恶意代码分析实战 windbg恶意软件分析 lab 10-3 通过rootkit隐藏恶意进程 这玩意要玩得很6的话 还是要对windows内核编程非常熟才行

问题

1.这个程序做了些什么？

 

 

 

 

 sys里面反编译看到的：

 

从静态分析初步看，应该是sys rootkit方式注册的服务来运行恶意代码，sys里会删除什么东西。

 

 

解答：书上说本次实验包括一个驱动程序和一个可执行文件，还要把驱动程序放到C:\Windows\System32目录下面，我们试试

 

 实际运行，

 

 任务管理器里面没有lab10-03.exe，实现了进程隐藏！！！

 

procmon采集的数据：

"时间","进程名","PID","操作","路径","结果","详细信息"
"21:50:34.8803721","Lab10-03.exe","1128","Process Start","","SUCCESS","Parent PID: 1796, Command line: ""C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe"" , Current directory: C:\Documents and Settings\Administrator\桌面\lab, Environment: ;	=::=::\;	ALLUSERSPROFILE=C:\Documents and Settings\All Users;	APPDATA=C:\Documents and Settings\Administrator\Application Data;	CLIENTNAME=Console;	CommonProgramFiles=C:\Program Files\Common Files;	COMPUTERNAME=BONELEE-B1632A4;	ComSpec=C:\WINDOWS\system32\cmd.exe;	FP_NO_HOST_CHECK=NO;	HOMEDRIVE=C:;	HOMEPATH=\Documents and Settings\Administrator;	LOGONSERVER=\\BONELEE-B1632A4;	NUMBER_OF_PROCESSORS=4;	OS=Windows_NT;	Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;	PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;	PROCESSOR_ARCHITECTURE=x86;	PROCESSOR_IDENTIFIER=x86 Family 6 Model 167 Stepping 1, GenuineIntel;	PROCESSOR_LEVEL=6;	PROCESSOR_REVISION=a701;	ProgramFiles=C:\Program Files;	SESSIONNAME=Console;	SystemDrive=C:;	SystemRoot=C:\WINDOWS;	TEMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp;	TMP=C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp;	USERDOMAIN=BONELEE-B1632A4;	USERNAME=Administrator;	USERPROFILE=C:\Documents and Settings\Administrator;	windir=C:\WINDOWS"
"21:50:34.8803733","Lab10-03.exe","1128","Thread Create","","SUCCESS","Thread ID: 1096"
"21:50:34.8806149","Lab10-03.exe","1128","QueryNameInformationFile","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS","Name: \Documents and Settings\Administrator\桌面\lab\Lab10-03.exe"
"21:50:34.8809136","Lab10-03.exe","1128","Load Image","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS","Image Base: 0x400000, Image Size: 0x6000"
"21:50:34.8812627","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\ntdll.dll","SUCCESS","Image Base: 0x7c920000, Image Size: 0x93000"
"21:50:34.8812836","Lab10-03.exe","1128","QueryNameInformationFile","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS","Name: \Documents and Settings\Administrator\桌面\lab\Lab10-03.exe"
"21:50:34.8814479","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\Prefetch\LAB10-03.EXE-078DF20B.pf","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: None, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8815512","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\Prefetch\LAB10-03.EXE-078DF20B.pf","SUCCESS","AllocationSize: 12,288, EndOfFile: 10,590, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8816517","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\Prefetch\LAB10-03.EXE-078DF20B.pf","SUCCESS","Offset: 0, Length: 10,590"
