512	success or wait	751406808
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB064.tmp New path: Disposition: EndOfFileInformation Data : unknown	success or wait	751407018
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB064.tmp New path: Disposition: AllocationInformation Data : unknown	success or wait	751411865
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB064.tmp New path: Disposition: PositionInformation Data : Offset: 0	success or wait	751412552
System info queried	Type: PerformanceInformation	success or wait	751412743
Process information queried	PID: 900 Info Class: QuotaLimits	success or wait	751413140
Process information queried	PID: 900 Info Class: VmCounters	success or wait	751413352
Section loaded	Path: \BaseNamedObjects\DFMap0-241775 Access: query and write and read Type: commit Baseaddress: 11B0000 Size: 524288 Protection: read write Mapped to pid: own pid	success or wait	751413769
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dot Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	751420431
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Templates\~$Normal.dot Offset: 0 Length: 24 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	751421396
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Cache	success or wait	751437843
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Cache Type: unicode Data: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files Old data:	success or wait	751439903
File created	Path: C:\Documents and Settings\Administrator\Local Settings\Temporary Internet Files\Content.Word\~WRS0001.tmp Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	751447743
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Keyname: '(	success or wait	751451871
Window created	Window Name: _WwC Class Name: _WwC HWND: 50132	success	751458139
Message sent	HWND: 50132 Message: NCCREATE WParam: 0 LParam: 1238664	success	751458333
Window shown	HWND: 50132 CMD: show normal	error	751458688
Key value replaced with new	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery\2A9B4 Name: 2A9B4 Type: binary Data: 04 00 00 00 84 03 00 00 44 00 00 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 2E 00 64 00 6F 00 63 00 10 00 00 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 00 00 00 00 01 00 00 00 00 00 00 00 C5 C4 CB 7C AB 7B CD 01 B4 A9 02 00 B4 A9 02 00 01 00 00 00 00 00 00 00 00 00 00 00 Old data: 04 00 00 00 84 03 00 00 44 00 00 00 43 00 3A 00 5C 00 44 00 6F 00 63 00 75 00 6D 00 65 00 6E 00 74 00 73 00 20 00 61 00 6E 00 64 00 20 00 53 00 65 00 74 00 74 00 69 00 6E 00 67 00 73 00 5C 00 41 00 64 00 6D 00 69 00 6E 00 69 00 73 00 74 00 72 00 61 00 74 00 6F 00 72 00 5C 00 44 00 65 00 73 00 6B 00 74 00 6F 00 70 00 5C 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 2E 00 64 00 6F 00 63 00 10 00 00 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 20 00 42 00 61 00 74 00 74 00 65 00 72 00 79 00 00 00 00 00 01 00 00 00 00 00 00 00 C5 C4 CB 7C AB 7B CD 01 B4 A9 02 00 B4 A9 02 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	751466819
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF Name: Disable Thread Input Manager	object name not found	751473883
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000409\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} Name: Enable	success or wait	751476504
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000807\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} Name: Enable	success or wait	751477416
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} Name: Enable	success or wait	751481539
Window created	Window Name: IPTR Class Name: IPTR HWND: 4011C	success	751511556
Message sent	HWND: 4011C Message: NCCREATE WParam: 0 LParam: 1238952	success	751514235
Message sent	HWND: 4011C Message: NCCALCSIZE WParam: 0 LParam: 1238992	error	751514479
Window created	Window Name: IPTR Class Name: IPTR HWND: 5011A	success	751539318
Message sent	HWND: 4011C Message: NCCREATE WParam: 0 LParam: 1238952	success	751541661
Message sent	HWND: 4011C Message: NCCALCSIZE WParam: 0 LParam: 1238992	error	751541902
Window created	Window Name: IPTR Class Name: IPTR HWND: B0118	success	751566717
Message sent	HWND: 4011C Message: NCCREATE WParam: 0 LParam: 1238952	success	751569020
Message sent	HWND: 4011C Message: NCCALCSIZE WParam: 0 LParam: 1238992	error	751569260
Window created	Window Name: IPTR Class Name: IPTR HWND: 8010C	success	751594089
Message sent	HWND: 4011C Message: NCCREATE WParam: 0 LParam: 1238952	success	751596834
Message sent	HWND: 4011C Message: NCCALCSIZE WParam: 0 LParam: 1238992	error	751597078
Window created	Window Name: IPTR Class Name: IPTR HWND: 6010A	success	751622338
Message sent	HWND: 6010A Message: NCCREATE WParam: 0 LParam: 1237660	success	751624159
Message sent	HWND: 6010A Message: NCCALCSIZE WParam: 0 LParam: 1237700	error	751624393
Message sent	HWND: 6010A Message: SETTEXT WParam: 0 LParam: 8912904	success	751630793
Window created	Window Name: IPTR Class Name: IPTR HWND: 60108	success	751661305
Message sent	HWND: 6010A Message: NCCREATE WParam: 0 LParam: 1237660	success	751663053
Message sent	HWND: 6010A Message: NCCALCSIZE WParam: 0 LParam: 1237700	error	751663286
Message sent	HWND: 6010A Message: SETTEXT WParam: 0 LParam: 8912904	success	751663586
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Locale Name: 00000409	success or wait	751669148
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	751669794
Window created	Window Name: IPTR Class Name: IPTR HWND: 500FA	success	751697989
Message sent	HWND: 6010A Message: NCCREATE WParam: 0 LParam: 1237660	success	751700411
Message sent	HWND: 6010A Message: NCCALCSIZE WParam: 0 LParam: 1237700	error	751700643
Message sent	HWND: 6010A Message: SETTEXT WParam: 0 LParam: 8912904	success	751700946
Message sent	HWND: 8010C Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240492	error	751705296
Message sent	HWND: 8010C Message: NCCALCSIZE WParam: 1 LParam: 1240448	error	751705526
Message sent	HWND: 8010C Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240492	error	751705747
Message sent	HWND: 8010C Message: NCCALCSIZE WParam: 1 LParam: 1240448	error	751705966
Message sent	HWND: 8010C Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240492	error	751706395
Message sent	HWND: 8010C Message: NCCALCSIZE WParam: 1 LParam: 1240448	error	751708746
Message sent	HWND: 8010C Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240492	error	751708965
Message sent	HWND: 8010C Message: NCCALCSIZE WParam: 1 LParam: 1240448	error	751709182
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	751716089
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	751716718
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	751719057
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: ProInfo	success or wait	751719538
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail Name: NULL	success or wait	751721639
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Clients\Mail\Outlook Express\Envelope\CLSID Name: NULL	success or wait	751724012
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	751737090
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	751739457
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	751739866
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: ProInfo	success or wait	751740344
Message sent	HWND: 500FA Message: NCCALCSIZE WParam: 1 LParam: 1240312	error	751741048
Message sent	HWND: 6010A Message: NCCALCSIZE WParam: 1 LParam: 1240368	error	751741765
Message sent	HWND: 6010A Message: NCCALCSIZE WParam: 1 LParam: 1240368	error	751744176
Message sent	HWND: 50132 Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240240	error	751744820
Message sent	HWND: 8010C Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240328	error	751745084
Message sent	HWND: 8010C Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240328	error	751745308
Message sent	HWND: 5011A Message: NCCALCSIZE WParam: 1 LParam: 1240284	error	751745532
Message sent	HWND: 8010C Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240328	error	751745829
Message sent	HWND: 5011A Message: NCCALCSIZE WParam: 1 LParam: 1240284	error	751748200
Message sent	HWND: 8010C Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240328	error	751748425
Message sent	HWND: 5011A Message: NCCALCSIZE WParam: 1 LParam: 1240284	error	751748650
Window shown	HWND: 5011A CMD: show no activate	error	751749175
Window shown	HWND: 5011A CMD: show no activate	success	751749349
Window created	Window Name: _WwF Class Name: _WwF HWND: 900F4	success	751749706
Message sent	HWND: 900F4 Message: NCCREATE WParam: 0 LParam: 1238704	success	751752612
Message sent	HWND: 900F4 Message: NCCALCSIZE WParam: 0 LParam: 1238756	error	751752842
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseAlternateForegroundWindowDetectionMethod	object name not found	751753537
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseSpaceAsTextDelimiter	object name not found	751753866
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AlternateTableHeightLayout	object name not found	751754190
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AdjustSdtCaSmart	object name not found	751754584
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: MMDataSrcHeuristic	object name not found	751759021
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DontJumpForegroundInDDEExec	object name not found	751759348
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DisableODSOUIInDataSrc	object name not found	751759676
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseTempCopyForNonLocDoc	object name not found	751759998
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: KeepUISpecModeAtVbaEnd	object name not found	751760319
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UseAlternatePageNumberFormat	object name not found	751763273
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DontUpdateSmartDocAtInsert	object name not found	751763600
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ShowFileNameOnlyInIconCaption	object name not found	751763923
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: AlternateStyleCopyPasteNoOverwrite	object name not found	751764244
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DontShowDocActionsPaneAtOpen	object name not found	751764562
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FastTableRenderOnIMETS	object name not found	751764883
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: MntrSynchronize1stTabCell	object name not found	751769306
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoLinkBltinCharStyles	object name not found	751770183
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoDocChangeEventOnStoryRange	object name not found	751770507
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: TreatLocationReferenceAsLocal	object name not found	751770830
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ForceSetCopyCount	object name not found	751771147
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ListDefaultDictForAllLanFirst	object name not found	751771471
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: MailMergeFastSetPrintOrient	object name not found	751774236
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: SuppressPrinterIconEnum	object name not found	751774564
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: NoActivateOleLinkObjAtOpen	object name not found	751774885
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: CheckDupAddin4ShellLoad	object name not found	751777937
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: CleanupOldHyphBeforeHyphenate	object name not found	751778267
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: KeepDocActPaneWhileInReviewPane	object name not found	751778592
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FireSelChangeEventInTableCell	object name not found	751778911
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: UpdateHdrFtrOnVBAFldUpdate	object name not found	751779229
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: ForceUpdateToolbarAtInit	object name not found	751779546
Window shown	HWND: 6014A CMD: show maximized	error	751780007
Message sent	HWND: 6014A Message: WINDOWPOSCHANGING WParam: 0 LParam: 1240708	error	751780223
Message sent	HWND: 6014A Message: NCCALCSIZE WParam: 1 LParam: 1240664	error	751780453
Foreground Window Got	HWND: 0	error	751791633
Message posted	HWND: 6014A Message: D00 WParam: 37 LParam: 0	success	751794019
Foreground Window Got	HWND: 6014A	success	751794202
Windows found	Window Name: NULL Class Name: MSOBALLOON HWND: 0	error	751794439
Windows found	Window Name: NULL Class Name: MsoHelp10 HWND: 0	error	751794651
Windows found	Window Name: NULL Class Name: AgentAnim HWND: 0	error	751794859
Message sent	HWND: 6014A Message: NCACTIVATE WParam: 1 LParam: 0	success	751795088
Message posted	HWND: 6014A Message: D00 WParam: 37 LParam: 0	success	751797878
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\riched20.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751805067
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\RICHED20.DLL Access: write and read and execute Type: commit Baseaddress: 1240000 Size: 1105920 Protection: execute Mapped to pid: own pid	success or wait	751805931
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\office11\riched20.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751807842
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\OFFICE11\RICHED20.DLL Access: query and write and read and execute Type: image Baseaddress: 39700000 Size: 1097728 Protection: read write Mapped to pid: own pid	success or wait	751809003
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	751813584
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	751814102
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	751814361
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	751814620
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	751814871
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	751815172
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page read and write New Protection: page readonly	success or wait	751815423
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 397EE000 Length: 1000 New Protection: page readonly New Protection: page read and write	success or wait	751815801
System info queried	Type: BasicInformation	success or wait	751816596
Section loaded	Path: \KnownDlls\OLEAUT32.dll Access: write and read and execute Type: unknown Baseaddress: 77120000 Size: 569344 Protection: read write Mapped to pid: own pid	success or wait	751817918
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751821312
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751821772
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751822061
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751822315
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751822563
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751822924
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751823168
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751824539
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751824788
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751825053
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751825297
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77121000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751825538
Message posted	TID: 5D4 Message: C087 WParam: 17 LParam: 393546	success	751826678
Window created	Window Name: MSCTFIME UI Class Name: MSCTFIME UI HWND: 500F2	success	751828030
Message sent	HWND: 500F2 Message: NCCREATE WParam: 0 LParam: 1234616	success	751829595
Message sent	HWND: 500F2 Message: NCCALCSIZE WParam: 0 LParam: 1234656	error	751830089
File opened	Path: C:\WINDOWS\system32\Msimtf.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751830813
Section loaded	Path: C:\WINDOWS\system32\msimtf.dll Access: write and read and execute Type: commit Baseaddress: 1300000 Size: 159744 Protection: execute Mapped to pid: own pid	success or wait	751831668
Foreground Window Got	HWND: 6014A	success	751833793
File opened	Path: C:\WINDOWS\system32\Msimtf.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751834629
Section loaded	Path: C:\WINDOWS\system32\msimtf.dll Access: write and read and execute Type: commit Baseaddress: 1300000 Size: 159744 Protection: execute Mapped to pid: own pid	success or wait	751835504
File opened	Path: C:\WINDOWS\system32\Msimtf.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751838112
Section loaded	Path: C:\WINDOWS\system32\msimtf.dll Access: write and read and execute Type: commit Baseaddress: 1300000 Size: 159744 Protection: execute Mapped to pid: own pid	success or wait	751838995
File opened	Path: C:\WINDOWS\system32\Msimtf.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751844367
Section loaded	Path: C:\WINDOWS\system32\msimtf.dll Access: write and read and execute Type: commit Baseaddress: 1300000 Size: 159744 Protection: execute Mapped to pid: own pid	success or wait	751845330
Foreground Window Got	HWND: 6014A	success	751848918
Windows found	Window Name: NULL Class Name: Shell_TrayWnd HWND: 1005E	success	751849386
Windows enumerated	Desktop: 0 Parent: 1005E Enum Children: true TID: 0 HWNDs: 10064, 10066, 10068, 1006A, 1006C, 1006E, 10078, 10084, 10088, 1, 88000000, 88000000, 88000000, 88000000, 88000000	success or wait	751849601
Message posted	TID: 61C Message: C087 WParam: 1 LParam: 0	success	751850083
Message posted	TID: 5D4 Message: C087 WParam: 0 LParam: 0	success	751850465
Section loaded	Path: \BaseNamedObjects\CTF.AsmListCache.FMPDefaultS-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read and execute and extend size Type: unknown Baseaddress: 1300000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	751851252
Window created	Window Name: CicMarshalWndClass Class Name: CicMarshalWndClass HWND: 70112	success	751853392
Message sent	HWND: 70112 Message: NCCREATE WParam: 0 LParam: 1238464	success	751853669
Message sent	HWND: 70112 Message: NCCALCSIZE WParam: 0 LParam: 1238528	error	751853914
Message posted	TID: 7DC Message: C088 WParam: 0 LParam: 0	success	751855305
Message sent	HWND: 6014A Message: NCPAINT WParam: 1 LParam: 0	error	751856107
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	751857149
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	751863571
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	751864116
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	751864355
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	751864589
Foreground Window Got	HWND: 6014A	success	751866017
System info queried	Type: BasicInformation	success or wait	751869772
System info queried	Type: ProcessorInformation	success or wait	751869968
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: AddIns	success or wait	751871955
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Word\Addins\WebPage.Connect Name: LoadBehavior	success or wait	751875024
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: Com+Enabled	success or wait	751875574
Section loaded	Path: \KnownDlls\CLBCATQ.DLL Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	751876142
File opened	Path: C:\WINDOWS\system32\CLBCATQ.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751876827
Section loaded	Path: C:\WINDOWS\system32\clbcatq.dll Access: query and write and read and execute Type: image Baseaddress: 76FD0000 Size: 520192 Protection: read write Mapped to pid: own pid	success or wait	751877597
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751880682
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751881186
Section loaded	Path: \KnownDlls\COMRes.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	751881498
File opened	Path: C:\WINDOWS\system32\COMRes.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	751882193
Section loaded	Path: C:\WINDOWS\system32\comres.dll Access: query and write and read and execute Type: image Baseaddress: 77050000 Size: 806912 Protection: read write Mapped to pid: own pid	success or wait	751882968
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77051000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751884764
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 77051000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751887168
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751887443
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751887792
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751888057
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751888400
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751888666
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751888930
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751889198
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751889466
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page read and write New Protection: page execute read	success or wait	751889734
Memory attributes changed	PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE Base: 76FD1000 Length: 1000 New Protection: page execute read New Protection: page read and write	success or wait	751889996
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: MinimumFreeMemPercentageToCreateProcess	object name not found	751891942
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: MinimumFreeMemPercentageToCreateObject	object name not found	751892319
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	751893099
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: Com+Enabled	success or wait	751893454
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	751900306
System info queried	Type: BasicInformation	success or wait	751901247
System info queried	Type: ProcessorInformation	success or wait	751901465
File opened	Path: C:\WINDOWS\Registration\R000000000007.clb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	751901760
File other op	Path: C:\WINDOWS\Registration\R000000000007.clb New path: Disposition: PositionInformation Data : Offset: 22512	success or wait	751902573
File other op	Path: C:\WINDOWS\Registration\R000000000007.clb New path: Disposition: PositionInformation Data : Offset: 0	success or wait	751903261
File read	Path: C:\WINDOWS\Registration\R000000000007.clb Offset: unknown Length: 22512 Value: 43 4F 4D 2B 01 00 00 00 01 00 12 00 24 00 00 00 00 01 01 00 63 00 00 00 00 00 00 01 01 00 00 00 00 01 10 00 00 00 00 00 C0 00 00 00 00 00 00 46 0E 00 00 00 30 01 00 00 A0 03 00 00 33 5F 30 00 D0 04 00 00 0C 00 00 00 33 5F 31 00 DC 04 00 00 88 02 00 00 33 5F 32 00 64 07 00 00 3C 00 00 00 33 5F 33 00	success or wait	751903474
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Word\Addins\WebPage.Connect Name: FileName	object name not found	751920308
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Word\Addins\WordEEFonts.Connect Name: LoadBehavior	success or wait	751920904
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\COM3 Name: REGDBVersion	success or wait	751921353
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Word\Addins\WordEEFonts.Connect Name: FileName	object name not found	751921953
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF Name: Disable Thread Input Manager	object name not found	751925176
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{1188450c-fdab-47ae-80d8-c9633f71be64}\LanguageProfile\0x00000000\{63800dac-e7ca-4df9-9a5c-20765055488d} Name: Enable	success or wait	751926002
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000409\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} Name: Enable	success or wait	751927248
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x00000807\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} Name: Enable	success or wait	751928160
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\TIP\{DCBD6FA8-032F-11D3-B5B1-00C04FC324A1}\LanguageProfile\0x0000ffff\{09EA4E4B-46CE-4469-B450-0DE76A435BBB} Name: Enable	success or wait	751929388
Window destroyed	HWND: 50134	success	751932915
Windows enumerated	Desktop: 0 Parent: 0 Enum Children: false TID: 5D4 HWNDs: 50134, 6014A, 6012E, 500F2, 8013C, 1, 10078, 10084, 10088, 1, 88000000, 88000000, 88000000, 88000000, 88000000	success or wait	751933072
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	751933500
Window shown	HWND: 50132 CMD: show normal	success	751940171
Message sent	HWND: 6014A Message: SETICON WParam: 1 LParam: 590459	error	751946919
Message sent	HWND: 6014A Message: SETICON WParam: 0 LParam: 262655	error	751948927
Window created	Window Name: IPTR Class Name: IPTR HWND: 60134	success	751974705
Message sent	HWND: 60134 Message: NCCREATE WParam: 0 LParam: 1237644	success	751976988
Message sent	HWND: 60134 Message: NCCALCSIZE WParam: 0 LParam: 1237684	error	751977248
Window created	Window Name: bosa_sdm_Microsoft Office Word 11.0 Class Name: bosa_sdm_Microsoft Office Word 11.0 HWND: 800FC	success	751987864
Message sent	HWND: 800FC Message: NCCREATE WParam: 0 LParam: 1236572	success	751992961
Message sent	HWND: 800FC Message: NCCALCSIZE WParam: 0 LParam: 1236692	error	751993204
Message sent	HWND: 800FC Message: SETTEXT WParam: 0 LParam: 10322604	success	751995666
Window created	Window Name: 6.0.2600.6028!ScrollBar Class Name: SCROLLBAR HWND: A0152	success	752051831
Message sent	HWND: A0152 Message: NCCREATE WParam: 0 LParam: 1236984	success	752052725
Message sent	HWND: A0152 Message: NCCALCSIZE WParam: 0 LParam: 1237052	error	752052965
Window shown	HWND: A0152 CMD: shown a	error	752054288
Message sent	HWND: 800FC Message: WINDOWPOSCHANGING WParam: 0 LParam: 1238752	error	752054549
Message sent	HWND: 800FC Message: NCCALCSIZE WParam: 1 LParam: 1238708	error	752054759
Window created	Window Name: IPTR Class Name: IPTR HWND: A00FE	success	752093778
Message sent	HWND: A00FE Message: NCCREATE WParam: 0 LParam: 1236580	success	752094193
Message sent	HWND: A00FE Message: NCCALCSIZE WParam: 0 LParam: 1236620	error	752094988
Message sent	HWND: 6010A Message: SETTEXT WParam: 0 LParam: 8912904	success	752102740
Message sent	HWND: A00FE Message: NCCALCSIZE WParam: 1 LParam: 1238624	error	752104647
Message sent	HWND: 900F4 Message: WINDOWPOSCHANGING WParam: 0 LParam: 1238484	error	752104962
Message sent	HWND: 900F4 Message: NCCALCSIZE WParam: 1 LParam: 1238440	error	752105182
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	752111462
Message sent	HWND: 900F4 Message: PAINT WParam: 0 LParam: 0	error	752112962
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	752115144
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	752115830
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	752117902
Window shown	HWND: 4011C CMD: show no activate	error	752118150
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	752118369
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	752120098
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: QuickPreview	object name not found	752120362
Window shown	HWND: 50132 CMD: show normal	success	752120675
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Local AppData	success or wait	752121646
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Local AppData Type: unicode Data: C:\Documents and Settings\Administrator\Local Settings\Application Data Old data:	success or wait	752123529
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\Application Data\Microsoft\Schemas\MS Word_restart.xml Access: read attributes and delete Options: non directory file and open for backup ident and open reparse point Overwritten: false	object path not found	752124347
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: STARTUP-PATH	object name not found	752125256
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: Startup	success or wait	752125684
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Word\STARTUP\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	752129402
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\STARTUP\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	752133652
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: VolumePref	object name not found	752136069
Process information queried	PID: 900 Info Class: Times	success or wait	752136391
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Keyname: '	success or wait	752136817
Key deleted	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	success or wait	752137932
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FirstRun	success or wait	752140946
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\UserInfo Name: UserName	success or wait	752141531
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\UserInfo Name: UserInitials	success or wait	752141895
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\UserInfo Name: Company	success or wait	752142214
Process information queried	PID: 900 Info Class: Times	success or wait	752143562
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common Name: QMEnable	success or wait	752144009
Message posted	HWND: 6014A Message: 45F WParam: 0 LParam: 0	success	752147007
Foreground Window Got	HWND: 6014A	success	752151848
Message posted	TID: 7DC Message: C088 WParam: 0 LParam: 0	success	752153253
Message sent	HWND: 900F4 Message: PAINT WParam: 0 LParam: 0	error	752154930
Window created	Window Name: IPTR Class Name: IPTR HWND: 60124	success	752189529
Window shown	HWND: 60124 CMD: show	error	752193132
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	752193373
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: DisableFontLinking	object name not found	752193839
Message sent	HWND: 6010A Message: SETTEXT WParam: 0 LParam: 8912904	success	752202283
Message sent	HWND: 6014A Message: NCPAINT WParam: 1 LParam: 0	error	752202923
Window shown	HWND: 800FC CMD: show	success	752203291
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	752211638
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Language Hotkey	success or wait	752212000
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	752212353
Key value queried	Path: HKEY_USERS\Keyboard Layout\Toggle Name: Layout Hotkey	success or wait	752212696
Message posted	TID: 7DC Message: C0C3 WParam: 0 LParam: 1492	success	752215787
Message posted	TID: 7DC Message: C0C3 WParam: 0 LParam: 1492	success	752217131
Message posted	TID: 7DC Message: C0C3 WParam: 0 LParam: 1492	success	752217903
Message posted	TID: 7DC Message: C0C3 WParam: 0 LParam: 1492	success	752221303
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF..CJJCD Access: query and write and read Type: commit Baseaddress: 1330000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	752222178
Mutant created	Name: \BaseNamedObjects\MSCTF.Shared.MUTEX.MNH	object name exists	752225232
Section loaded	Path: \BaseNamedObjects\MSCTF.Shared.SFM.MNH Access: query and write and read and execute and extend size Type: unknown Baseaddress: 1340000 Size: 524288 Protection: read write Mapped to pid: own pid	success or wait	752225490
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF.B.CJJCD Access: query and write and read Type: commit Baseaddress: 1330000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	752227883
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF.C.CJJCD Access: query and write and read Type: commit Baseaddress: 13C0000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	752228586
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF.D.CJJCD Access: query and write and read Type: commit Baseaddress: 13D0000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	752229285
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF.E.CJJCD Access: query and write and read Type: commit Baseaddress: 1330000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	752232668
Message sent	HWND: 900F4 Message: PAINT WParam: 0 LParam: 0	error	752239687
Key value queried	Path: HKEY_USERS\Software\Microsoft\Internet Explorer\Settings Name: Anchor Color	success or wait	752251691
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19521108172 Access: query and write and read and execute and extend size Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	752266226
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19521108172 Access: query and write and read Type: reserve Baseaddress: 13E0000 Size: 126976 Protection: read write Mapped to pid: own pid	success or wait	752266476
Mutant created	Name: \BaseNamedObjects\Local\Mso97SharedDg19521108172Mutex	success or wait	752267315
Message sent	HWND: 6014A Message: NCPAINT WParam: 1 LParam: 0	error	752292134
Message sent	HWND: 900F4 Message: PAINT WParam: 0 LParam: 0	error	752293485
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF.F.AMJCD Access: query and write and read Type: commit Baseaddress: 1330000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	752415113
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19521108172 Access: query and write and read and execute and extend size Type: unknown Baseaddress: 1400000 Size: 126976 Protection: read write Mapped to pid: own pid	success or wait	752432862
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19531108172 Access: query and write and read and execute and extend size Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	752434635
Section loaded	Path: \BaseNamedObjects\Local\Mso97SharedDg19531108172 Access: query and write and read Type: reserve Baseaddress: 1400000 Size: 126976 Protection: read write Mapped to pid: own pid	success or wait	752434876
Mutant created	Name: \BaseNamedObjects\Local\Mso97SharedDg19531108172Mutex	success or wait	752435736
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.ENF.G.ANJCD Access: query and write and read Type: commit Baseaddress: 1330000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	752457445
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	752458501
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	752458713
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	752462850
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	752468795
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	752469216
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: ProInfo	success or wait	752469700
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	752484211
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	752488945
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MNH.FB.ANJCD Access: query and write and read and execute and extend size Type: unknown Baseaddress: 1330000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	752489411
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MNH.GB.ANJCD Access: query and write and read and execute and extend size Type: unknown Baseaddress: 1330000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	752490470
Section loaded	Path: \BaseNamedObjects\MSCTF.MarshalInterface.FileMap.MNH.HB.ANJCD Access: query and write and read and execute and extend size Type: unknown Baseaddress: 1330000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	752491310
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	752493387
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	752493579
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: DelayLV	object name not found	752493817
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	752500045
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	752500259
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet Name: DoNotCheckIfOfficeIsHTMLEditor	object name not found	752501950
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.htm Name:	success or wait	752502996
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command Name:	success or wait	752519749
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command Name:	success or wait	752520319
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\11 Name:	success or wait	752524470
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\11 Name:	success or wait	752531202
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.mht Name:	success or wait	752543230
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command Name:	success or wait	752546475
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command Name:	success or wait	752547031
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\11 Name:	success or wait	752548147
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\11 Name:	success or wait	752553914
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	752560375
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	752560570
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	752565575
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	752568581
Section loaded	Path: \KnownDlls\msi.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	752569202
File opened	Path: C:\WINDOWS\system32\msi.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	752569902
Section loaded	Path: C:\WINDOWS\system32\msi.dll Access: query and write and read and execute Type: image Baseaddress: 7D1E0000 Size: 2867200 Protection: read write Mapped to pid: own pid	success or wait	752570654
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	752583568
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	752585915
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer Name: DisableUserInstalls	object name not found	752587278
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\Installer Name: Debug	object name not found	752589158
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\InstallProperties Name: WindowsInstaller	success or wait	752591483
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: DigitalProductID	buffer overflow	752593818
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: DigitalProductID	success or wait	752594144
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\InstallProperties Name: WindowsInstaller	success or wait	752596387
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: WORDFiles	success or wait	752600631
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	752601369
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	752601709
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	success or wait	752773851
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C Name: 9040110900063D11C8EF10054038389C	success or wait	752774714
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A453DD12EE71CEF49A4EB2A8684FB83A Name: 9040110900063D11C8EF10054038389C	success or wait	752775441
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5861C19D5F3D8C8439408F306F31034A Name: 9040110900063D11C8EF10054038389C	success or wait	752776158
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\311714883E93F274A838DDB012991F9D Name: 9040110900063D11C8EF10054038389C	success or wait	752776867
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72E940125B15C02498F17C8F91EADC14 Name: 9040110900063D11C8EF10054038389C	success or wait	752777580
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16EFE5D0815A2D11A92E0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	752778286
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41AE703BF87339947BDCC4715F97EFED Name: 9040110900063D11C8EF10054038389C	success or wait	752778995
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	752779598
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	752780330
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	752792226
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	752792570
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	752793363
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	752794087
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	752794801
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	752795510
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	752804370
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	752804712
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	752805457
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	752806171
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	752806874
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	752818201
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	752818955
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	752819668
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	752820381
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	752821086
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	752829433
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: WORDFiles	success or wait	752837564
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: WORDFiles Type: dword Data: 1089994761 Old data: 1089994760	success or wait	752837950
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: DigitalProductID	buffer overflow	752840793
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: DigitalProductID	success or wait	752841119
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\General Name: Data	success or wait	752842093
File opened	Path: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\OPA11.BAK Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file and open reparse point Attributes: none Content Overwritten: true	success or wait	752853511
File created	Path: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat Access: read attributes and delete and synchronize and generic write Options: sequential only and synchronous io non alert and non directory file Attributes: archive Content Overwritten: true	object name collision	752854717
File opened	Path: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	752855713
File other op	Path: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: archive and temporary	success or wait	752856515
File opened	Path: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: normal Content Overwritten: true	success or wait	752860605
File other op	Path: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat New path: Disposition: PositionInformation Data : Offset: 0	success or wait	752863073
File read	Path: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat Offset: unknown Length: 8200 Value: 02 AB 1B 8F D1 D4 FE 68 A2 DB EA C7 E5 28 02 7E DB 3B 1F FA FD 11 53 96 8F 67 D0 D6 29 AF 27 91 64 6F 5D 8C 2B A8 2B F1 E9 6A 6C A5 A1 29 47 81 8C 0A 60 4C 01 C6 73 F4 B9 77 78 55 29 29 48 32 A9 19 BD 20 AE 2F FD AC 6D 17 DB FA B4 9D 92 58 A9 B6 71 A2 0E 8F 20 8A 6F 51 91 92 32 B2 33 BE 60 30 4B F8	success or wait	752865756
File opened	Path: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: normal Content Overwritten: true	success or wait	752872827
File other op	Path: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat New path: Disposition: PositionInformation Data : Offset: 0	success or wait	752873643
File read	Path: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat Offset: unknown Length: 8200 Value: 02 AB 1B 8F D1 D4 FE 68 A2 DB EA C7 E5 28 02 7E DB 3B 1F FA FD 11 53 96 8F 67 D0 D6 29 AF 27 91 64 6F 5D 8C 2B A8 2B F1 E9 6A 6C A5 A1 29 47 81 8C 0A 60 4C 01 C6 73 F4 B9 77 78 55 29 29 48 32 A9 19 BD 20 AE 2F FD AC 6D 17 DB FA B4 9D 92 58 A9 B6 71 A2 0E 8F 20 8A 6F 51 91 92 32 B2 33 BE 60 30 4B F8	success or wait	752873818
File other op	Path: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat New path: Disposition: PositionInformation Data : Offset: 8200	success or wait	752879553
File read	Path: C:\DOCUME~1\ALLUSE~1\APPLIC~1\MICROS~1\OFFICE\DATA\opa11.dat Offset: unknown Length: 6 Value: 0E AB 1B 8F C2 D4	success or wait	752879729
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	752888987
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	752889471
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: WORDFiles	success or wait	752896903
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	752897673
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	buffer overflow	752897995
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: WORDFiles	success or wait	752898308
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\CB4EDBE115A903645B145216AF54CC5C Name: 9040110900063D11C8EF10054038389C	success or wait	752898938
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\A453DD12EE71CEF49A4EB2A8684FB83A Name: 9040110900063D11C8EF10054038389C	success or wait	752899652
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\5861C19D5F3D8C8439408F306F31034A Name: 9040110900063D11C8EF10054038389C	success or wait	752900336
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\311714883E93F274A838DDB012991F9D Name: 9040110900063D11C8EF10054038389C	success or wait	752901017
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\72E940125B15C02498F17C8F91EADC14 Name: 9040110900063D11C8EF10054038389C	success or wait	752901704
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\16EFE5D0815A2D11A92E0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	752902392
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\41AE703BF87339947BDCC4715F97EFED Name: 9040110900063D11C8EF10054038389C	success or wait	752909883
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	752910461
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	752911162
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	752911495
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	752911817
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	752912574
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	752917503
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	752918209
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	752918909
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	752919609
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	752919935
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	752923393
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	752924100
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	752924792
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	752925117
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	752925812
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	752929168
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	752929866
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	752930557
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	752931774
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\9040110900063D11C8EF10054038389C Name: ProductName	success or wait	752938092
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: DigitalProductID	buffer overflow	752938724
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: DigitalProductID	success or wait	752939040
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\1033\id_011.dpc Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: none Content Overwritten: true	success or wait	752952292
File read	Path: C:\Program Files\Microsoft Office\OFFICE11\1033\ID_011.DPC Offset: unknown Length: 575 Value: 4D 10 B1 97 70 ED 41 A7 18 C6 A0 30 FA E4 CA 9C 8B 05 18 82 F8 0F FE CF CF FB A8 BA 01 1E 74 D0 91 F9 C1 07 18 87 24 9A DE 4A 61 67 12 00 63 63 64 87 E3 11 82 80 0F 0E 75 EF E7 44 3D 12 8E 09 50 E2 3A 7D CB 9B EE B9 1B 52 A8 34 CF E6 7D BC CA 68 CC E3 38 34 82 28 9D 21 A3 C7 A8 89 7D EF 88 1B EC 8B	success or wait	752953145
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\General Name: AuditMode	object name not found	752955476
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\General Name: AuditMode	object name not found	752956059
System info queried	Type: BasicInformation	success or wait	752958718
System info queried	Type: ProcessorInformation	success or wait	752973233
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	752989023
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	752989217
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	752989524
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5 Type: binary Data: 03 00 00 00 27 00 00 00 7B 39 30 31 31 30 34 30 39 2D 36 30 30 30 2D 31 31 44 33 2D 38 43 46 45 2D 30 31 35 30 30 34 38 33 38 33 43 39 7D 00 56 00 00 00 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 4F 00 66 00 66 00 69 00 63 00 65 00 20 00 50 00 72 00 6F 00 66 00 65 00 73 00 73 00 69 00 6F 00 6E 00 61 00 6C 00 20 00 45 00 64 00 69 00 74 00 69 00 6F 00 6E 00 20 00 32 00 30 00 30 00 33 00 00 00 Old data:	success or wait	753001155
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\InstallProperties Name: WindowsInstaller	success or wait	753005489
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: WordName	success or wait	753012109
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: WordName	success or wait	753020943
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: WordName	success or wait	753021278
Key value replaced with new	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: WordName Type: binary Data: 4D 00 69 00 63 00 72 00 6F 00 73 00 6F 00 66 00 74 00 20 00 57 00 6F 00 72 00 64 00 00 00 Old data:	success or wait	753021642
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word Name: WordName	success or wait	753022212
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: Viewer	object name not found	753031663
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: DigitalProductID	buffer overflow	753032184
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: DigitalProductID	success or wait	753032511
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\InstallRoot\UE Name: {90110409-6000-11D3-8CFE-0150048383C9} Type: binary Data: 12 79 FE 79 2F 8E AC BC 4E 6F C4 64 EF 9A 1A 37 Old data:	success or wait	753033694
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: Authorized	success or wait	753034389
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: EULADis	success or wait	753047456
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	753078290
Window created	Window Name: _WwB Class Name: _WwB HWND: 600F8	success	753084232
Foreground Window Got	HWND: 6014A	success	753229825
Foreground Window Got	HWND: 6014A	success	753230775
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	753235800
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: NoTrack	object name not found	753236874
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoNetHood	object name not found	753238347
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoNetHood	object name not found	753250543
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoPropertiesMyComputer	object name not found	753251267
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoPropertiesMyComputer	object name not found	753251904
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoInternetIcon	object name not found	753252573
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoInternetIcon	object name not found	753257361
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoCommonGroups	object name not found	753258506
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoCommonGroups	object name not found	753259229
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Desktop	success or wait	753272036
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Desktop Type: unicode Data: C:\Documents and Settings\Administrator\Desktop Old data:	success or wait	753274195
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoControlPanel	object name not found	753275064
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoControlPanel	object name not found	753275883
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoSetFolders	object name not found	753279131
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoSetFolders	object name not found	753279942
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Name: NULL	success or wait	753281122
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	753283341
Section loaded	Path: \KnownDlls\SETUPAPI.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	753286546
File opened	Path: C:\WINDOWS\system32\SETUPAPI.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	753287325
Section loaded	Path: C:\WINDOWS\system32\setupapi.dll Access: query and write and read and execute Type: image Baseaddress: 77920000 Size: 995328 Protection: read write Mapped to pid: own pid	success or wait	753288239
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	753301721
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemSetupInProgress	success or wait	753302158
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\WPA\PnP Name: seed	success or wait	753303055
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: OsLoaderPath	success or wait	753303886
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: OsLoaderPath	success or wait	753304353
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemPartition	success or wait	753305293
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\Setup Name: SystemPartition	success or wait	753306803
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: SourcePath	success or wait	753307691
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: SourcePath	success or wait	753308157
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackSourcePath	success or wait	753308999
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackSourcePath	success or wait	753309465
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackCachePath	success or wait	753310613
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: ServicePackCachePath	success or wait	753312122
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: DriverCachePath	success or wait	753313039
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: DriverCachePath	success or wait	753313501
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: DevicePath	success or wait	753314347
Mutant created	Name: unknown	success or wait	753315122
Mutant created	Name: unknown	success or wait	753315565
Mutant created	Name: unknown	success or wait	753317591
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogLevel	success or wait	753318023
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogLevel	success or wait	753318487
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup Name: LogPath	object name not found	753319013
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	753320111
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Hostname	success or wait	753320985
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters Name: Domain	success or wait	753322880
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	753324579
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	753326066
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	753327068
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	753329224
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	753329678
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	pending	753330110
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	753331755
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........j.......R...............K.dL.Y.Q.K..*.,.................S.e.L.o.a.d.D.r.i.v.e.r.P.r.i.v.i.l.e.g.e.	pending	753333360
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,.......................K.dL.Y.Q.K..	pending	753334392
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	753337624
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	753338216
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	753338608
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	753339050
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	pending	753339479
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	753341232
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........b.......J...............4..H...[g.C.".$.................S.e.U.n.d.o.c.k.P.r.i.v.i.l.e.g.e.	pending	753342646
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,.......................4..H...[g.C.	pending	753345590
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	753347334
Privilege adjusted	Privilege: Load Driver On or off: on	success or wait	753356347
File opened	Path: IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	753369016
File opened	Path: IDE#CdRomVBOX_CD-ROM_____________________________1.0_____#42562d3231303037333036372020202020202020#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	753371603
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	753374700
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f} Name: Data	buffer overflow	753380627
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f} Name: Data	success or wait	753388905
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{811e0202-1746-11df-8a4d-806d6172696f} Name: Generation	success or wait	753390486
File opened	Path: STORAGE#Volume#1&30a96598&0&SignatureF4ACF4ACOffset7E00Length3BFEFCE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	753391198
File opened	Path: STORAGE#Volume#1&30a96598&0&SignatureF4ACF4ACOffset7E00Length3BFEFCE00#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	753392911
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	753395075
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Data	buffer overflow	753406637
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Data	success or wait	753407064
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	753408546
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	753409242
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	753413374
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: BaseClass Type: unicode Data: Drive Old data:	success or wait	753422946
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	753423652
File opened	Path: MountPointManager Access: read attributes and synchronize Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	753431798
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{811e0202-1746-11df-8a4d-806d6172696f} Name: BaseClass Type: unicode Data: Drive Old data:	success or wait	753437316
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	753437817
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	753438121
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	753438538
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	753439372
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753443886
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: DontShowSuperHidden	object name not found	753447697
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: DontShowSuperHidden	object name not found	753448604
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer Name: ShellState	success or wait	753452778
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer Name: ShellState	success or wait	753453217
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: ForceActiveDesktopOn	object name not found	753454042
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: ForceActiveDesktopOn	object name not found	753454858
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoActiveDesktop	object name not found	753458497
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoActiveDesktop	object name not found	753459358
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoWebView	object name not found	753460299
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoWebView	object name not found	753461114
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: ClassicShell	object name not found	753462773
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: ClassicShell	object name not found	753463588
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: SeparateProcess	object name not found	753464465
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: SeparateProcess	object name not found	753465266
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoNetCrawling	object name not found	753468186
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoNetCrawling	object name not found	753469050
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoSimpleStartMenu	object name not found	753469906
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoSimpleStartMenu	object name not found	753470715
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: Hidden	success or wait	753472626
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: ShowCompColor	success or wait	753473053
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	753473510
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: DontPrettyPath	success or wait	753473935
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: ShowInfoTip	success or wait	753474355
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideIcons	success or wait	753474776
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: MapNetDrvBtn	success or wait	753475198
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: WebView	success or wait	753475996
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: Filter	success or wait	753479442
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: ShowSuperHidden	success or wait	753479861
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: SeparateProcess	success or wait	753480357
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: NoNetCrawling	success or wait	753480779
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: DocObject	object name not found	753482340
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: BrowseInPlace	object name not found	753484602
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: IsShortcut	object name not found	753486259
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: AlwaysShowExt	success or wait	753487059
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Directory Name: NeverShowExt	object name not found	753490869
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753491918
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753493329
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	753600597
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	753606873
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	753607124
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	753607369
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	753607901
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	753608107
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	753608305
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	753610305
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	753613221
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	753615782
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	753617638
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	753618155
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753620370
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753621645
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753622974
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753624350
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: AllowFileCLSIDJunctions	object name not found	753629270
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: AllowFileCLSIDJunctions	object name not found	753629974
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	753631384
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	success or wait	753636116
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Name: +	object name not found	753640432
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Name: + Type: binary Data: 19 2B 03 00 84 03 00 00 06 00 00 00 01 00 00 00 66 00 00 00 02 00 00 00 56 00 00 00 04 00 00 00 63 00 3A 00 5C 00 64 00 6F 00 63 00 75 00 6D 00 65 00 7E 00 31 00 5C 00 61 00 64 00 6D 00 69 00 6E 00 69 00 7E 00 31 00 5C 00 6C 00 6F 00 63 00 61 00 6C 00 73 00 7E 00 31 00 5C 00 69 00 70 00 68 00 6F 00 6E 00 65 00 20 00 35 00 2E 00 64 00 6F 00 63 00 00 00 00 00 00 00 Old data:	success or wait	753640948
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	753641848
Section loaded	Path: \BaseNamedObjects\DfSharedHeap3B5CC Access: query and write and read Type: reserve Baseaddress: 1420000 Size: 4194304 Protection: read write Mapped to pid: own pid	success or wait	753642721
File opened	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\iPhone 5.doc Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	753646355
System info queried	Type: PerformanceInformation	success or wait	753647201
Process information queried	PID: 900 Info Class: QuotaLimits	success or wait	753647617
Process information queried	PID: 900 Info Class: VmCounters	success or wait	753647828
Section loaded	Path: \BaseNamedObjects\DFMap0-243156 Access: query and write and read Type: commit Baseaddress: 1820000 Size: 524288 Protection: read write Mapped to pid: own pid	success or wait	753648093
Section loaded	Path: \BaseNamedObjects\DfRoot00003B5CC Access: query and write and read Type: commit Baseaddress: 13D0000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	753650513
File created	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB5D9.tmp Access: read attributes and delete and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and delete on close Attributes: temporary Content Overwritten: true	success or wait	753652008
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB5D9.tmp New path: Disposition: PositionInformation Data : Offset: 512	success or wait	753657597
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB5D9.tmp New path: Disposition: EndOfFileInformation Data : unknown	success or wait	753657808
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB5D9.tmp New path: Disposition: AllocationInformation Data : unknown	success or wait	753663126
File other op	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\~DFB5D9.tmp New path: Disposition: PositionInformation Data : Offset: 0	success or wait	753666329
System info queried	Type: PerformanceInformation	success or wait	753666525
Process information queried	PID: 900 Info Class: QuotaLimits	success or wait	753666921
Process information queried	PID: 900 Info Class: VmCounters	success or wait	753667135
Section loaded	Path: \BaseNamedObjects\DFMap0-243174 Access: query and write and read Type: commit Baseaddress: 18A0000 Size: 524288 Protection: read write Mapped to pid: own pid	success or wait	753667400
File created	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~$hone 5.doc Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: hidden Content Overwritten: true	success or wait	753670203
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~$hone 5.doc Offset: unknown Length: 54 Value: 0D 48 61 6E 75 65 6C 65 20 42 61 73 65 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	753680920
File write	Path: C:\DOCUME~1\ADMINI~1\LOCALS~1\~$hone 5.doc Offset: unknown Length: 108 Value: 0D 00 48 00 61 00 6E 00 75 00 65 00 6C 00 65 00 20 00 42 00 61 00 73 00 65 00 72 00 00 00 00 00 16 00 00 00 F8 00 06 00 3E 01 0A 00 A0 00 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 02 00 00 00 00 00 00 00 74 47 0C 00 FF FF FF FF FF FF 0C 00 5C 00 00 00 03 00 00 00 04 00 00 00 08 00 00 00 04 00 00 00	success or wait	753682093
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools Name: SpellingWavyUnderlineColor	object name not found	753684438
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools Name: GrammarWavyUnderlineColor	object name not found	753684774
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: NoTrack	object name not found	753690801
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: MaxPropsStreamSize	object name not found	753693277
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	753703454
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	753703989
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Recent	object name not found	753705437
Section loaded	Path: \KnownDlls\USERENV.dll Access: write and read and execute Type: unknown Baseaddress: 769C0000 Size: 737280 Protection: read write Mapped to pid: own pid	success or wait	753706293
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	753712991
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: ChkAccDebugLevel	object name not found	753715969
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions Name: ProductType	success or wait	753716813
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Personal	success or wait	753722571
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Local Settings	success or wait	753722995
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: RsopDebugLevel	object name not found	753724027
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	753724761
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: RsopLogging	object name not found	753725160
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: UserEnvDebugLevel	object name not found	753725956
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: RsopLogging	object name not found	753728752
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon Name: UserEnvDebugLevel	object name not found	753729514
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\System Name: UserEnvDebugLevel	object name not found	753730267
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: ProfileImagePath	success or wait	753731061
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dot Name: Progid	object name not found	753737399
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.dot Name: Application	object name not found	753738181
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dot Name: NULL	success or wait	753739193
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.dot Name: PerceivedType	object name not found	753743453
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8 Name: DocObject	object name not found	753744387
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot Name: DocObject	object name not found	753745124
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8 Name: BrowseInPlace	object name not found	753745815
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot Name: BrowseInPlace	object name not found	753746493
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8\CLSID Name: NULL	success or wait	753749330
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8 Name: IsShortcut	object name not found	753750360
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot Name: IsShortcut	object name not found	753751038
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8 Name: AlwaysShowExt	object name not found	753751717
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot Name: AlwaysShowExt	object name not found	753752394
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Template.8 Name: NeverShowExt	object name not found	753753069
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.dot Name: NeverShowExt	object name not found	753753746
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\ReviewCycle Name: ReviewToken	success or wait	753756839
Mutant created	Name: \BaseNamedObjects\Global\MTX_MSO_Formal1_S-1-5-21-507921405-1960408961-839522115-500	success or wait	753757859
Section loaded	Path: \BaseNamedObjects\Local\MSO_Formal11108172_S-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read and execute and extend size Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	753758197
Section loaded	Path: \BaseNamedObjects\Local\MSO_Formal11108172_S-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read Type: commit Baseaddress: 1920000 Size: 8192 Protection: read write Mapped to pid: own pid	success or wait	753758451
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\review.rcd Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	object name not found	753760931
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\review.rcd Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	object name not found	753762112
Mutant created	Name: \BaseNamedObjects\Global\MTX_MSO_AdHoc1_S-1-5-21-507921405-1960408961-839522115-500	success or wait	753763135
Section loaded	Path: \BaseNamedObjects\Local\MSO_AdHoc11108172_S-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read and execute and extend size Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	753764223
Section loaded	Path: \BaseNamedObjects\Local\MSO_AdHoc11108172_S-1-5-21-507921405-1960408961-839522115-500 Access: query and write and read Type: commit Baseaddress: 1930000 Size: 8192 Protection: read write Mapped to pid: own pid	success or wait	753764477
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\adhoc.rcd Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	object name not found	753765928
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\adhoc.rcd Access: read attributes and synchronize and generic read Options: sequential only and synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	object name not found	753767080
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: DoNotDismissFileNewTaskPane	object name not found	753768095
Window placement got	HWND: 6014A CMD: show maximized	success	753768396
Window created	Window Name: _WwB Class Name: _WwB HWND: 500F0	success	753772507
Foreground Window Got	HWND: 6014A	success	753851850
Window created	Window Name: _WwG Class Name: _WwG HWND: 500EE	success	753854469
Window created	Window Name: 6.0.2600.6028!ScrollBar Class Name: SCROLLBAR HWND: 500EA	success	753857889
Window created	Window Name: _WwC Class Name: _WwC HWND: 500E8	success	753858691
Window created	Window Name: IPTR Class Name: IPTR HWND: 500E6	success	753884299
Window created	Window Name: 6.0.2600.6028!ScrollBar Class Name: SCROLLBAR HWND: 500E0	success	753885721
Window created	Window Name: IPTR Class Name: IPTR HWND: 500D8	success	753909733
Window created	Window Name: _WwC Class Name: _WwC HWND: A0058	success	753915617
Window created	Window Name: _WwC Class Name: _WwC HWND: 6012C	success	753916155
Window created	Window Name: _WwC Class Name: _WwC HWND: 500D6	success	753917152
Window shown	HWND: 500EA CMD: show normal	error	754524191
Window shown	HWND: 500E0 CMD: show normal	error	754524370
Window shown	HWND: 500D8 CMD: show normal	error	754524534
Window shown	HWND: 500E6 CMD: show normal	error	754525286
Window shown	HWND: 6012C CMD: show normal	error	754525944
Window shown	HWND: 500D6 CMD: show normal	error	754526887
Message sent	HWND: 6014A Message: NCACTIVATE WParam: 1 LParam: 0	success	754529400
Message posted	TID: 5D4 Message: C087 WParam: 17 LParam: 327918	success	754529793
File opened	Path: C:\WINDOWS\system32\Msimtf.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	754530940
Section loaded	Path: C:\WINDOWS\system32\msimtf.dll Access: write and read and execute Type: commit Baseaddress: 1980000 Size: 159744 Protection: execute Mapped to pid: own pid	success or wait	754531833
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet Name: PixelsPerInch	object name not found	754537379
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet Name: PixelsPerInch	object name not found	754537728
Window shown	HWND: 500EA CMD: show normal	success	754538069
Window shown	HWND: 500E0 CMD: show normal	success	754538228
Window shown	HWND: 500D8 CMD: show normal	success	754538386
Window shown	HWND: 500E6 CMD: show normal	success	754539189
Window shown	HWND: 6012C CMD: show normal	success	754539699
Window shown	HWND: 500D6 CMD: show normal	success	754548016
Window shown	HWND: 500EA CMD: show normal	success	754549802
Window shown	HWND: 500E0 CMD: show normal	success	754549961
Window shown	HWND: 500D8 CMD: show normal	success	754550118
Window shown	HWND: 500E6 CMD: show normal	success	754550531
Window shown	HWND: 6012C CMD: show normal	success	754550879
Window shown	HWND: 500D6 CMD: show normal	success	754551036
Window shown	HWND: 50132 CMD: show normal	success	754551212
Window shown	HWND: 500F0 CMD: show normal	error	754551372
Message sent	HWND: 6014A Message: NCPAINT WParam: 1 LParam: 0	error	754551783
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	754553205
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	754554822