"21:50:34.8818826","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\Prefetch\LAB10-03.EXE-078DF20B.pf","SUCCESS",""
"21:50:34.8819266","Lab10-03.exe","1128","CreateFile","C:","SUCCESS","Desired Access: Read Attributes, Write Attributes, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8819656","Lab10-03.exe","1128","QueryInformationVolume","C:","SUCCESS","VolumeCreationTime: 2022-10-2 3:29:03, VolumeSerialNumber: AC10-70A8, SupportsObjects: True, VolumeLabel: "
"21:50:34.8819807","Lab10-03.exe","1128","FileSystemControl","C:","SUCCESS","Control: FSCTL_FILE_PREFETCH"
"21:50:34.8820024","Lab10-03.exe","1128","CreateFile","C:\","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8820241","Lab10-03.exe","1128","QueryDirectory","C:\","SUCCESS","0: AUTOEXEC.BAT, 1: boot.ini, 2: bootfont.bin, 3: CONFIG.SYS, 4: DLL1.dll, 5: DLL2.dll, 6: Documents and Settings, 7: IO.SYS, 8: Lab09-01.exe, 9: MSDOS.SYS, 10: NTDETECT.COM, 11: ntldr, 12: ocl.exe, 13: pagefile.sys, 14: Program Files, 15: RECYCLER, 16: System Volume Information, 17: WINDOWS"
"21:50:34.8821083","Lab10-03.exe","1128","QueryDirectory","C:\","NO MORE FILES",""
"21:50:34.8821514","Lab10-03.exe","1128","CloseFile","C:\","SUCCESS",""
"21:50:34.8823496","Lab10-03.exe","1128","CreateFile","C:\DOCUMENTS AND SETTINGS","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8824155","Lab10-03.exe","1128","QueryDirectory","C:\Documents and Settings","SUCCESS","0: ., 1: .., 2: Administrator, 3: All Users, 4: Default User, 5: LocalService, 6: NetworkService"
"21:50:34.8825034","Lab10-03.exe","1128","QueryDirectory","C:\Documents and Settings","NO MORE FILES",""
"21:50:34.8825815","Lab10-03.exe","1128","CloseFile","C:\Documents and Settings","SUCCESS",""
"21:50:34.8827173","Lab10-03.exe","1128","CreateFile","C:\Documents and Settings\ADMINISTRATOR","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8827508","Lab10-03.exe","1128","QueryDirectory","C:\Documents and Settings\Administrator","SUCCESS","0: ., 1: .., 2: Application Data, 3: Cookies, 4: Favorites, 5: Local Settings, 6: log.txt, 7: My Documents, 8: NetHood, 9: NTUSER.DAT, 10: ntuser.dat.LOG, 11: ntuser.ini, 12: PrintHood, 13: Recent, 14: SendTo, 15: Templates, 16: UserData, 17: 「开始」菜单, 18: 桌面"
"21:50:34.8828602","Lab10-03.exe","1128","QueryDirectory","C:\Documents and Settings\Administrator","NO MORE FILES",""
"21:50:34.8829006","Lab10-03.exe","1128","CloseFile","C:\Documents and Settings\Administrator","SUCCESS",""
"21:50:34.8831590","Lab10-03.exe","1128","CreateFile","C:\Documents and Settings\Administrator\桌面","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8832654","Lab10-03.exe","1128","QueryDirectory","C:\Documents and Settings\Administrator\桌面","SUCCESS","0: ., 1: .., 2: DLL1.dll, 3: DLL2.dll, 4: Firefox-latest.exe, 5: lab, 6: Lab09-01.exe, 7: Lab09-02.exe, 8: Lab10-02.exe, 9: LieBaoBrowser.exe, 10: Logfile.CSV, 11: Logfile2.CSV, 12: NetFx20SP1_x86.exe, 13: ocl.exe, 14: ProcessExplorer-20161118, 15: ProcessExplorer-20161118.zip, 16: ProcessMonitor_3.83, 17: ProcessMonitor_3.83.zip, 18: Procmon汉化版 v3.20.0.0.exe, 19: reg1-202210041846.hivu, 20: Regshot-1.9.0, 21: WinDbg.lnk, 22: Windbgx86-v6.12.2.633.msi, 23: WindowsXP-KB936929-SP3-x86-symbols-full-ENU.exe, 24: winsdk_web.exe, 25: ~res-x86.txt, 26: 快捷方式 到 procexp.lnk, 27: 猎豹安全浏览器.lnk"