Message sent	HWND: 6014A Message: NCPAINT WParam: 1 LParam: 0	error	754555082
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	754555323
Message sent	HWND: 6014A Message: NCPAINT WParam: 1 LParam: 0	error	754555562
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	754555799
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	754556033
Message sent	HWND: 900F4 Message: NCPAINT WParam: 1 LParam: 0	error	754556669
Window shown	HWND: 500EE CMD: show normal	error	755036978
Message sent	HWND: 6014A Message: NCPAINT WParam: 1 LParam: 0	error	755037272
Window shown	HWND: 6012C CMD: show	success	755037750
Window shown	HWND: 500D6 CMD: show	success	755037910
Window shown	HWND: 50132 CMD: show normal	success	755038675
Window shown	HWND: 500EA CMD: show normal	success	755038839
Window shown	HWND: 500E0 CMD: show normal	success	755049037
Window shown	HWND: 500D8 CMD: show normal	success	755050257
Window shown	HWND: 500E6 CMD: show normal	success	755051222
Window shown	HWND: 6012C CMD: show normal	success	755051729
Window shown	HWND: 500D6 CMD: show normal	success	755051889
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	755062296
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	755067233
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755069708
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: MaximumAllowedAllocationSize	object name not found	755086066
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755086731
File opened	Path: C:\DOCUME~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755088010
File opened	Path: C:\DOCUME~1\ADMINI~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755089231
Section loaded	Path: \BaseNamedObjects\Global\RotHintTable Access: read Type: unknown Baseaddress: 1980000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	755091255
System info queried	Type: BasicInformation	success or wait	755095773
File opened	Path: C:\WINDOWS\system32\winlogon.exe Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755096576
Section loaded	Path: C:\WINDOWS\system32\winlogon.exe Access: write and read and execute Type: commit Baseaddress: 1990000 Size: 507904 Protection: execute Mapped to pid: own pid	success or wait	755097379
Section loaded	Path: \KnownDlls\xpsp2res.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	755127093
File opened	Path: C:\WINDOWS\system32\xpsp2res.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755127816
Section loaded	Path: C:\WINDOWS\system32\xpsp2res.dll Access: query and write and read and execute Type: image Baseaddress: 1990000 Size: 2904064 Protection: read write Mapped to pid: own pid	conflicting addresses	755128598
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Ole Name: DefaultAccessPermission	object name not found	755131053
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	755133712
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	755134242
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	755134554
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	755134917
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	pending	755135238
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........@.......(.....,.........................................	pending	755136696
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........t.......\.....9.....1w.+Mg.O..;..8k..................................CF..w.tC..2............................	pending	755138224
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,...................1w.+Mg.O..;..8k.	pending	755142766
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	755145443
Thread created	PID: 900 TID: 1332 EIP: 7C8106F9 EAX: 77E76C7D Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	755156772
Thread resumed	TID: 1332 PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	755157603
Thread created	PID: 900 TID: 1608 EIP: 7C8106F9 EAX: 774FE4DF Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	755170556
Thread resumed	TID: 1608 PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	755171341
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755171822
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755173429
Thread delayed	Time: -60 TID: 1608	success or wait	755175961
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755187403
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755188759
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755190081
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755192040
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems Keyname: +	success or wait	755195919
Key deleted	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\StartupItems	success or wait	755199310
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced Name: HideFileExt	success or wait	755200811
Key created	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery\32CCF	success or wait	755202013
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Resiliency\DocumentRecovery\32CCF Name: 32CCF Type: binary Data: 04 00 00 00 84 03 00 00 2A 00 00 00 43 00 3A 00 5C 00 44 00 4F 00 43 00 55 00 4D 00 45 00 7E 00 31 00 5C 00 41 00 44 00 4D 00 49 00 4E 00 49 00 7E 00 31 00 5C 00 4C 00 4F 00 43 00 41 00 4C 00 53 00 7E 00 31 00 5C 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 2E 00 64 00 6F 00 63 00 08 00 00 00 69 00 50 00 68 00 6F 00 6E 00 65 00 20 00 35 00 00 00 00 00 01 00 00 00 00 00 00 00 78 51 21 83 EA 69 CD 01 CF 2C 03 00 CF 2C 03 00 00 00 00 00 00 00 00 00 00 00 00 00 Old data:	success or wait	755203296
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Outlook\Security Name: OutlookSecureTempFolder	object name not found	755204323
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag Name: DisableDocumentAssemblies	object name not found	755205548
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	object name not found	755205962
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\InstallRoot Name: InstallCount	success or wait	755209107
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	buffer overflow	755209523
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	buffer overflow	755209847
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Licensing Name: 1EBDE4BC9A514630B5412561FA45CCC5	success or wait	755210167
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: DigitalProductID	buffer overflow	755210834
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: DigitalProductID	success or wait	755211156
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BDAB17EF6C1EC5848A53E114D327F3CA Name: 9040110900063D11C8EF10054038389C	success or wait	755213297
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: ProInfo	success or wait	755213710
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5 Type: dword Data: 1 Old data:	success or wait	755216946
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: NoTTP	object name not found	755226004
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\Internet Name: UseOnlineContent	success or wait	755226361
Message posted	HWND: A013E Message: DDE_ACK WParam: 393464 LParam: 1878224	success	755255730
Foreground Window Got	HWND: 6014A	success	755304980
Message posted	TID: 7DC Message: C088 WParam: 0 LParam: 0	success	755306575
Section loaded	Path: \KnownDlls\MSIMG32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	755316242
File opened	Path: C:\WINDOWS\system32\MSIMG32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755317013
Section loaded	Path: C:\WINDOWS\system32\msimg32.dll Access: query and write and read and execute Type: image Baseaddress: 76380000 Size: 20480 Protection: read write Mapped to pid: own pid	success or wait	755317843
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755332238
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755332452
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	success or wait	755343951
Message posted	HWND: A013E Message: DDE_TERMINATE WParam: 393464 LParam: 0	success	755347431
Window destroyed	HWND: 600F8	success	755351973
Windows enumerated	Desktop: 0 Parent: 0 Enum Children: false TID: 5D4 HWNDs: 6014A, 6012E, 500F2, 8013C, 1, 1, 10078, 10084, 10088, 1, 88000000, 88000000, 88000000, 88000000, 88000000	success or wait	755352123
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoRecentDocsHistory	object name not found	755353047
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: RecentFiles	success or wait	755353841
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755354391
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755354592
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755354839
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755356288
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755356559
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755357357
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	755362453
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755362990
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755363543
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755364919
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755368701
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755370072
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755370367
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755370789
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: UseDesktopIniCache	object name not found	755371275
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: UseDesktopIniCache	object name not found	755372029
File opened	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755372737
File read	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	755374291
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755376260
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755376557
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755383449
File opened	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755383822
File read	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	755385312
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755386481
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755386774
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755387175
File opened	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755387524
File read	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	755388949
File opened	Path: C:\Documents and Settings\Administrator\Application Data\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755390082
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755391505
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755393410
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755393988
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755394264
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755394564
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755395075
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755395354
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755395647
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755397203
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755397543
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755398985
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755399285
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755399804
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755400140
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755401564
Process information queried	PID: 900 Info Class: DefaultHardErrorMode	success or wait	755402328
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755402570
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755403989
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755404251
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755405037
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	755406556
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755407086
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755407638
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755408931
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755410988
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755412386
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Recent	object name not found	755414626
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: ProfileImagePath	success or wait	755415320
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc Name: Progid	object name not found	755421390
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.doc Name: Application	object name not found	755422688
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc Name: NULL	success or wait	755423676
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.doc Name: PerceivedType	object name not found	755426199
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8 Name: DocObject	object name not found	755429517
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc Name: DocObject	object name not found	755430242
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8 Name: BrowseInPlace	object name not found	755430929
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc Name: BrowseInPlace	object name not found	755431600
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8\CLSID Name: NULL	success or wait	755432666
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8 Name: IsShortcut	object name not found	755433656
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc Name: IsShortcut	object name not found	755434326
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8 Name: AlwaysShowExt	object name not found	755434992
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc Name: AlwaysShowExt	object name not found	755437917
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Word.Document.8 Name: NeverShowExt	object name not found	755438596
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\SystemFileAssociations\.doc Name: NeverShowExt	object name not found	755439266
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755440475
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755441938
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755442203
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755442970
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\iPhone 5.doc\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	object name not found	755443565
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\iPhone 5.doc.LNK Access: read attributes and delete Options: non directory file and open for backup ident and open reparse point Overwritten: false	object name not found	755449975
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Recent	object name not found	755455286
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: ProfileImagePath	success or wait	755455955
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755456700
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755456959
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755457701
Section loaded	Path: \KnownDlls\LINKINFO.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	755458358
File opened	Path: C:\WINDOWS\system32\LINKINFO.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755459067
Section loaded	Path: C:\WINDOWS\system32\linkinfo.dll Access: query and write and read and execute Type: image Baseaddress: 76980000 Size: 32768 Protection: read write Mapped to pid: own pid	success or wait	755459839
System info queried	Type: BasicInformation	success or wait	755466383
System info queried	Type: ProcessorInformation	success or wait	755466623
System info queried	Type: BasicInformation	success or wait	755466850
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Network\SharingHandler Name: NULL	success or wait	755469298
Section loaded	Path: \KnownDlls\ntshrui.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	755469940
File opened	Path: C:\WINDOWS\system32\ntshrui.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755470680
Section loaded	Path: C:\WINDOWS\system32\ntshrui.dll Access: query and write and read and execute Type: image Baseaddress: 76990000 Size: 151552 Protection: read write Mapped to pid: own pid	success or wait	755471508
Section loaded	Path: \KnownDlls\ATL.DLL Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	755474370
File opened	Path: C:\WINDOWS\system32\ATL.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755475127
Section loaded	Path: C:\WINDOWS\system32\atl.dll Access: query and write and read and execute Type: image Baseaddress: 76B20000 Size: 69632 Protection: read write Mapped to pid: own pid	success or wait	755475956
Section loaded	Path: \KnownDlls\NETAPI32.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	755485130
File opened	Path: C:\WINDOWS\system32\NETAPI32.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755485867
Section loaded	Path: C:\WINDOWS\system32\netapi32.dll Access: query and write and read and execute Type: image Baseaddress: 5B860000 Size: 348160 Protection: read write Mapped to pid: own pid	success or wait	755486785
File opened	Path: C:\WINDOWS\system32\ntshrui.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755501956
Section loaded	Path: C:\WINDOWS\system32\ntshrui.dll Access: read Type: commit Baseaddress: 1E70000 Size: 143360 Protection: readonly Mapped to pid: own pid	success or wait	755502809
File opened	Path: C:\WINDOWS\system32\ntshrui.dll.123.Manifest Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	755503690
File opened	Path: C:\WINDOWS\system32\ntshrui.dll.123.Config Access: read data or list directory and read ea and execute or traverse and read attributes and read control and synchronize Options: synchronous io non alert and non directory file Overwritten: false	object name not found	755504684
File opened	Path: C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202 Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	755534017
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755535091
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755535393
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755536600
File opened	Path: \pipe\srvsvc Access: read attributes and synchronize and generic read and generic write Options: non directory file and open no recall Attributes: none Content Overwritten: true	success or wait	755537343
File other op	Path: \srvsvc New path: Disposition: PipeInformation Data : unknown	success or wait	755538207
File other op	Path: \srvsvc New path: Disposition: CompletionInformation Data : unknown	success or wait	755540894
File write	Path: \srvsvc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 C8 4F 32 4B 70 16 D3 01 12 78 5A 47 BF 6E E1 88 03 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	755541271
File read	Path: \srvsvc Offset: 0 Length: 1024 Value: 05 00 02 03 10 00 00 00 30 00 00 00 03 00 00 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 18 35 18 00 38 35 18 00 10 00 00 00 00 00 00 00 0F 00 00 00 48 00 41 00 4E 00 55 00 45 00 4C 00 45 00 2D 00 42 00 43 00 36 00 30 00 37 00 32 00 30 00 00 00	pending	755541628
File control set	Path: \srvsvc Control Code: 11C017 Input Buffer: ........8....... .......................................	pending	755542907
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ProductOptions Name: ProductType	success or wait	755546528
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\DefaultSecurity Name: SrvsvcDefaultShareInfo	object name not found	755547306
File opened	Path: \pipe\lsarpc Access: read attributes and synchronize and generic read and generic write Options: non directory file Attributes: none Content Overwritten: true	success or wait	755548097
File other op	Path: \lsarpc New path: Disposition: PipeInformation Data : unknown	success or wait	755548897
File other op	Path: \lsarpc New path: Disposition: CompletionInformation Data : unknown	success or wait	755549219
File write	Path: \lsarpc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 78 57 34 12 34 12 CD AB EF 00 01 23 45 67 89 AB 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	755549590
File read	Path: \lsarpc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 32 16 00 00 0C 00 5C 50 49 50 45 5C 6C 73 61 73 73 00 00 00 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 00 00 00 00 A4 C6 1C 00 00 00 00 00 00 00 00 00 00 00 00 00 A8 C6 1C 00 00 00 00 80 B8 C6 1C 00	success or wait	755550757
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........8....... .....,.................................	pending	755551698
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ..............................&..aoN...V..Jn..	pending	755553450
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ..............................&..aoN...V..Jn..	pending	755554338
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,.....................&..aoN...V..Jn	pending	755555203
File control set	Path: \srvsvc Control Code: 11C017 Input Buffer: ........D.......,.........................Jn............C.$.........	pending	755556127
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	755557162
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\iPhone 5.doc Access: read attributes and synchronize Options: synchronous io non alert and open for backup ident Attributes: normal Content Overwritten: true	success or wait	755557884
File control set	Path: C:\Documents and Settings\Administrator\Local Settings\iPhone 5.doc Control Code: 900C0 Input Buffer:	success or wait	755558863
File opened	Path: C:\Documents and Settings\Administrator\Local Settings Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	file is a directory	755562094
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\ Access: read attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Attributes: normal Content Overwritten: true	success or wait	755562696
File control set	Path: C:\Documents and Settings\Administrator\Local Settings Control Code: get reparse point Input Buffer:	not a reparse point	755588385
File opened	Path: C:\Documents and Settings\Administrator\Local Settings Access: read attributes and synchronize Options: synchronous io non alert Overwritten: false	success or wait	755589246
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	755590610
File created	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\iPhone 5.doc.LNK Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	755594073
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	755602946
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755603537
Section loaded	Path: unknown Access: query and write and read Type: commit Baseaddress: 1E70000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	755604197
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: CompareJunctionness	object name not found	755613481
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: CompareJunctionness	object name not found	755615107
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Start Menu	success or wait	755616437
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Start Menu Type: unicode Data: C:\Documents and Settings\Administrator\Start Menu Old data:	success or wait	755618096
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755622228
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755622526
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755623387
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755624065
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755625436
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755633936
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755635386
File opened	Path: C:\Documents and Settings\Administrator\Start Menu\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755637120
File read	Path: C:\Documents and Settings\Administrator\Start Menu\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 36 0D 0A	success or wait	755640182
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755642230
File opened	Path: C:\Documents and Settings\Administrator\Start Menu\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755643408
File read	Path: C:\Documents and Settings\Administrator\Start Menu\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 36 0D 0A	success or wait	755658109
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755659290
File opened	Path: C:\Documents and Settings\Administrator\Start Menu\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755660868
File read	Path: C:\Documents and Settings\Administrator\Start Menu\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 36 0D 0A	success or wait	755671171
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Common Start Menu	success or wait	755673020
Key value replaced with same	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Common Start Menu Type: unicode Data: C:\Documents and Settings\All Users\Start Menu Old data:	success or wait	755674506
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755679196
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755679519
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755680382
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755681062
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755682429
File opened	Path: C:\Documents and Settings\All Users\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755683841
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755685251
File opened	Path: C:\Documents and Settings\All Users\Start Menu\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755686443
File read	Path: C:\Documents and Settings\All Users\Start Menu\desktop.ini Offset: unknown Length: 272 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 36 0D 0A 5B 4C 6F 63 61 6C 69 7A 65 64 46 69 6C 65 4E 61 6D 65 73 5D 0D 0A 57 69 6E 64 6F 77 73 20 43 61 74 61 6C 6F 67 2E	success or wait	755693603
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755695836
File opened	Path: C:\Documents and Settings\All Users\Start Menu\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755697019
File read	Path: C:\Documents and Settings\All Users\Start Menu\desktop.ini Offset: unknown Length: 272 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 36 0D 0A 5B 4C 6F 63 61 6C 69 7A 65 64 46 69 6C 65 4E 61 6D 65 73 5D 0D 0A 57 69 6E 64 6F 77 73 20 43 61 74 61 6C 6F 67 2E	success or wait	755701695
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755702994
File opened	Path: C:\Documents and Settings\All Users\Start Menu\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755704143
File read	Path: C:\Documents and Settings\All Users\Start Menu\desktop.ini Offset: unknown Length: 272 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 36 0D 0A 5B 4C 6F 63 61 6C 69 7A 65 64 46 69 6C 65 4E 61 6D 65 73 5D 0D 0A 57 69 6E 64 6F 77 73 20 43 61 74 61 6C 6F 67 2E	success or wait	755706459
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Common Desktop	success or wait	755708348
Key value replaced with same	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Common Desktop Type: unicode Data: C:\Documents and Settings\All Users\Desktop Old data:	success or wait	755709785
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755710968
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755711265
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755712108
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755712774
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755714131
File opened	Path: C:\Documents and Settings\All Users\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755718125
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Common AppData	success or wait	755720116
Key value replaced with same	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Common AppData Type: unicode Data: C:\Documents and Settings\All Users\Application Data Old data:	success or wait	755722164
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755722617
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755722911
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755723767
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755724431
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755725952
File opened	Path: C:\Documents and Settings\All Users\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755729167
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755730593
File opened	Path: C:\Documents and Settings\All Users\Application Data\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755732791
File read	Path: C:\Documents and Settings\All Users\Application Data\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	755734461
Process information queried	PID: 900 Info Class: DeviceMap	success or wait	755736553
File opened	Path: C:\Documents and Settings\All Users\Application Data\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755737825
File read	Path: C:\Documents and Settings\All Users\Application Data\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	755739415
File opened	Path: C:\Documents and Settings\All Users\Application Data\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755742276
File read	Path: C:\Documents and Settings\All Users\Application Data\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	755746460
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: AppData	success or wait	755748291
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: AppData Type: unicode Data: C:\Documents and Settings\Administrator\Application Data Old data:	success or wait	755749967
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755751619
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755752288
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755756704
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755758113
File opened	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755760751
File read	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	755762357
File opened	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755767041
File read	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	755768631
File opened	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755770916
File read	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	755772440
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755778740
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755779452
File opened	Path: C:\WINDOWS\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755780813
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755783612
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755784280
File opened	Path: C:\WINDOWS\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755785612
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755790164
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755790832
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: My Pictures	success or wait	755792760
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: My Pictures Type: unicode Data: C:\Documents and Settings\Administrator\My Documents\My Pictures Old data:	success or wait	755794574
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755796165
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755799227
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755800584
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755801991
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755804576
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	755806160
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755808455
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	755811711
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755814331
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	755815923
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755817158
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	755818757
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755823879
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	755825421
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755829720
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	755831300
File opened	Path: C:\Documents and Settings\Administrator\My Documents\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755832753
File opened	Path: C:\Documents and Settings\Administrator\My Documents\My Pictures\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755835438
File read	Path: C:\Documents and Settings\Administrator\My Documents\My Pictures\Desktop.ini Offset: unknown Length: 191 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 33 39 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 50 69 63 74 75 72 65 73 0D 0A 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F	success or wait	755839569
File opened	Path: C:\Documents and Settings\Administrator\My Documents\My Pictures\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755841514
File read	Path: C:\Documents and Settings\Administrator\My Documents\My Pictures\Desktop.ini Offset: unknown Length: 191 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 33 39 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 50 69 63 74 75 72 65 73 0D 0A 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F	success or wait	755843172
File opened	Path: C:\Documents and Settings\Administrator\My Documents\My Pictures\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755846083
File read	Path: C:\Documents and Settings\Administrator\My Documents\My Pictures\Desktop.ini Offset: unknown Length: 191 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 33 39 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 50 69 63 74 75 72 65 73 0D 0A 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F	success or wait	755847712
File opened	Path: C:\Documents and Settings\Administrator\My Documents\My Pictures\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755852141
File read	Path: C:\Documents and Settings\Administrator\My Documents\My Pictures\Desktop.ini Offset: unknown Length: 191 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 33 39 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 50 69 63 74 75 72 65 73 0D 0A 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F	success or wait	755853856
File opened	Path: C:\Documents and Settings\Administrator\My Documents\My Pictures\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755856572
File read	Path: C:\Documents and Settings\Administrator\My Documents\My Pictures\Desktop.ini Offset: unknown Length: 191 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 33 39 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 50 69 63 74 75 72 65 73 0D 0A 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F	success or wait	755858154
File opened	Path: C:\Documents and Settings\Administrator\My Documents\My Pictures\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755862958
File read	Path: C:\Documents and Settings\Administrator\My Documents\My Pictures\Desktop.ini Offset: unknown Length: 191 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 33 39 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 50 69 63 74 75 72 65 73 0D 0A 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F	success or wait	755864529
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Personal	success or wait	755866544
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Personal Type: unicode Data: C:\Documents and Settings\Administrator\My Documents Old data:	success or wait	755868191
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755869887
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755873003
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755874423
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755875885
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755878569
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	755880259
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755881582
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	755885526
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755888267
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	755889925
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755891198
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	755892855
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755898165
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	755900057
File opened	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755906106
File read	Path: C:\Documents and Settings\Administrator\My Documents\desktop.ini Offset: unknown Length: 84 Value: 5B 44 65 6C 65 74 65 4F 6E 43 6F 70 79 5D 0D 0A 4F 77 6E 65 72 3D 41 64 6D 69 6E 69 73 74 72 61 74 6F 72 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 3D 35 0D 0A 50 65 72 73 6F 6E 61 6C 69 7A 65 64 4E 61 6D 65 3D 4D 79 20 44 6F 63 75 6D 65 6E 74 73 0D 0A	success or wait	755907708
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: ProgramFilesDir (x86)	object name not found	755909546
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: ProgramFilesDir	success or wait	755910283
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755917396
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755918071
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: CommonPictures	object name not found	755925931
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: ProfilesDirectory	success or wait	755926602
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: AllUsersProfile	success or wait	755927267
Key value replaced with same	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: CommonPictures Type: unicode Data: C:\Documents and Settings\All Users\Documents\My Pictures Old data:	success or wait	755928886
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755930483
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755931156
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755932510
File opened	Path: C:\Documents and Settings\All Users\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755939733