"21:50:34.8833831","Lab10-03.exe","1128","QueryDirectory","C:\Documents and Settings\Administrator\桌面","NO MORE FILES",""
"21:50:34.8834706","Lab10-03.exe","1128","CloseFile","C:\Documents and Settings\Administrator\桌面","SUCCESS",""
"21:50:34.8836590","Lab10-03.exe","1128","CreateFile","C:\Documents and Settings\Administrator\桌面\lab","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8837524","Lab10-03.exe","1128","QueryDirectory","C:\Documents and Settings\Administrator\桌面\lab","SUCCESS","0: ., 1: .., 2: Lab10-01.exe, 3: Lab10-01.sys, 4: Lab10-02.exe, 5: Lab10-03.exe, 6: Lab10-03.sys"
"21:50:34.8840274","Lab10-03.exe","1128","QueryDirectory","C:\Documents and Settings\Administrator\桌面\lab","NO MORE FILES",""
"21:50:34.8841289","Lab10-03.exe","1128","CloseFile","C:\Documents and Settings\Administrator\桌面\lab","SUCCESS",""
"21:50:34.8842501","Lab10-03.exe","1128","CreateFile","C:\WINDOWS","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8843212","Lab10-03.exe","1128","QueryDirectory","C:\WINDOWS","SUCCESS","0: ., 1: .., 2: 0.log, 3: addins, 4: AppPatch, 5: assembly, 6: Blue Lace 16.bmp, 7: bootstat.dat, 8: clock.avi, 9: cmsetacl.log, 10: Coffee Bean.bmp, 11: comsetup.log, 12: Config, 13: Connection Wizard, 14: control.ini, 15: Cursors, 16: Debug, 17: desktop.ini, 18: Downloaded Program Files, 19: Driver Cache, 20: DtcInstall.log, 21: ehome, 22: explorer.exe, 23: explorer.scf, 24: FaxSetup.log, 25: FeatherTexture.bmp, 26: Fonts, 27: Gone Fishing.bmp, 28: Greenstone.bmp, 29: Help, 30: hh.exe, 31: iis6.log, 32: ime, 33: imsins.BAK, 34: imsins.log, 35: inf, 36: Installer, 37: java, 38: L2Schemas, 39: MedCtrOC.log, 40: Media, 41: Microsoft.NET, 42: msagent, 43: msapps, 44: msdfmap.ini, 45: msgsocm.log, 46: msmqinst.log, 47: mui, 48: netfxocm.log, 49: Network Diagnostic, 50: NOTEPAD.EXE, 51: ntdtcsetup.log, 52: ocgen.log, 53: ocmsn.log, 54: ODBCINST.INI, 55: OEWABLog.txt, 56: Offline Web Pages, 57: oobeact.log, 58: pchealth, 59: PeerNet, 60: Prairie Wind.bmp, 61: Prefetch, 62: Provisioning, 63: regedit.exe, 64: Registration, 65: REGLOCS.OLD, 66: regopt.log, 67: repair, 68: Resources, 69: Rhododendron.bmp, 70: River Sumida.bmp, 71: Santa Fe Stucco.bmp, 72: SchedLgU.Txt, 73: security, 74: sessmgr.setup.log, 75: SET3.tmp, 76: SET4.tmp, 77: SET8.tmp, 78: setupact.log, 79: setupapi.log, 80: setuperr.log, 81: setuplog.txt, 82: Soap Bubbles.bmp, 83: SoftwareDistribution, 84: srchasst, 85: Sti_Trace.log, 86: Symbols, 87: system, 88: system.ini, 89: system32, 90: tabletoc.log, 91: TASKMAN.EXE, 