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755942344
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	755943915
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755947020
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	755950376
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755952704
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	755954207
File opened	Path: C:\Documents and Settings\All Users\Documents\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755955541
File opened	Path: C:\Documents and Settings\All Users\Documents\My Pictures\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755958424
File read	Path: C:\Documents and Settings\All Users\Documents\My Pictures\Desktop.ini Offset: unknown Length: 150 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 49 6E 66 6F 54 69 70 3D 40 53 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 31 32 36 38 38 0D 0A 49 63 6F 6E 46 69 6C 65 3D 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 6D 79 64 6F 63 73 2E 64 6C 6C 0D 0A 49 63 6F 6E 49 6E 64 65 78	success or wait	755962591
File opened	Path: C:\Documents and Settings\All Users\Documents\My Pictures\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755965940
File read	Path: C:\Documents and Settings\All Users\Documents\My Pictures\Desktop.ini Offset: unknown Length: 150 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 49 6E 66 6F 54 69 70 3D 40 53 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 31 32 36 38 38 0D 0A 49 63 6F 6E 46 69 6C 65 3D 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 6D 79 64 6F 63 73 2E 64 6C 6C 0D 0A 49 63 6F 6E 49 6E 64 65 78	success or wait	755967565
File opened	Path: C:\Documents and Settings\All Users\Documents\My Pictures\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755971072
File read	Path: C:\Documents and Settings\All Users\Documents\My Pictures\Desktop.ini Offset: unknown Length: 150 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 49 6E 66 6F 54 69 70 3D 40 53 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 31 32 36 38 38 0D 0A 49 63 6F 6E 46 69 6C 65 3D 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 6D 79 64 6F 63 73 2E 64 6C 6C 0D 0A 49 63 6F 6E 49 6E 64 65 78	success or wait	755974442
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Common Documents	success or wait	755976334
Key value replaced with same	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: Common Documents Type: unicode Data: C:\Documents and Settings\All Users\Documents Old data:	success or wait	755977827
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	755980034
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755980814
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755983315
File opened	Path: C:\Documents and Settings\All Users\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	755984763
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755988407
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	755990061
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755993206
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	755994868
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	755997685
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	755999260
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{59031a47-3f72-44a7-89c5-5595fe6b30ee}\InProcServer32 Name: NULL	success or wait	756002151
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer Name: NoSharedDocuments	object name not found	756003333
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoSharedDocuments	object name not found	756004103
File opened	Path: \pipe\wkssvc Access: read attributes and synchronize and generic read and generic write Options: non directory file and open no recall Attributes: none Content Overwritten: true	success or wait	756005085
File other op	Path: \wkssvc New path: Disposition: PipeInformation Data : unknown	success or wait	756005922
File other op	Path: \wkssvc New path: Disposition: CompletionInformation Data : unknown	success or wait	756007376
File write	Path: \wkssvc Offset: 0 Length: 72 Value: 05 00 0B 03 10 00 00 00 48 00 00 00 01 00 00 00 B8 10 B8 10 00 00 00 00 01 00 00 00 00 00 01 00 98 D0 FF 6B 12 A1 10 36 98 33 46 C3 F8 7E 34 5A 01 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00	success or wait	756007813
File read	Path: \wkssvc Offset: 0 Length: 1024 Value: 05 00 0C 03 10 00 00 00 44 00 00 00 01 00 00 00 B8 10 B8 10 77 18 00 00 0D 00 5C 50 49 50 45 5C 77 6B 73 73 76 63 00 80 01 00 00 00 00 00 00 00 04 5D 88 8A EB 1C C9 11 9F E8 08 00 2B 10 48 60 02 00 00 00 0E 00 00 00 00 00 00 00 0E 00 00 00 44 00 65 00 66 00 61 00 75 00 6C 00 74 00 20 00 73 00 68 00	success or wait	756008572
File control set	Path: \wkssvc Control Code: 11C017 Input Buffer: ........ .......................	pending	756009562
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: CommonMusic	object name not found	756015904
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: ProfilesDirectory	success or wait	756016562
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: AllUsersProfile	success or wait	756017464
Key value replaced with same	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: CommonMusic Type: unicode Data: C:\Documents and Settings\All Users\Documents\My Music Old data:	success or wait	756019036
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	756020904
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756034138
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756035513
File opened	Path: C:\Documents and Settings\All Users\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756036975
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756043918
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	756045500
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756050107
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	756051698
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756054208
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	756055716
File opened	Path: C:\Documents and Settings\All Users\Documents\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756056867
File opened	Path: C:\Documents and Settings\All Users\Documents\My Music\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756060373
File read	Path: C:\Documents and Settings\All Users\Documents\My Music\Desktop.ini Offset: unknown Length: 151 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 49 6E 66 6F 54 69 70 3D 40 53 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 31 32 36 38 39 0D 0A 49 63 6F 6E 46 69 6C 65 3D 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 53 48 45 4C 4C 33 32 2E 64 6C 6C 0D 0A 49 63 6F 6E 49 6E 64 65	success or wait	756062033
File opened	Path: C:\Documents and Settings\All Users\Documents\My Music\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756071520
File read	Path: C:\Documents and Settings\All Users\Documents\My Music\Desktop.ini Offset: unknown Length: 151 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 49 6E 66 6F 54 69 70 3D 40 53 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 31 32 36 38 39 0D 0A 49 63 6F 6E 46 69 6C 65 3D 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 53 48 45 4C 4C 33 32 2E 64 6C 6C 0D 0A 49 63 6F 6E 49 6E 64 65	success or wait	756073133
File opened	Path: C:\Documents and Settings\All Users\Documents\My Music\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756083680
File read	Path: C:\Documents and Settings\All Users\Documents\My Music\Desktop.ini Offset: unknown Length: 151 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 49 6E 66 6F 54 69 70 3D 40 53 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 31 32 36 38 39 0D 0A 49 63 6F 6E 46 69 6C 65 3D 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 53 48 45 4C 4C 33 32 2E 64 6C 6C 0D 0A 49 63 6F 6E 49 6E 64 65	success or wait	756085251
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: CommonVideo	object name not found	756089653
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: ProfilesDirectory	success or wait	756090311
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList Name: AllUsersProfile	success or wait	756090968
Key value replaced with same	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders Name: CommonVideo Type: unicode Data: C:\Documents and Settings\All Users\Documents\My Videos Old data:	success or wait	756092569
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	756094224
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756099792
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756101141
File opened	Path: C:\Documents and Settings\All Users\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756102548
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756105155
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	756106728
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756112895
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	756114460
File opened	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756117433
File read	Path: C:\Documents and Settings\All Users\Documents\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 38 35 0D 0A	success or wait	756119002
File opened	Path: C:\Documents and Settings\All Users\Documents\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756120170
File opened	Path: C:\Documents and Settings\All Users\Documents\My Videos\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756122879
File read	Path: C:\Documents and Settings\All Users\Documents\My Videos\Desktop.ini Offset: unknown Length: 151 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 49 6E 66 6F 54 69 70 3D 40 53 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 31 32 36 39 30 0D 0A 49 63 6F 6E 46 69 6C 65 3D 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 53 48 45 4C 4C 33 32 2E 64 6C 6C 0D 0A 49 63 6F 6E 49 6E 64 65	success or wait	756124468
File opened	Path: C:\Documents and Settings\All Users\Documents\My Videos\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756130963
File read	Path: C:\Documents and Settings\All Users\Documents\My Videos\Desktop.ini Offset: unknown Length: 151 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 49 6E 66 6F 54 69 70 3D 40 53 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 31 32 36 39 30 0D 0A 49 63 6F 6E 46 69 6C 65 3D 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 53 48 45 4C 4C 33 32 2E 64 6C 6C 0D 0A 49 63 6F 6E 49 6E 64 65	success or wait	756132601
File opened	Path: C:\Documents and Settings\All Users\Documents\My Videos\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756135011
File read	Path: C:\Documents and Settings\All Users\Documents\My Videos\Desktop.ini Offset: unknown Length: 151 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 49 6E 66 6F 54 69 70 3D 40 53 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 31 32 36 39 30 0D 0A 49 63 6F 6E 46 69 6C 65 3D 25 53 79 73 74 65 6D 52 6F 6F 74 25 5C 73 79 73 74 65 6D 33 32 5C 53 48 45 4C 4C 33 32 2E 64 6C 6C 0D 0A 49 63 6F 6E 49 6E 64 65	success or wait	756136594
File write	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\iPhone 5.doc.LNK Offset: unknown Length: 737 Value: 4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 8B 00 00 00 20 00 00 00 1E EF 1E 83 EA 69 CD 01 50 40 95 84 EA 69 CD 01 78 51 21 83 EA 69 CD 01 00 54 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6D 01 14 00 1F 50 E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D 19 00	success or wait	756141602
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	756145273
Section loaded	Path: unknown Access: query and write and read Type: commit Baseaddress: 1E70000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	756147487
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	756157218
Section loaded	Path: unknown Access: query and write and read Type: commit Baseaddress: 1E70000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	756163188
Section loaded	Path: unknown Access: query and write and read Type: commit Baseaddress: 1E70000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	756166305
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756172555
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: RecentFiles	success or wait	756178082
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Access: synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	756178635
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Offset: unknown Length: 77 Value: 5B 66 6F 6C 64 65 72 73 5D 0D 0A 54 65 6D 70 6C 61 74 65 73 2E 4C 4E 4B 3D 30 0D 0A 61 6C 6C 2E 4C 4E 4B 3D 30 0D 0A 44 65 73 6B 74 6F 70 2E 4C 4E 4B 3D 30 0D 0A 5B 70 70 74 5D 0D 0A 74 65 73 74 2E 70 70 74 2E 4C 4E 4B 3D 30 0D 0A	success or wait	756180279
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Access: synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	756181931
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Offset: unknown Length: 77 Value: 5B 66 6F 6C 64 65 72 73 5D 0D 0A 54 65 6D 70 6C 61 74 65 73 2E 4C 4E 4B 3D 30 0D 0A 61 6C 6C 2E 4C 4E 4B 3D 30 0D 0A 44 65 73 6B 74 6F 70 2E 4C 4E 4B 3D 30 0D 0A 5B 70 70 74 5D 0D 0A 74 65 73 74 2E 70 70 74 2E 4C 4E 4B 3D 30 0D 0A	success or wait	756183333
File write	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Offset: 77 Length: 27 Value: 5B 64 6F 63 5D 0D 0A 69 50 68 6F 6E 65 20 35 2E 64 6F 63 2E 4C 4E 4B 3D 30 0D 0A	success or wait	756183823
File other op	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat New path: Disposition: EndOfFileInformation Data : unknown	success or wait	756184589
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	756186123
File other op	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: directory and archive and temporary	success or wait	756188415
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756192872
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	756195408
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Offset: unknown Length: 104 Value: 5B 66 6F 6C 64 65 72 73 5D 0D 0A 54 65 6D 70 6C 61 74 65 73 2E 4C 4E 4B 3D 30 0D 0A 61 6C 6C 2E 4C 4E 4B 3D 30 0D 0A 44 65 73 6B 74 6F 70 2E 4C 4E 4B 3D 30 0D 0A 5B 70 70 74 5D 0D 0A 74 65 73 74 2E 70 70 74 2E 4C 4E 4B 3D 30 0D 0A 5B 64 6F 63 5D 0D 0A 69 50 68 6F 6E 65 20 35 2E 64 6F 63 2E 4C 4E 4B	success or wait	756196732
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer Name: NoRecentDocsHistory	object name not found	756197793
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: RecentFiles	success or wait	756198180
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756199184
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	756205432
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	756207022
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756210304
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756211654
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756213003
File opened	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756215416
File read	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	756216893
File opened	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756223005
File read	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	756224468
File opened	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Access: synchronize and generic read Options: synchronous io non alert and non directory file Overwritten: false	success or wait	756226574
File read	Path: C:\Documents and Settings\Administrator\Application Data\desktop.ini Offset: unknown Length: 62 Value: 5B 2E 53 68 65 6C 6C 43 6C 61 73 73 49 6E 66 6F 5D 0D 0A 4C 6F 63 61 6C 69 7A 65 64 52 65 73 6F 75 72 63 65 4E 61 6D 65 3D 40 73 68 65 6C 6C 33 32 2E 64 6C 6C 2C 2D 32 31 37 36 35 0D 0A	success or wait	756227988
File opened	Path: C:\Documents and Settings\Administrator\Application Data\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756232460
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756243376
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756246144
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756249948
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	756252372
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	756253687
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756254736
File opened	Path: C:\Documents and Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756258329
File opened	Path: C:\Documents and Settings\Administrator\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756259689
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Recent	object name not found	756261710
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: ProfileImagePath	success or wait	756262382
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756265205
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	756268119
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Local Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	object name not found	756268718
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Local Settings.LNK Access: read attributes and delete Options: non directory file and open for backup ident and open reparse point Overwritten: false	object name not found	756274923
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Recent	object name not found	756276635
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: ProfileImagePath	success or wait	756277290
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\CPC\Volume\{0d6ab97b-ade6-11de-bdcc-806d6172696f} Name: Generation	success or wait	756279027
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Fonts	object name not found	756280826
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Network\SharingHandler Name: NULL	success or wait	756281946
File opened	Path: C:\Documents and Settings\Administrator\Local Settings\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756284092
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Recent	object name not found	756285713
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-507921405-1960408961-839522115-500 Name: ProfileImagePath	success or wait	756286390
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756288035
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\lanmanserver\DefaultSecurity Name: SrvsvcDefaultShareInfo	object name not found	756289627
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........8....... .....,.................................	pending	756290308
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ............................X.8.Ch.L...,......	pending	756291835
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ............................X.8.Ch.L...,......	pending	756292692
File control set	Path: \lsarpc Control Code: 11C017 Input Buffer: ........,...................X.8.Ch.L...,....	pending	756293926
File control set	Path: \srvsvc Control Code: 11C017 Input Buffer: ........D.......,.......................................C.$.........	pending	756294873
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	756295894
File opened	Path: C:\Documents and Settings\Administrator\Local Settings Access: read attributes and synchronize Options: synchronous io non alert and open for backup ident Attributes: normal Content Overwritten: true	success or wait	756296610
File control set	Path: C:\Documents and Settings\Administrator\Local Settings Control Code: 900C0 Input Buffer:	success or wait	756297514
File opened	Path: C:\Documents and Settings\Administrator Access: read attributes and synchronize Options: synchronous io non alert and non directory file Overwritten: false	file is a directory	756298824
File opened	Path: C:\Documents and Settings\Administrator\ Access: read attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Attributes: normal Content Overwritten: true	success or wait	756299380
File control set	Path: C:\Documents and Settings\Administrator Control Code: get reparse point Input Buffer:	not a reparse point	756300510
File opened	Path: C:\Documents and Settings\Administrator Access: read attributes and synchronize Options: synchronous io non alert Overwritten: false	success or wait	756301359
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\ComputerName\ActiveComputerName Name: ComputerName	success or wait	756302624
File created	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Local Settings.LNK Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	756305284
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	756310599
Section loaded	Path: unknown Access: query and write and read Type: commit Baseaddress: 1E70000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	756311820
File write	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\Local Settings.LNK Offset: unknown Length: 622 Value: 4C 00 00 00 01 14 02 00 00 00 00 00 C0 00 00 00 00 00 00 46 8B 00 00 00 12 00 00 00 8A FF 93 68 2F 42 CA 01 8C 0C 4E 91 EA 69 CD 01 60 60 E0 90 EA 69 CD 01 00 00 00 00 00 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 21 01 14 00 1F 50 E0 4F D0 20 EA 3A 69 10 A2 D8 08 00 2B 30 30 9D 19 00	success or wait	756316669
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	756320230
Section loaded	Path: unknown Access: query and write and read Type: commit Baseaddress: 1E70000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	756321463
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Drive\shellex\FolderExtensions\{fbeb8a05-beee-4442-804e-409d6c4515e9} Name: DriveMask	success or wait	756327306
Section loaded	Path: unknown Access: query and write and read Type: commit Baseaddress: 1E70000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	756328472
Section loaded	Path: unknown Access: query and write and read Type: commit Baseaddress: 1E70000 Size: 4096 Protection: read write Mapped to pid: own pid	success or wait	756331526
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756335075
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: RecentFiles	success or wait	756336462
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Access: synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	756337046
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Offset: unknown Length: 104 Value: 5B 66 6F 6C 64 65 72 73 5D 0D 0A 54 65 6D 70 6C 61 74 65 73 2E 4C 4E 4B 3D 30 0D 0A 61 6C 6C 2E 4C 4E 4B 3D 30 0D 0A 44 65 73 6B 74 6F 70 2E 4C 4E 4B 3D 30 0D 0A 5B 70 70 74 5D 0D 0A 74 65 73 74 2E 70 70 74 2E 4C 4E 4B 3D 30 0D 0A 5B 64 6F 63 5D 0D 0A 69 50 68 6F 6E 65 20 35 2E 64 6F 63 2E 4C 4E 4B	success or wait	756338424
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Access: synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	756339488
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Offset: unknown Length: 104 Value: 5B 66 6F 6C 64 65 72 73 5D 0D 0A 54 65 6D 70 6C 61 74 65 73 2E 4C 4E 4B 3D 30 0D 0A 61 6C 6C 2E 4C 4E 4B 3D 30 0D 0A 44 65 73 6B 74 6F 70 2E 4C 4E 4B 3D 30 0D 0A 5B 70 70 74 5D 0D 0A 74 65 73 74 2E 70 70 74 2E 4C 4E 4B 3D 30 0D 0A 5B 64 6F 63 5D 0D 0A 69 50 68 6F 6E 65 20 35 2E 64 6F 63 2E 4C 4E 4B	success or wait	756340852
File write	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Offset: 54 Length: 72 Value: 4C 6F 63 61 6C 20 53 65 74 74 69 6E 67 73 2E 4C 4E 4B 3D 30 0D 0A 5B 70 70 74 5D 0D 0A 74 65 73 74 2E 70 70 74 2E 4C 4E 4B 3D 30 0D 0A 5B 64 6F 63 5D 0D 0A 69 50 68 6F 6E 65 20 35 2E 64 6F 63 2E 4C 4E 4B 3D 30 0D 0A	success or wait	756341366
File other op	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat New path: Disposition: EndOfFileInformation Data : unknown	success or wait	756342045
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	756343570
File other op	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat New path: Disposition: BasicInformation Data : Creation Time: 01:00 01-01-1601 Last Access Time: 01:00 01-01-1601 Last Write Time: 01:00 01-01-1601 Change Time: 01:00 01-01-1601 File Attributes: directory and archive and temporary	success or wait	756344461
File opened	Path: C:\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	756345924
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Access: write attributes and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	756349217
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Office\Recent\index.dat Offset: unknown Length: 126 Value: 5B 66 6F 6C 64 65 72 73 5D 0D 0A 54 65 6D 70 6C 61 74 65 73 2E 4C 4E 4B 3D 30 0D 0A 61 6C 6C 2E 4C 4E 4B 3D 30 0D 0A 44 65 73 6B 74 6F 70 2E 4C 4E 4B 3D 30 0D 0A 4C 6F 63 61 6C 20 53 65 74 74 69 6E 67 73 2E 4C 4E 4B 3D 30 0D 0A 5B 70 70 74 5D 0D 0A 74 65 73 74 2E 70 70 74 2E 4C 4E 4B 3D 30 0D 0A 5B	success or wait	756350571
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Wizards Name: Assistant Time Stamp	object name not found	758137336
Mutant created	Name: \BaseNamedObjects\OfficeAssistantStateMutex	success or wait	758137759
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Assistant Name: AsstState	object name not found	758138556
System info queried	Type: PerformanceInformation	success or wait	758139018
Process information queried	PID: 900 Info Class: QuotaLimits	success or wait	758139432
Process information queried	PID: 900 Info Class: VmCounters	success or wait	758139638
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Office\Common\Assistant Name: CurrAsstState Type: dword Data: 38 Old data:	success or wait	758139911
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common Name: ScreenReaderPresent	object name not found	758140347
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9B92EB61-CBC1-11D3-8C2D-00A0CC37B591}\1.2\0\win32 Name: NULL	buffer overflow	758147682
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{9B92EB61-CBC1-11D3-8C2D-00A0CC37B591}\1.2\0\win32 Name: NULL	success or wait	758148002
Key created	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications	success or wait	758151595
Key created	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp	success or wait	758154592
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp Name: FriendlyName Type: unicode Data: Microsoft Word 11.0 Old data:	success or wait	758155499
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp Name: LabelText Type: binary Data: 01 00 00 00 Old data:	success or wait	758155882
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp Name: Save Type: binary Data: 01 00 00 00 Old data:	success or wait	758156303
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp Name: ShowButtons Type: binary Data: 01 00 00 00 Old data:	success or wait	758156658
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp Name: ShowIndicators Type: binary Data: 01 00 00 00 Old data:	success or wait	758158045
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp Keyname: NoLabelOption	object name not found	758158376
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp Keyname: NoSaveOption	object name not found	758158566
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp Keyname: NoButtonOption	object name not found	758158752
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Applications\OpusApp Keyname: NoIndicatorOption	object name not found	758158939
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag Name: migratedBitValues	object name not found	758159438
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6} Name: Status	success or wait	758160024
Key value deleted	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6} Keyname: Status	success or wait	758160339
Key created	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#stockticker	success or wait	758163680
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#stockticker Name: OpusApp Type: dword Data: 1 Old data:	success or wait	758165318
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#phone Name: OpusApp Type: dword Data: 1 Old data:	success or wait	758167299
Key created	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#date	success or wait	758168771
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\urn:schemas-microsoft-com:office:smarttags#date Name: XLMAIN Type: dword Data: 1 Old data:	success or wait	758169426
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888} Name: Status	object name not found	758170275
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A} Name: Status	object name not found	758171682
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A} Name: Status	object name not found	758172354
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD} Name: Status	object name not found	758173022
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6} Name: Status	object name not found	758173689
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F} Name: Status	object name not found	758174358
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD} Name: Status	object name not found	758175023
Key value set	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag Name: migratedBitValues Type: binary Data: 01 00 00 00 Old data:	success or wait	758175683
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{06F9A697-9708-422D-A5AF-C559391A850A} Name: Managed	object name not found	758177557
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A} Name: Managed	object name not found	758178223
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{339361CD-6723-455D-A40B-C95F1F91FF8A}\InprocServer32 Name:	success or wait	758179310
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{339361CD-6723-455D-A40B-C95F1F91FF8A}\InprocServer32 Name:	success or wait	758179897
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758180816
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A} Name: OpusApp	object name not found	758182171
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A} Name: defaultStatus	object name not found	758182490
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{339361CD-6723-455D-A40B-C95F1F91FF8A} Name: Solution	object name not found	758182801
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD} Name: Managed	object name not found	758183476
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}\InprocServer32 Name:	success or wait	758184495
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD}\InprocServer32 Name:	success or wait	758185127
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758185961
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD} Name: OpusApp	object name not found	758187216
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD} Name: defaultStatus	object name not found	758187531
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{49DF3409-46B3-4B0C-B7BF-FEC0F9401EDD} Name: Solution	object name not found	758187806
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6} Name: Managed	object name not found	758188505
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\InprocServer32 Name:	success or wait	758189573
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\InprocServer32 Name:	success or wait	758190126
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758190957
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6} Name: OpusApp	object name not found	758192200
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6} Name: defaultStatus	object name not found	758192720
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6} Name: Solution	object name not found	758193036
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F} Name: Managed	object name not found	758193891
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3754D1A-04D3-4085-8CFB-97705B57A98F}\InprocServer32 Name:	success or wait	758197260
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C3754D1A-04D3-4085-8CFB-97705B57A98F}\InprocServer32 Name:	success or wait	758197819
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758198649
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F} Name: OpusApp	object name not found	758199930
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F} Name: defaultStatus	object name not found	758200243
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{C3754D1A-04D3-4085-8CFB-97705B57A98F} Name: Solution	object name not found	758200555
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD} Name: Managed	object name not found	758201222
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F114AE61-1331-4238-92C9-BBE330AF25FD}\InprocServer32 Name:	success or wait	758203139
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F114AE61-1331-4238-92C9-BBE330AF25FD}\InprocServer32 Name:	success or wait	758203696
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758204531
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD} Name: OpusApp	object name not found	758205790
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD} Name: defaultStatus	object name not found	758206108
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Actions\{F114AE61-1331-4238-92C9-BBE330AF25FD} Name: Solution	object name not found	758206420
Foreground Window Got	HWND: 6014A	success	758207605
Foreground Window Got	HWND: 6014A	success	758207760
Foreground Window Got	HWND: 6014A	success	758208016
Foreground Window Got	HWND: 6014A	success	758208166
Foreground Window Got	HWND: 6014A	success	758208401
Foreground Window Got	HWND: 6014A	success	758208549
Foreground Window Got	HWND: 6014A	success	758208784
Foreground Window Got	HWND: 6014A	success	758208931
Foreground Window Got	HWND: 6014A	success	758209166
Foreground Window Got	HWND: 6014A	success	758209314
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6} Name: Managed	object name not found	758209792
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\InprocServer32 Name:	success or wait	758210792
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6}\InprocServer32 Name:	success or wait	758211338
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758212164
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6} Name: OpusApp	success or wait	758213836
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{64AB6C69-B40E-40AF-9B7F-F5687B48E2B6} Name: Solution	object name not found	758214152
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888} Name: Managed	object name not found	758214820
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}\InprocServer32 Name:	success or wait	758215836
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{87EF1CFE-51CA-4E6B-8C76-E576AA926888}\InprocServer32 Name:	success or wait	758216441
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758217268
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888} Name: OpusApp	object name not found	758218514
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888} Name: defaultStatus	object name not found	758218829
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common\Smart Tag\Recognizers\{87EF1CFE-51CA-4E6B-8C76-E576AA926888} Name: Solution	object name not found	758219137
Foreground Window Got	HWND: 6014A	success	758219801
Foreground Window Got	HWND: 6014A	success	758219951
Foreground Window Got	HWND: 6014A	success	758220189
Foreground Window Got	HWND: 6014A	success	758220338
Thread created	PID: 900 TID: 1556 EIP: 7C8106F9 EAX: 30D5CF6C Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	758221660
Thread resumed	TID: 1556 PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	758222410
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	758224947
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Access: write and read and execute Type: commit Baseaddress: 1E70000 Size: 131072 Protection: execute Mapped to pid: own pid	success or wait	758225745
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	758227660
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Access: query and write and read and execute Type: image Baseaddress: 37320000 Size: 143360 Protection: read write Mapped to pid: own pid	success or wait	758228493
Section loaded	Path: \KnownDlls\WINSPOOL.DRV Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	758235122
File opened	Path: C:\WINDOWS\system32\WINSPOOL.DRV Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	758235841
Section loaded	Path: C:\WINDOWS\system32\winspool.drv Access: query and write and read and execute Type: image Baseaddress: 73000000 Size: 155648 Protection: read write Mapped to pid: own pid	success or wait	758236605
Section loaded	Path: \KnownDlls\OLEACC.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	758242224
File opened	Path: C:\WINDOWS\system32\OLEACC.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	758242940
Section loaded	Path: C:\WINDOWS\system32\oleacc.dll Access: query and write and read and execute Type: image Baseaddress: 74C80000 Size: 180224 Protection: read write Mapped to pid: own pid	success or wait	758243693
Section loaded	Path: \KnownDlls\MSVCP60.dll Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	758246064
File opened	Path: C:\WINDOWS\system32\MSVCP60.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	758246768
Section loaded	Path: C:\WINDOWS\system32\msvcp60.dll Access: query and write and read and execute Type: image Baseaddress: 76080000 Size: 413696 Protection: read write Mapped to pid: own pid	success or wait	758247529
System info queried	Type: BasicInformation	success or wait	758259313
Mutant created	Name: \BaseNamedObjects\oleacc-msaa-loaded	success or wait	758261012
File opened	Path: C:\WINDOWS\system32\OLEACCRC.DLL Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	758261834
Section loaded	Path: C:\WINDOWS\system32\oleaccrc.dll Access: query and read Type: commit Baseaddress: 1E80000 Size: 20480 Protection: readonly Mapped to pid: own pid	success or wait	758262615
Section loaded	Path: \KnownDlls\SXS.DLL Access: write and read and execute Type: unknown Baseaddress: unknown Size: unknown Protection: unknown Mapped to pid: unknown	object name not found	758270631
File opened	Path: C:\WINDOWS\system32\SXS.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	758271362
Section loaded	Path: C:\WINDOWS\system32\sxs.dll Access: query and write and read and execute Type: image Baseaddress: 7E720000 Size: 720896 Protection: read write Mapped to pid: own pid	success or wait	758272131
System info queried	Type: BasicInformation	success or wait	758276475
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CF607698-2145-4FF6-9175-719D9CA8898C}\2.0\0\win32 Name: NULL	success or wait	758281029
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: none Content Overwritten: true	success or wait	758281725
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 0	success or wait	758282770
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 64 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 38 01 00 00	success or wait	758282971
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 0	success or wait	758283777
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 312	success or wait	758283981
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 4 Value: 50 45 00 00	success or wait	758284177
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 20 Value: 4C 01 05 00 05 AC 27 46 00 00 00 00 00 00 00 00 E0 00 0E 21	success or wait	758284402
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 560	success or wait	758284639
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 40 Value: 2E 74 65 78 74 00 00 00 F7 82 01 00 00 10 00 00 00 84 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60	success or wait	758284834
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 40 Value: 2E 64 61 74 61 00 00 00 01 2B 00 00 00 A0 01 00 00 14 00 00 00 88 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	758285117
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 40 Value: 2E 63 64 61 74 61 00 00 04 00 00 00 00 D0 01 00 00 02 00 00 00 9C 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0	success or wait	758285362
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 40 Value: 2E 72 73 72 63 00 00 00 20 21 00 00 00 E0 01 00 00 22 00 00 00 9E 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	758285603
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 720	success or wait	758285856
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 105984	success or wait	758286056
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 02 00 01 00	success or wait	758286255
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 8 Value: E8 00 00 80 28 00 00 80	success or wait	758286528
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 106008	success or wait	758286757
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 106216	success or wait	758286959
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 2 Value: 08 00	success or wait	758287154
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 106008	success or wait	758287378
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 8 Value: FA 00 00 80 40 00 00 80	success or wait	758287575
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 106016	success or wait	758288015
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 106234	success or wait	758288219
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 2 Value: 07 00	success or wait	758288414
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 14 Value: 54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	758288634
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 106016	success or wait	758288867
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 720	success or wait	758289069
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 720	success or wait	758289272
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 106048	success or wait	758289471
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	758289666
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 106064	success or wait	758289901
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 8 Value: 01 00 00 00 88 00 00 80	success or wait	758290098
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 720	success or wait	758290324
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 720	success or wait	758290526
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 106120	success or wait	758290726
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	758290921
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 8 Value: 09 04 00 00 C8 00 00 00	success or wait	758291148
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 720	success or wait	758291374
File other op	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL New path: Disposition: PositionInformation Data : Offset: 106184	success or wait	758291572
File read	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Offset: unknown Length: 16 Value: 48 E8 01 00 D4 18 00 00 00 00 00 00 00 00 00 00	success or wait	758291765
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\FNAME.DLL Access: query and read Type: commit Baseaddress: 1FB0000 Size: 49152 Protection: readonly Mapped to pid: own pid	success or wait	758292051
System info queried	Type: BasicInformation	success or wait	758292373
System info queried	Type: ProcessorInformation	success or wait	758292583
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32 Name: NULL	success or wait	758297727
File opened	Path: C:\WINDOWS\system32\stdole2.tlb Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and random access Attributes: none Content Overwritten: true	success or wait	758298323
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 0	success or wait	758299090
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 64 Value: 4D 5A 90 00 03 00 00 00 04 00 00 00 FF FF 00 00 B8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 00 00 00	success or wait	758299845
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 0	success or wait	758300826
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 192	success or wait	758301043
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 4 Value: 50 45 00 00	success or wait	758301253
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 20 Value: 4C 01 01 00 CE 29 02 48 00 00 00 00 00 00 00 00 E0 00 0F 21	success or wait	758301489
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 440	success or wait	758301737
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 40 Value: 2E 72 73 72 63 00 00 00 60 3E 00 00 00 10 00 00 00 40 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40	success or wait	758301945
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 480	success or wait	758302209
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 512	success or wait	758302426
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 01 00	success or wait	758302658
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 8 Value: A0 00 00 80 20 00 00 80	success or wait	758302900
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 536	success or wait	758303142
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 672	success or wait	758303357
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 2 Value: 07 00	success or wait	758303568
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 14 Value: 54 00 59 00 50 00 45 00 4C 00 49 00 42 00	success or wait	758303800
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 536	success or wait	758304044
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 480	success or wait	758304236
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 480	success or wait	758304856
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 544	success or wait	758305070
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	758305281
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 560	success or wait	758305529
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 8 Value: 01 00 00 00 50 00 00 80	success or wait	758305739
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 480	success or wait	758305979
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 480	success or wait	758306196
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 592	success or wait	758306411
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 16 Value: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00	success or wait	758306622
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 8 Value: 09 04 00 00 80 00 00 00	success or wait	758306864
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 480	success or wait	758307105
File other op	Path: C:\WINDOWS\system32\stdole2.tlb New path: Disposition: PositionInformation Data : Offset: 640	success or wait	758307317
File read	Path: C:\WINDOWS\system32\stdole2.tlb Offset: unknown Length: 16 Value: B0 10 00 00 40 3A 00 00 00 00 00 00 00 00 00 00	success or wait	758307523
Section loaded	Path: C:\WINDOWS\system32\stdole2.tlb Access: query and read Type: commit Baseaddress: 1FC0000 Size: 16384 Protection: readonly Mapped to pid: own pid	success or wait	758307820
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{CF607698-2145-4FF6-9175-719D9CA8898C}\2.0\0\win32 Name: NULL	success or wait	758313037
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\1033\stintl.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	758314690
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\1033\STINTL.DLL Access: write and read and execute Type: commit Baseaddress: 1FD0000 Size: 24576 Protection: execute Mapped to pid: own pid	success or wait	758315523
File opened	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\1033\stintl.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	758317451
Section loaded	Path: C:\PROGRA~1\COMMON~1\MICROS~1\SMARTT~1\1033\STINTL.DLL Access: query and write and read and execute Type: image Baseaddress: 374B0000 Size: 24576 Protection: read write Mapped to pid: own pid	success or wait	758318271
Thread created	PID: 900 TID: 1328 EIP: 7C8106F9 EAX: 30072A95 Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	758868385
Thread resumed	TID: 1328 PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	758869169
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	758879984
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	758881858
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	758882598
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	758882937
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	758883264
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	758884040
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	758884753
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	758885466
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	758886178
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	758886892
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	758887227
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	758887945
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	758888699
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	758889407
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	758889741
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	758890455
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	758891169
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	758891878
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	758892587
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	758893293
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: ProductFiles	success or wait	758895303
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: ProductFiles Type: dword Data: 1089994756 Old data: 1089994755	success or wait	758895668
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: TOOLS-PATH	object name not found	758929397
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758931183
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758933000
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: Proof	success or wait	758934339
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758936093
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools Location Name: proof	object name not found	758938479
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: CommonFilesDir	success or wait	758939071
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	758941540
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758944782
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758948632
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758950401
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758952199
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758954009
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758955791
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758957542
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758959328
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758961189
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758963058
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758964904
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758966754
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758968649
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758970558
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758972402
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758974226
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758977012
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758978809
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758980563
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758982355
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758984209
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758985983
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758987735
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758990058
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758991860
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758993638
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758995393
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758997183
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	758998988
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759000766
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759002549
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759004352
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759006214
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759007992
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759009772
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759011569
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759013372
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759015148
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759016933
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759018727
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759020541
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759022318
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759024070
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759025862
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759027673
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759029456
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759032018
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759033818
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759035628
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759037501
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759039348
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759041205
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759043107
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759044884
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759046682
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759048472
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759050275
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759052152
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759053998
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759055898
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759057800
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759059576
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759061394
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759063187
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759064997
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759066771
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759068520
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759070309
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759072112
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759074411
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759076174
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759078022
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759079835
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759081708
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759083555
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759085405
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759087261
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759090311
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759092166
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759094027
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759095928
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759097796
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759099639
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759101490
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759103444
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759105324
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759107170
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759109017
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759110946
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759112823
File opened	Path: C:\Program Files\Microsoft Office\OFFICE11\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759114665
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759116507
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759118940
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9\Normal	object name not found	759120941
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9\Normal	object name not found	759123147
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9\Normal	object name not found	759129430
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9\Normal	object name not found	759130485
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9\Normal	object name not found	759131578
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9\Normal	object name not found	759132622
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759140559
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	759143407
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759638408
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759640001
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 2	success or wait	759640530
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759641115
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759641644
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 4	success or wait	759642158
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759642675
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759643204
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759644745
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759645371
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 2	success or wait	759645927
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759647574
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759648108
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759649098
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759649743
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 2	success or wait	759650323
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759650850
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 2	success or wait	759651426
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759651979
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 2	success or wait	759652563
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 2	success or wait	759653114
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 2	success or wait	759653695
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759654311
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 6	success or wait	759654827
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759656351
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759656978
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759657531
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 2	success or wait	759658050
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 3	success or wait	759658633
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 3	success or wait	759659197
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 3	success or wait	759659719
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 6	success or wait	759660362
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759660981
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759661574
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759662095
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759662725
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759663241
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759663868
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759665360
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759665886
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 6	success or wait	759666405
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759666988
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759667788
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759668382
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759668974
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759669500
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759670020
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759670584
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759671963
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759672487
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759673055
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759673568
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 2	success or wait	759674080
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759674595
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759675916
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759676442
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759676960
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759677483
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759678814
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759679347
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759679945
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759680494
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759681017
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759681543
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759682058
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759682587
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759683116
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759683682
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759685140
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759685669
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759686252
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759686802
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759687411
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759687963
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759688478
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759689000
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 1	success or wait	759689612
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 2	success or wait	759711674
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 2	success or wait	759712273
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 2	success or wait	759712915
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759713430
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: 5	success or wait	759713953
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: d	success or wait	759716481
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: f	success or wait	759718664
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: f	success or wait	759721475
Key value queried	Path: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Nls\Language Groups Name: f	success or wait	759722025
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762707934
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762709860
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762715510
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762717412
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\LanguageResources Name: ShowDates	success or wait	762720607
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	762723995
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\mslid.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	762725843
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\MSLID.DLL Access: write and read and execute Type: commit Baseaddress: 21F0000 Size: 536576 Protection: execute Mapped to pid: own pid	success or wait	762726684
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\mslid.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	762729725
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\MSLID.DLL Access: query and write and read and execute Type: image Baseaddress: 507C0000 Size: 540672 Protection: read write Mapped to pid: own pid	success or wait	762730580
System info queried	Type: BasicInformation	success or wait	762737841
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762777256
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762784103
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762789512
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762791331
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762796716
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762798537
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762804176
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762806076
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762812180
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762814080
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762819406
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762821687
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762827063
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762828870
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762834197
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762836391
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762841766
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762843577
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762848958
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762850769
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762856602
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762858409
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762863720
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762865524
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762870943
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762872754
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762878332
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762880236
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762885609
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762887415
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762893315
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762895221
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762901084
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762902887
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762908151
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762909957
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762915311
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762917116
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762922723
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762924649
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762930221
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762932122
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762937680
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	762940119
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	763404079
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\ Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for backup ident Overwritten: false	success or wait	763406029
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: FixReadabilityStatistics	object name not found	763415398
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 1033\Normal	buffer overflow	763416452
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 1033\Normal	success or wait	763416779
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SpellingAndGrammarFiles_1033	success or wait	763417707
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	763418528
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	763418922
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	success or wait	763419267
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\122BC46DF1D81D118A6000AA00740998 Name: 9040110900063D11C8EF10054038389C	success or wait	763420821
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69 Name: 9040110900063D11C8EF10054038389C	success or wait	763428340
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	buffer overflow	763431974
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	success or wait	763432320
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763433793
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13608793E82C1D11FB5B000A9CF0828A Name: 9040110900063D11C8EF10054038389C	success or wait	763435241
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763437338
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingToolsFiles_1033	success or wait	763437960
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	763438732
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	763439081
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763439647
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763440410
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingParent	success or wait	763441015
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	763441759
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	763442115
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763442739
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SHAREDFiles	success or wait	763443349
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	763444085
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	763444426
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763444989
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	763445601
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	763446362
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	763446707
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	763447050
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	763447843
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763448579
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	763449317
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	763450221
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	763450973
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	763451327
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	763452754
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	763453492
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	763454744
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	763455089
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	763455833
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763456571
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	763457306
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	763458038
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	763458769
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763460384
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033	object name not found	763462246
Key value set	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033 Type: dword Data: 1089994753 Old data:	success or wait	763462609
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 1033\Normal	buffer overflow	763466812
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 1033\Normal	success or wait	763467140
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SpellingAndGrammarFiles_1033	success or wait	763468046
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	763468827
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	763469180
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	success or wait	763469529
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\122BC46DF1D81D118A6000AA00740998 Name: 9040110900063D11C8EF10054038389C	success or wait	763470176
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69 Name: 9040110900063D11C8EF10054038389C	success or wait	763470889
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	buffer overflow	763471599
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	success or wait	763471931
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763472642
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13608793E82C1D11FB5B000A9CF0828A Name: 9040110900063D11C8EF10054038389C	success or wait	763473350
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763474060
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingToolsFiles_1033	success or wait	763474648
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	763475368
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	763475711
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763476258
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763476970
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingParent	success or wait	763477567
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	763478306
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	763478665
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763479220
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SHAREDFiles	success or wait	763479822
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	763480552
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	763480894
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763481441
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	763482052
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	763482788
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	763483165
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	763483507
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	763484281
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763485017
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	763485754
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	763486489
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	763487225
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	763487572
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	763488312
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	763489043
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	763489772
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	763490117
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	763490854
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763491584
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	763492357
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	763493092
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	763493826
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763495422
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033	success or wait	763497823
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033 Type: dword Data: 1089994754 Old data: 1089994753	success or wait	763498197
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 1033\Normal	buffer overflow	763499549
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 1033\Normal	success or wait	763499871
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SpellingAndGrammarFiles_1033	success or wait	763500788
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	763501532
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	763501897
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	success or wait	763502254
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\122BC46DF1D81D118A6000AA00740998 Name: 9040110900063D11C8EF10054038389C	success or wait	763502895
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69 Name: 9040110900063D11C8EF10054038389C	success or wait	763503604
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	buffer overflow	763504313
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	success or wait	763504657
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763505380
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13608793E82C1D11FB5B000A9CF0828A Name: 9040110900063D11C8EF10054038389C	success or wait	763506455
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763507171
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingToolsFiles_1033	success or wait	763507765
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	763509717
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	763510065
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763510614
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763511332
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingParent	success or wait	763511952
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	763512696
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	763513705
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763514323
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SHAREDFiles	success or wait	763514927
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	763515657
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	763515998
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763516545
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	763517979
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	763518716
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	763519063
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	763519404
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	763520181
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763520921
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	763522258
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	763522996
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	763523730
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	763524077
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	763524819
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	763526354
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	763527094
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	763527439
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	763528179
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763528910
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	763531561
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	763532304
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	763533037
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763535315
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033	success or wait	763537154
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033 Type: dword Data: 1089994755 Old data: 1089994754	success or wait	763538236
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 1033\Normal	buffer overflow	763542537
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 1033\Normal	success or wait	763542861
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SpellingAndGrammarFiles_1033	success or wait	763543775
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	763544511
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	763544865
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	success or wait	763545213
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\122BC46DF1D81D118A6000AA00740998 Name: 9040110900063D11C8EF10054038389C	success or wait	763545852
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69 Name: 9040110900063D11C8EF10054038389C	success or wait	763547259
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	buffer overflow	763548001
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	success or wait	763548336
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763549052
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13608793E82C1D11FB5B000A9CF0828A Name: 9040110900063D11C8EF10054038389C	success or wait	763549760
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763550468
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingToolsFiles_1033	success or wait	763551059
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	763551783
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	763552126
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763552674
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763553386
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingParent	success or wait	763553982
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	763554756
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	763555109
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763555663
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SHAREDFiles	success or wait	763556265
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	763556990
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	763557332
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763557879
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	763558485
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	763559221
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	763559565
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	763559906
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	763560670
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763561404
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	763562237
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	763562977
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	763563913
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	763564261
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	763565005
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	763565740
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	763566469
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	763566814
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	763567548
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	763568278
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	763569032
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	763569771
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	763570503
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	763572102
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033	success or wait	763573935
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033 Type: dword Data: 1089994756 Old data: 1089994755	success or wait	763574304
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\MSSPELL3.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	763575320
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\MSSPELL3.DLL Access: write and read and execute Type: commit Baseaddress: 2600000 Size: 86016 Protection: execute Mapped to pid: own pid	success or wait	763576164
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\MSSPELL3.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	763584828
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\MSSPELL3.DLL Access: query and write and read and execute Type: image Baseaddress: 3F000000 Size: 86016 Protection: read write Mapped to pid: own pid	success or wait	763585686
System info queried	Type: BasicInformation	success or wait	763597461
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries Name: 1	success or wait	763600647
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: Proof	success or wait	763601192
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries Name: 2	object name not found	763603082
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries Name: 3	object name not found	763603737
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries Name: 4	object name not found	763604390
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries Name: 5	object name not found	763605038
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries Name: 6	object name not found	763605689
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries Name: 7	object name not found	763606333
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries Name: 8	object name not found	763606979
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries Name: 9	object name not found	763607624
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries Name: 10	object name not found	763608268
File created	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	763612734
Section loaded	Path: \BaseNamedObjects\DfSharedHeap3C40F Access: query and write and read Type: reserve Baseaddress: 2610000 Size: 4194304 Protection: read write Mapped to pid: own pid	success or wait	763617250
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	763618626
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Offset: 0 Length: 512 Value: 00 00 00 00 31 00 2D 00 35 00 2D 00 31 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	end of file	763619634
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	763623105
File other op	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC New path: Disposition: PositionInformation Data : Offset: 0	success or wait	763625296
File created	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: hidden Content Overwritten: true	success or wait	763626463
File write	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC Offset: unknown Length: 54 Value: 0D 48 61 6E 75 65 6C 65 20 42 61 73 65 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	763630404
File write	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC Offset: unknown Length: 108 Value: 0D 00 48 00 61 00 6E 00 75 00 65 00 6C 00 65 00 20 00 42 00 61 00 73 00 65 00 72 00 00 00 00 00 20 00 00 00 00 00 00 00 04 00 00 00 04 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 00 00 03 00 01 00 0C 00 5C 00 00 00 03 00 00 00 04 00 00 00 08 00 00 00 04 00 00 00	success or wait	763631655
File created	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~WRI0002 Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	763634436
File other op	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC New path: Disposition: PositionInformation Data : Offset: 0	success or wait	763638966
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	763640880
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC Access: read attributes and delete Options: non directory file and open for backup ident and open reparse point Overwritten: false	success or wait	763642182
File deleted	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC New path: Disposition: Data :	success or wait	763643082
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	763646378
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Access: read attributes and delete Options: non directory file and open for backup ident and open reparse point Overwritten: false	success or wait	763647648
File deleted	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC New path: Disposition: Data :	success or wait	763648536
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~WRI0002 Access: read attributes and delete and synchronize Options: synchronous io non alert and open for backup ident and open reparse point Overwritten: false	success or wait	763650507
File moved	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~WRI0002 New path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Disposition: Data :	success or wait	763651573
Section loaded	Path: \BaseNamedObjects\DfSharedHeap3C42C Access: query and write and read Type: reserve Baseaddress: 2610000 Size: 4194304 Protection: read write Mapped to pid: own pid	success or wait	763655825
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	763656990
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Offset: 0 Length: 512 Value: 00 00 00 00 31 00 2D 00 35 00 2D 00 31 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	end of file	763657968
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	763659599
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: Proof	success or wait	763662850
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Custom Dictionaries Name: 1 Type: unicode Data: CUSTOM.DIC Old data:	success or wait	763663479
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	763666493
Section loaded	Path: \BaseNamedObjects\DfSharedHeap3C440 Access: query and write and read Type: reserve Baseaddress: 2610000 Size: 4194304 Protection: read write Mapped to pid: own pid	success or wait	763671084
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	763672239
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Offset: 0 Length: 512 Value: 00 00 00 00 31 00 2D 00 35 00 2D 00 31 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	end of file	763673159
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	763676446
File other op	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC New path: Disposition: PositionInformation Data : Offset: 0	success or wait	763677595
File created	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC Access: read attributes and synchronize and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: hidden Content Overwritten: true	success or wait	763678207
File write	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC Offset: unknown Length: 54 Value: 0D 48 61 6E 75 65 6C 65 20 42 61 73 65 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00	success or wait	763681754
File write	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC Offset: unknown Length: 108 Value: 0D 00 48 00 61 00 6E 00 75 00 65 00 6C 00 65 00 20 00 42 00 61 00 73 00 65 00 72 00 00 00 00 00 20 00 00 00 00 00 00 00 04 00 00 00 04 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 00 00 00 00 00 03 00 01 00 0C 00 5C 00 00 00 03 00 00 00 04 00 00 00 08 00 00 00 04 00 00 00	success or wait	763682872
File other op	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC New path: Disposition: PositionInformation Data : Offset: 0	success or wait	763684313
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	763686796
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC Access: read attributes and delete Options: non directory file and open for backup ident and open reparse point Overwritten: false	success or wait	763688121
File deleted	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\~$CUSTOM.DIC New path: Disposition: Data :	success or wait	763689022
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Access: read attributes and synchronize and generic read and generic write Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	763690969
File read	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\CUSTOM.DIC Offset: unknown Length: 4 Value: B0 FF 12 00	end of file	763691820
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: Proof	success or wait	763693921
File opened	Path: C:\Documents and Settings\Administrator\Application Data\Microsoft\Proof\MSSP3EN.exc Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	object name not found	763694682
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\MSSP3EN.LEX Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	763695581
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\MSSP3EN.LEX Access: query and read Type: commit Baseaddress: 2610000 Size: 462848 Protection: readonly Mapped to pid: own pid	success or wait	763696429
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1033\9	object name not found	763741856
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1033\9	object name not found	763742957
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 9\9	object name not found	763744805
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 9\9	object name not found	763745848
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1033\9	object name not found	763772452
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1033\9	object name not found	763773507
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1036\9	object name not found	763785099
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1036\9	object name not found	763786421
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 2057\9	object name not found	763798681
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 2057\9	object name not found	763799751
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 3081\9	object name not found	763811596
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 3081\9	object name not found	763812688
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 3082\9	object name not found	763824394
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 3082\9	object name not found	763825458
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 3084\9	object name not found	763837144
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 3084\9	object name not found	763838195
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 4105\9	object name not found	763851501
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 4105\9	object name not found	763852559
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1033\9	object name not found	763864092
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1033\9	object name not found	763865134
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1036\9	object name not found	763890268
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1036\9	object name not found	763891321
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 2057\9	object name not found	763903622
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 2057\9	object name not found	763904681
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 3081\9	object name not found	763916257
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 3081\9	object name not found	763917305
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 3082\9	object name not found	763929345
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 3082\9	object name not found	763930396
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 3084\9	object name not found	763941985
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 3084\9	object name not found	763943029
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 4105\9	object name not found	763955277
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 4105\9	object name not found	763956329
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1033\9	object name not found	763967917
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1033\9	object name not found	763968955
Message posted	TID: 7DC Message: C08C WParam: 0 LParam: 1328	success	764072918
Thread terminated	TID: 1328 PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	unknown	764073614
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	success or wait	764188950
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1033\1033	buffer overflow	764202161
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1033\1033	success or wait	764202514
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SpellingAndGrammarFiles_1033	success or wait	764203445
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	764204234
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	764204606
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	success or wait	764204951
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\122BC46DF1D81D118A6000AA00740998 Name: 9040110900063D11C8EF10054038389C	success or wait	764205603
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69 Name: 9040110900063D11C8EF10054038389C	success or wait	764206498
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	buffer overflow	764207211
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	success or wait	764207544
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764208301
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13608793E82C1D11FB5B000A9CF0828A Name: 9040110900063D11C8EF10054038389C	success or wait	764209010
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764209719
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingToolsFiles_1033	success or wait	764210318
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	764211047
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	764211393
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764211945
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764212662
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingParent	success or wait	764213298
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	764214040
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	764214398
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764214954
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SHAREDFiles	success or wait	764215551
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	764216283
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	764216623
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764217170
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	764217777
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	764218511
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	764218857
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	764219198
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	764219989
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764220730
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	764221461
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	764222199
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	764222932
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	764223276
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	764224023
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	764224755
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	764225486
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	764225836
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	764226572
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764227701
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	764228434
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	764229171
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	764229957
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	buffer overflow	764231569
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	success or wait	764231893
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033	success or wait	764233857
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033 Type: dword Data: 1089994757 Old data: 1089994756	success or wait	764234246
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1033\1033	buffer overflow	764246205
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\285E35716D00D104F994678A97F78A0A Name: 1033\1033	success or wait	764246526
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SpellingAndGrammarFiles_1033	success or wait	764247431
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	764248167
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	764248518
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	success or wait	764248867
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\122BC46DF1D81D118A6000AA00740998 Name: 9040110900063D11C8EF10054038389C	success or wait	764249514
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69 Name: 9040110900063D11C8EF10054038389C	success or wait	764250221
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	buffer overflow	764250929
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	success or wait	764251264
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764251982
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13608793E82C1D11FB5B000A9CF0828A Name: 9040110900063D11C8EF10054038389C	success or wait	764252711
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764253417
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingToolsFiles_1033	success or wait	764254008
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	764254736
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	764255077
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764255650
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764256368
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingParent	success or wait	764256961
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	764257699
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	764258051
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764258606
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SHAREDFiles	success or wait	764259204
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	764259933
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	764260272
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764260815
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	764261424
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	764262155
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	764262500
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	764262838
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	764263601
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764264334
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	764265065
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	764265832
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	764266568
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	764266912
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	764267649
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	764268384
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	764269111
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	764269453
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	764270692
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764271424
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	764272152
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	764272878
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	764273606
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	buffer overflow	764275196
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	success or wait	764275521
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033	success or wait	764277341
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033 Type: dword Data: 1089994758 Old data: 1089994757	success or wait	764277709
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\C18EB3B85D045C14AA95785DC1D767B1 Name: 1033	buffer overflow	764281191
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\C18EB3B85D045C14AA95785DC1D767B1 Name: 1033	success or wait	764281516
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SpellingAndGrammarFiles_1033	success or wait	764282423
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	764283120
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	764283469
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	success or wait	764283813
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\122BC46DF1D81D118A6000AA00740998 Name: 9040110900063D11C8EF10054038389C	success or wait	764284490
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69 Name: 9040110900063D11C8EF10054038389C	success or wait	764285203
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	buffer overflow	764285927
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	success or wait	764286272
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764287000
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13608793E82C1D11FB5B000A9CF0828A Name: 9040110900063D11C8EF10054038389C	success or wait	764287722
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764288443
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingToolsFiles_1033	success or wait	764289407
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	764290143
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	764290489
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764291217
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764291937
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingParent	success or wait	764292540
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	764293283
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	764293637
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764294198
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SHAREDFiles	success or wait	764294803
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	764295537
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	764811352
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764812016
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	764812664
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	764813427
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	764813801
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	764814148
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	764814933
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764815683
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	764817039
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	764817785
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	764818531
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	764818884
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	764819632
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	764820373
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	764821116
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	764821468
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	764822213
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764822955
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	764823699
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	764824438
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	764825180
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69 Name: 9040110900063D11C8EF10054038389C	success or wait	764826812
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033	success or wait	764829241
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033 Type: dword Data: 1089994759 Old data: 1089994758	success or wait	764829617
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\C18EB3B85D045C14AA95785DC1D767B1 Name: 1033	buffer overflow	764831405
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Components\C18EB3B85D045C14AA95785DC1D767B1 Name: 1033	success or wait	764831726
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SpellingAndGrammarFiles_1033	success or wait	764832643
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	764833391
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	buffer overflow	764833751
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SpellingAndGrammarFiles_1033	success or wait	764834098
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\122BC46DF1D81D118A6000AA00740998 Name: 9040110900063D11C8EF10054038389C	success or wait	764834743
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69 Name: 9040110900063D11C8EF10054038389C	success or wait	764835456
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	buffer overflow	764836172
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F97A7CF51C1B13C428CBD7B3DD106020 Name: 9040110900063D11C8EF10054038389C	success or wait	764836508
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764837221
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\13608793E82C1D11FB5B000A9CF0828A Name: 9040110900063D11C8EF10054038389C	success or wait	764837933
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\F3BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764838681
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingToolsFiles_1033	success or wait	764839272
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	764839998
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingToolsFiles_1033	success or wait	764840341
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\94BE92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764840888
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764841604
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProofingParent	success or wait	764842206
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	764842992
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProofingParent	success or wait	764843349
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764843907
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: SHAREDFiles	success or wait	764844513
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	764845254
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: SHAREDFiles	success or wait	764845598
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764846146
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\9040110900063D11C8EF10054038389C Name: ProductFiles	success or wait	764846759
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	764847501
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	buffer overflow	764847846
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Features Name: ProductFiles	success or wait	764848633
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\0EAE1CE3652AD1140BB010C68A730687 Name: 9040110900063D11C8EF10054038389C	success or wait	764849430
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\379E92CC2CB71D119A12000A9CE1A22A Name: 9040110900063D11C8EF10054038389C	success or wait	764850173
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1650EACF3C291D11A92C0006794C4E25 Name: 9040110900063D11C8EF10054038389C	success or wait	764850918
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19C2DC6651A24AD4BB2DE51C70F5C3E0 Name: 9040110900063D11C8EF10054038389C	success or wait	764851663
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	buffer overflow	764852441
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\D562284CE147D0E4CB6C801C80461A10 Name: 9040110900063D11C8EF10054038389C	success or wait	764852788
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\DBA0D1302088D1E44B6F7E0DC6732662 Name: 9040110900063D11C8EF10054038389C	success or wait	764853540
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\2516E66D0FE30B64EB1CDE1F52E7C357 Name: 9040110900063D11C8EF10054038389C	success or wait	764854276
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	buffer overflow	764855011
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\1F53EF4649650FD468E7990AAA2398BA Name: 9040110900063D11C8EF10054038389C	success or wait	764855357
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\FE6545E80813C4542A70D28194279382 Name: 9040110900063D11C8EF10054038389C	success or wait	764856098
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\987E83843F00AC84188BFB846FC86492 Name: 9040110900063D11C8EF10054038389C	success or wait	764856865
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\4A27DD755B98E23499AA660C6A835D0C Name: 9040110900063D11C8EF10054038389C	success or wait	764857628
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\86FBBBBDC3EB97D4989B210DB8D577D2 Name: 9040110900063D11C8EF10054038389C	success or wait	764858368
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\19A12162A748EF94E899C354C0912213 Name: 9040110900063D11C8EF10054038389C	success or wait	764859106
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\07B795E021151E34DBF8D2CB39429C69 Name: 9040110900063D11C8EF10054038389C	success or wait	764860720
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033	success or wait	764862576
Key value replaced with new	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\9040110900063D11C8EF10054038389C\Usage Name: SpellingAndGrammarFiles_1033 Type: dword Data: 1089994760 Old data: 1089994759	success or wait	764862948
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\1033\MSGR3EN.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	764864386
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\1033\MSGR3EN.DLL Access: write and read and execute Type: commit Baseaddress: 26D0000 Size: 3166208 Protection: execute Mapped to pid: own pid	success or wait	764865279
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\1033\MSGR3EN.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	764868417
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\1033\MSGR3EN.DLL Access: query and write and read and execute Type: image Baseaddress: 3F100000 Size: 3166208 Protection: read write Mapped to pid: own pid	success or wait	764869274
System info queried	Type: BasicInformation	success or wait	764881045
Process information queried	PID: 900 Info Class: Cookie	success or wait	764887662
Process information queried	PID: 900 Info Class: Cookie	success or wait	764887865
System info queried	Type: BasicInformation	success or wait	764889670
System info queried	Type: ProcessorInformation	success or wait	764889880
Key created	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar	success or wait	764915449
Key created	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar	success or wait	764918454
Key created	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0	success or wait	764919300
Key created	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033	success or wait	764920136
Key value queried	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033 Name: Options Version	object name not found	764920945
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033 Name: Options Version Type: dword Data: 1 Old data:	success or wait	764921427
Key created	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 0	success or wait	764921806
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 0 Name: Name Type: unicode Data: Grammar & Style Old data:	success or wait	764922546
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 0 Name: Data Type: binary Data: 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 01 00 01 01 01 02 02 02 Old data:	success or wait	764922941
Key created	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 1	success or wait	764923599
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 1 Name: Name Type: unicode Data: Grammar Only Old data:	success or wait	764925236
Key value set	Path: HKEY_USERS\Software\Microsoft\Shared Tools\Proofing Tools\Grammar\MSGrammar\3.0\1033\Option Set 1 Name: Data Type: binary Data: 01 01 01 01 01 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 02 02 02 Old data:	success or wait	764925633
File opened	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\MSGR3EN.LEX Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: normal Content Overwritten: true	success or wait	764990349
System info queried	Type: PerformanceInformation	success or wait	764991278
Process information queried	PID: 900 Info Class: QuotaLimits	success or wait	764991698
Process information queried	PID: 900 Info Class: VmCounters	success or wait	764991901
Section loaded	Path: C:\Program Files\Common Files\Microsoft Shared\PROOF\MSGR3EN.LEX Access: query and read Type: commit Baseaddress: 2830000 Size: 3788800 Protection: readonly Mapped to pid: own pid	success or wait	764992188
System info queried	Type: CurrentTimeZoneInformation	success or wait	765080436
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5	success or wait	765632562
Thread created	PID: 900 TID: 1780 EIP: 7C8106F9 EAX: 30072A95 Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	770722244
Thread resumed	TID: 1780 PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	770723118
Window created	Window Name: File Open Message Window Class Name: File Open Message Window HWND: 60154	success	770728682
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 1780 Hook ID: keyboard	success	770728968
Windows hook set	Module: C:\WINDOWS\system32\MSCTF.dll TID: 1780 Hook ID: mouse	success	770729197
Key value queried	Path: HKEY_USERS\Software\Microsoft\CTF Name: Disable Thread Input Manager	object name not found	770730155
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CTF\SystemShared Name: CUAS	success or wait	770731368
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Word\Options Name: DOC-PATH	object name not found	770734382
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Name: Personal	success or wait	770735130
File opened	Path: C:\Documents and Settings\Administrator\My Documents Access: execute or traverse and synchronize Options: directory file and synchronous io non alert Overwritten: false	success or wait	770736680
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows Name: Device	success or wait	770738252
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices Name: Microsoft XPS Document Writer	success or wait	770738677
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770746973
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770748642
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unidrvui.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770752317
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll Access: write and read and execute Type: commit Baseaddress: 2ED0000 Size: 745472 Protection: execute Mapped to pid: own pid	success or wait	770753161
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\unidrvui.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770755677
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\unidrvui.dll Access: query and write and read and execute Type: image Baseaddress: 7E5A0000 Size: 761856 Protection: read write Mapped to pid: own pid	success or wait	770756499
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770764668
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770766088
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770767327
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2ED0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	770768204
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770769458
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770771443
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770777461
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2EE0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	770778340
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770780380
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2EE0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	770781208
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770783104
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	770783939
System info queried	Type: BasicInformation	success or wait	770790946
Process information queried	PID: 900 Info Class: Cookie	success or wait	770792057
Process information queried	PID: 900 Info Class: Cookie	success or wait	770792357
Process information queried	PID: 900 Info Class: Cookie	success or wait	770792583
Process information queried	PID: 900 Info Class: Cookie	success or wait	770792810
Process information queried	PID: 900 Info Class: Cookie	success or wait	770793073
Process information queried	PID: 900 Info Class: Cookie	success or wait	770793297
Process information queried	PID: 900 Info Class: Cookie	success or wait	770793519
Process information queried	PID: 900 Info Class: Cookie	success or wait	770793753
Process information queried	PID: 900 Info Class: Cookie	success or wait	770793989
Process information queried	PID: 900 Info Class: Cookie	success or wait	770794222
Process information queried	PID: 900 Info Class: Cookie	success or wait	770794453
Process information queried	PID: 900 Info Class: Cookie	success or wait	770794684
Process information queried	PID: 900 Info Class: Cookie	success or wait	770794915
Process information queried	PID: 900 Info Class: Cookie	success or wait	770795146
Process information queried	PID: 900 Info Class: Cookie	success or wait	770795376
Process information queried	PID: 900 Info Class: Cookie	success or wait	770795605
Process information queried	PID: 900 Info Class: Cookie	success or wait	770795837
Process information queried	PID: 900 Info Class: Cookie	success or wait	770796069
Process information queried	PID: 900 Info Class: Cookie	success or wait	770796299
Process information queried	PID: 900 Info Class: Cookie	success or wait	770796528
Process information queried	PID: 900 Info Class: Cookie	success or wait	770796757
Process information queried	PID: 900 Info Class: Cookie	success or wait	770796987
Process information queried	PID: 900 Info Class: Cookie	success or wait	770797210
Process information queried	PID: 900 Info Class: Cookie	success or wait	770797473
Process information queried	PID: 900 Info Class: Cookie	success or wait	770798924
Process information queried	PID: 900 Info Class: Cookie	success or wait	770799145
Process information queried	PID: 900 Info Class: Cookie	success or wait	770799363
Process information queried	PID: 900 Info Class: Cookie	success or wait	770799581
Process information queried	PID: 900 Info Class: Cookie	success or wait	770799798
Process information queried	PID: 900 Info Class: Cookie	success or wait	770800017
Process information queried	PID: 900 Info Class: Cookie	success or wait	770800236
Process information queried	PID: 900 Info Class: Cookie	success or wait	770800452
Process information queried	PID: 900 Info Class: Cookie	success or wait	770800669
Process information queried	PID: 900 Info Class: Cookie	success or wait	770800888
Process information queried	PID: 900 Info Class: Cookie	success or wait	770801106
Process information queried	PID: 900 Info Class: Cookie	success or wait	770801330
Process information queried	PID: 900 Info Class: Cookie	success or wait	770801849
Process information queried	PID: 900 Info Class: Cookie	success or wait	770802064
Process information queried	PID: 900 Info Class: Cookie	success or wait	770802289
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770803505
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770804413
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770805308
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770805768
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770806715
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2ED0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	770807587
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770808548
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770809766
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770813610
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2EE0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	770814458
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770816237
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2EE0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	770817053
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770818654
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	770819469
System info queried	Type: BasicInformation	success or wait	770825671
Process information queried	PID: 900 Info Class: Cookie	success or wait	770826803
Process information queried	PID: 900 Info Class: Cookie	success or wait	770827098
Process information queried	PID: 900 Info Class: Cookie	success or wait	770827322
Process information queried	PID: 900 Info Class: Cookie	success or wait	770827546
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770840271
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770841183
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770841642
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770842593
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2ED0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	770844012
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770844967
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770846190
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770849956
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2EE0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	770850801
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770852507
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2EE0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	770853319
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770854914
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	770855725
System info queried	Type: BasicInformation	success or wait	770861928
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770880023
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdrv.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770881242
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll Access: write and read and execute Type: commit Baseaddress: 2ED0000 Size: 765952 Protection: execute Mapped to pid: own pid	success or wait	770882094
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdrv.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770884005
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdrv.dll Access: query and write and read and execute Type: image Baseaddress: 3F500000 Size: 786432 Protection: read write Mapped to pid: own pid	success or wait	770884821
System info queried	Type: BasicInformation	success or wait	770910065
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770930999
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770931194
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770932124
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770932592
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770933553
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2EE0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	770934445
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770935437
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770936679
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770940426
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2EF0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	770941319
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770943077
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2EF0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	770943897
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770946060
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	770946890
System info queried	Type: BasicInformation	success or wait	770953314
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770965629
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770965827
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770966753
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	770967227
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770968185
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 2EE0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	770969066
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770970052
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770971295
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	770975591
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 2EF0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	770976445
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770978200
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 2EF0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	770979021
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	770980661
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	770981486
System info queried	Type: BasicInformation	success or wait	770987905
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771003875
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771004087
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771004996
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771005476
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771006442
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771007339
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771008386
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771009651
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771013481
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771014350
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771016705
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771017545
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771019243
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771020080
System info queried	Type: BasicInformation	success or wait	771026769
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771039681
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771039889
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771040821
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771041305
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771042277
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771043173
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771044235
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771045504
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771049300
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771050168
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771051980
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771052815
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771054506
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771055343
System info queried	Type: BasicInformation	success or wait	771062937
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771075782
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771076718
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771077203
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771078176
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771079072
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771080118
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771081390
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771085213
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771086081
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771087944
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771088780
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771090477
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771091316
System info queried	Type: BasicInformation	success or wait	771098018
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771125900
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771126113
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771126984
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771127450
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771128384
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771129284
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771130396
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771131668
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771135455
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771136331
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771138159
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771138999
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771140697
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771141529
System info queried	Type: BasicInformation	success or wait	771148759
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771161721
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771162659
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771163143
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771164118
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771165016
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771166059
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771167323
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771172248
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771173221
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771175063
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771176128
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771177830
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771178670
System info queried	Type: BasicInformation	success or wait	771185811
File opened	Path: C:\WINDOWS\system32\FontSub.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771203990
Section loaded	Path: C:\WINDOWS\system32\fontsub.dll Access: write and read and execute Type: commit Baseaddress: 32E0000 Size: 81920 Protection: execute Mapped to pid: own pid	success or wait	771204786
File opened	Path: C:\WINDOWS\system32\FontSub.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771206623
Section loaded	Path: C:\WINDOWS\system32\fontsub.dll Access: query and write and read and execute Type: image Baseaddress: 69310000 Size: 94208 Protection: read write Mapped to pid: own pid	success or wait	771207390
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771210437
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771210937
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771216244
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771216444
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771217355
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771217823
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771218780
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771219664
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771220673
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771221919
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771226005
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771226901
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771228667
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771229490
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771231661
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771232484
System info queried	Type: BasicInformation	success or wait	771238883
Process information queried	PID: 900 Info Class: Wow64Information	success or wait	771251022
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771253577
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771254463
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771255469
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771256711
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771260509
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771261362
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771263124
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771263942
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771265581
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771266407
System info queried	Type: BasicInformation	success or wait	771273347
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771303472
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771304364
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771305381
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771306622
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771310383
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771311232
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771313020
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771313844
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771315486
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771316843
System info queried	Type: BasicInformation	success or wait	771323306
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Windows Name: Device	success or wait	771347525
Key value queried	Path: HKEY_USERS\Software\Microsoft\Windows NT\CurrentVersion\Devices Name: Microsoft XPS Document Writer	success or wait	771347980
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771352603
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771353481
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771354474
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771355695
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771360494
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771361346
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771363061
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771363875
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771365476
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771366289
System info queried	Type: BasicInformation	success or wait	771372558
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771387636
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771388504
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771389484
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771390775
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771395140
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771395990
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771397700
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771398514
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771400117
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771400955
System info queried	Type: BasicInformation	success or wait	771407657
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771421530
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771422399
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771423370
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771424590
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771428324
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771429163
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771430889
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771431702
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771433307
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771434121
System info queried	Type: BasicInformation	success or wait	771440336
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771460114
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771460990
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771462049
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771463291
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771467311
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771468164
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771469921
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771470743
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771472383
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771473240
System info queried	Type: BasicInformation	success or wait	771479648
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771494941
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771495822
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771496830
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771498102
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771502673
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771503533
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771505681
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771506507
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771508150
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771508967
System info queried	Type: BasicInformation	success or wait	771515403
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771531633
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771532528
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771533627
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771534919
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771538701
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771539564
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771541379
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771542213
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771543901
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771544735
System info queried	Type: BasicInformation	success or wait	771551405
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771567011
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771567904
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771568942
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771570206
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771574527
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771575390
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771577206
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771578066
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771579751
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771580585
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771602585
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771603481
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771604577
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771605851
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771609632
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771610496
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771612307
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771613141
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771614833
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771615669
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771642697
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771643594
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771644640
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771645974
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771649751
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771650616
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771652431
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771653268
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771655001
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771655837
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771678559
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771679458
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771680505
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771681773
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771685545
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771686408
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771688271
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771689112
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771690808
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771691641
File opened	Path: C:\WINDOWS\system32\FontSub.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771715032
Section loaded	Path: C:\WINDOWS\system32\fontsub.dll Access: write and read and execute Type: commit Baseaddress: 32E0000 Size: 81920 Protection: execute Mapped to pid: own pid	success or wait	771715814
File opened	Path: C:\WINDOWS\system32\FontSub.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771717422
Section loaded	Path: C:\WINDOWS\system32\fontsub.dll Access: query and write and read and execute Type: image Baseaddress: 69310000 Size: 94208 Protection: read write Mapped to pid: own pid	success or wait	771718193
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771726556
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771727438
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771729658
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771730971
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771734726
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771735578
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771737332
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771738158
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771739798
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771740617
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771762191
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771763073
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771764082
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771765318
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771769069
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771769919
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771771671
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771772491
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.DLL Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	771774224
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771775049
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.BUD Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771796673
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.BUD Access: query and read Type: commit Baseaddress: 32E0000 Size: 61440 Protection: readonly Mapped to pid: own pid	success or wait	771797597
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771798606
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\StdNames.gpd Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771799850
File opened	Path: C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\mxdwdui.ini Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file and open no recall Attributes: normal Content Overwritten: true	success or wait	771803654
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.ini Access: query and read Type: commit Baseaddress: 32F0000 Size: 4096 Protection: readonly Mapped to pid: own pid	success or wait	771804508
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: write and read and execute Type: commit Baseaddress: 32F0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	771807086
Section loaded	Path: C:\WINDOWS\system32\spool\drivers\w32x86\3\mxdwdui.dll Access: query and write and read and execute Type: image Baseaddress: 3F960000 Size: 212992 Protection: read write Mapped to pid: own pid	success or wait	771809550
Message posted	TID: 7DC Message: C08C WParam: 0 LParam: 1780	success	771835836
Thread terminated	TID: 1780 PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	unknown	771837095
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common Name: QMEnable	success or wait	791416009
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: LastProduct	success or wait	791416409
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9} Name: InstallType	success or wait	791417590
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9} Name: SourceType	success or wait	791417920
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9} Name: Upgrade	success or wait	791418240
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9} Name: OODS	success or wait	791418556
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9} Name: Location	success or wait	791418872
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9} Name: PIDKEY	success or wait	791419186
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\Config\{90110409-6000-11D3-8CFE-0150048383C9} Name: LocalCache	success or wait	791419499
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Excel\InstallRoot Name: Path	success or wait	791420463
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\PowerPoint\InstallRoot Name: Path	success or wait	791422862
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Word\InstallRoot Name: Path	success or wait	791423471
System info queried	Type: ProcessorInformation	success or wait	791424075
Key value queried	Path: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Name: ~MHz	success or wait	791424553
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate Name: BytesPerSec	object name not found	791426793
System info queried	Type: CurrentTimeZoneInformation	success or wait	791427818
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer Name: Build	success or wait	791428507
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer Name: Version	success or wait	791428843
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common Name: QMEnable	success or wait	791429262
System info queried	Type: PerformanceInformation	success or wait	791430357
Process information queried	PID: 900 Info Class: QuotaLimits	success or wait	791430759
Process information queried	PID: 900 Info Class: VmCounters	success or wait	791430952
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\.htm Name: NULL	success or wait	791431920
File opened	Path: C:\WINDOWS\system32 Access: read data or list directory and synchronize Options: directory file and synchronous io non alert and open for free space query Overwritten: false	success or wait	791432292
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common Name: QMInternalUID	object name not found	791433483
Key value queried	Path: HKEY_USERS\Control Panel\International\Geo Name: Nation	success or wait	791435351
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion Name: CommonFilesDir	success or wait	791436436
File opened	Path: C:\Program Files\Common Files\system\ado\msadox.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	791437573
Section loaded	Path: C:\Program Files\Common Files\System\ado\msadox.dll Access: write and read and execute Type: commit Baseaddress: 2CB0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	791438376
File opened	Path: C:\Program Files\Common Files\system\ado\msadox.dll Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	791439862
Section loaded	Path: C:\Program Files\Common Files\System\ado\msadox.dll Access: query and read Type: commit Baseaddress: 2CB0000 Size: 200704 Protection: readonly Mapped to pid: own pid	success or wait	791440663
File opened	Path: C:\Program Files\Common Files\system\ado\msadox.dll Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	791443953
Section loaded	Path: C:\Program Files\Common Files\System\ado\msadox.dll Access: write and read and execute Type: commit Baseaddress: 2CB0000 Size: 200704 Protection: execute Mapped to pid: own pid	success or wait	791444752
File opened	Path: C:\Program Files\Common Files\system\ado\msadox.dll Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	791446225
Section loaded	Path: C:\Program Files\Common Files\System\ado\msadox.dll Access: query and read Type: commit Baseaddress: 2CB0000 Size: 200704 Protection: readonly Mapped to pid: own pid	success or wait	791447023
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\Common Name: QmIMID	object name not found	791452191
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MessengerService Name: InstallationDirectory	success or wait	791453700
File opened	Path: C:\Program Files\Messenger\msmsgs.exe Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	791456013
Section loaded	Path: C:\Program Files\Messenger\msmsgs.exe Access: write and read and execute Type: commit Baseaddress: 2EE0000 Size: 1695744 Protection: execute Mapped to pid: own pid	success or wait	791456780
File opened	Path: C:\Program Files\Messenger\msmsgs.exe Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	791458225
Section loaded	Path: C:\Program Files\Messenger\msmsgs.exe Access: query and read Type: commit Baseaddress: 2EE0000 Size: 1695744 Protection: readonly Mapped to pid: own pid	success or wait	791458986
File opened	Path: C:\Program Files\Messenger\msmsgs.exe Access: execute or traverse and synchronize Options: synchronous io non alert and non directory file Overwritten: false	success or wait	791473112
Section loaded	Path: C:\Program Files\Messenger\msmsgs.exe Access: write and read and execute Type: commit Baseaddress: 2EE0000 Size: 1695744 Protection: execute Mapped to pid: own pid	success or wait	791473875
File opened	Path: C:\Program Files\Messenger\msmsgs.exe Access: read attributes and synchronize and generic read Options: synchronous io non alert and non directory file Attributes: none Content Overwritten: true	success or wait	791475324
Section loaded	Path: C:\Program Files\Messenger\msmsgs.exe Access: query and read Type: commit Baseaddress: 2EE0000 Size: 1695744 Protection: readonly Mapped to pid: own pid	success or wait	791476079
Key value queried	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\General Name: CustomizableAlertBaseURL	object name not found	791483786
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Registration\{90110409-6000-11D3-8CFE-0150048383C9} Name: ProductID	success or wait	791484266
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\BDAB17EF6C1EC5848A53E114D327F3CA Name: 9040110900063D11C8EF10054038389C	success or wait	791486608
Key value queried	Path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\11.0\Common\ProductVersion Name: ProInfo	success or wait	791487019
Key value replaced with same	Path: HKEY_USERS\Software\Microsoft\Office\11.0\Common\BaseSuite Name: 1EBDE4BC9A514630B5412561FA45CCC5 Type: dword Data: 1 Old data:	success or wait	791488147
Foreground Window Got	HWND: 6014A	success	965806601
Thread created	PID: 900 TID: 180 EIP: 7C8106F9 EAX: 77E76C7D Imagepath: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	969891862
Thread resumed	TID: 180 PID: 900 Path: C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE	success or wait	969892662

General Information

Classification / Threat Score

Matching Signatures

Startup

Created / dropped Files

Contacted Domains

Contacted IPs

Static File Info

String Analysis

Network Behavior

Code Manipulation Behavior

System Behavior

Analysis File: WINWORD.EXE PID: 1160 Parent PID: 1884

File Activites

Section Activites

Registry Activites

Mutex Activites

Process Activites

Thread Activites

Memory Activites

System Activites

Timing Activites

Windows UI Activites

Process Token Activites

Analysis File: svchost.exe PID: 1832 Parent PID: 624

File Activites

Section Activites

Registry Activites

Mutex Activites

Process Activites

Thread Activites

Memory Activites

System Activites

Timing Activites

Process Token Activites

Object Security Activites

Analysis File: ~WORDL.tmp PID: 1112 Parent PID: 1160

File Activites

Section Activites

Registry Activites

Mutex Activites

Process Activites

Thread Activites

Memory Activites

System Activites

Timing Activites

Windows UI Activites

Process Token Activites

Analysis File: cmd.exe PID: 1096 Parent PID: 1160

File Activites

Section Activites

Registry Activites

Mutex Activites

Process Activites

Thread Activites

Memory Activites

System Activites

Timing Activites

Windows UI Activites

Process Token Activites

Analysis File: rundll32.exe PID: 760 Parent PID: 1112

File Activites

Section Activites

Registry Activites

Mutex Activites

Process Activites

Thread Activites

Memory Activites

System Activites

Timing Activites

Windows UI Activites

Analysis File: cmd.exe PID: 868 Parent PID: 1112

File Activites

Section Activites

Registry Activites

Mutex Activites

Process Activites

Memory Activites

System Activites

Analysis File: WINWORD.EXE PID: 900 Parent PID: 1096