92: Tasks, 93: Temp, 94: tsoc.log, 95: twain.dll, 96: twain_32, 97: twain_32.dll, 98: twunk_16.exe, 99: twunk_32.exe, 100: vb.ini, 101: vbaddin.ini, 102: vmmreg32.dll, 103: Web, 104: wiadebug.log, 105: wiaservc.log, 106: win.ini, 107: WindowsShell.Manifest, 108: WindowsUpdate.log, 109: winhelp.exe, 110: winhlp32.exe, 111: winnt.bmp, 112: winnt256.bmp, 113: WinSxS, 114: wmprfCHS.prx, 115: wmsetup.log, 116: WMSysPr9.prx, 117: Zapotec.bmp, 118: _default.pif"
"21:50:34.8844144","Lab10-03.exe","1128","QueryDirectory","C:\WINDOWS","NO MORE FILES",""
"21:50:34.8845046","Lab10-03.exe","1128","CloseFile","C:\WINDOWS","SUCCESS",""
"21:50:34.8846256","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\REGISTRATION","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8846945","Lab10-03.exe","1128","QueryDirectory","C:\WINDOWS\Registration","SUCCESS","0: ., 1: .., 2: CRMLog, 3: R000000000006.clb, 4: R000000000007.clb, 5: {02D4B3F1-FD88-11D1-960D-00805FC79235}.{A04B4CFB-6F67-45EB-8DF3-C08B604D27E0}.crmlog"
"21:50:34.8848099","Lab10-03.exe","1128","QueryDirectory","C:\WINDOWS\Registration","NO MORE FILES",""
"21:50:34.8848863","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\Registration","SUCCESS",""
"21:50:34.8850294","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32","SUCCESS","Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8851331","Lab10-03.exe","1128","QueryDirectory","C:\WINDOWS\system32","SUCCESS","0: ., 1: .., 2: $winnt$.inf, 3: 1025, 4: 1028, 5: 1031, 6: 1033, 7: 1037, 8: 1041, 9: 1042, 10: 1054, 11: 12520437.cpx, 12: 12520850.cpx, 13: 2052, 14: 3076, 15: 3com_dmi, 16: 6to4svc.dll, 17: a15.tbl, 18: a234.tbl, 19: aaaamon.dll, 20: aaclient.dll, 21: access.cpl, 22: acctres.dll, 23: accwiz.exe, 24: acelpdec.ax, 25: acledit.dll, 26: aclui.dll, 27: acode.tbl, 28: activeds.dll, 29: activeds.tlb, 30: actmovie.exe, 31: actxprxy.dll, 32: admparse.dll, 33: adptif.dll, 34: adsldp.dll, 35: adsldpc.dll, 36: adsmsext.dll, 37: adsnds.dll, 38: adsnt.dll, 39: adsnw.dll, 40: advapi32.dll, 41: advpack.dll, 42: ahui.exe, 43: alg.exe, 44: alrsvc.dll, 45: amcompat.tlb, 46: amstream.dll, 47: ansi.sys, 48: apcups.dll, 49: append.exe, 50: apphelp.dll, 51: appmgmt, 52: appmgmts.dll, 53: appmgr.dll, 54: appwiz.cpl, 55: arp.exe, 56: arphr.tbl, 57: arptr.tbl, 58: array30.tab, 59: arrayhw.tab, 60: asctrls.ocx, 61: asferror.dll, 62: asr_fmt.exe, 63: asr_ldm.exe, 64: asr_pfu.exe, 65: asycfilt.dll, 66: at.exe, 67: atkctrs.dll, 68: atl.dll, 69: atmadm.exe, 70: atmfd.dll, 71: atmlib.dll, 72: atmpvcno.dll, 73: atrace.dll, 74: attrib.exe, 75: audiosrv.dll, 76: auditusr.exe, 77: authz.dll, 78: autochk.exe, 79: autoconv.exe, 80: autodisc.dll, 81: AUTOEXEC.NT, 82: autofmt.exe, 83: autolfn.exe, 84: avicap.dll, 85: avicap32.dll, 86: avifil32.dll, 87: avifile.dll, 88: avmeter.dll, 89: avtapi.dll, 90: avwav.dll, 91: azroles.dll, 92: basesrv.dll, 93: batmeter.dll, 94: batt.dll, 95: bidispl.dll, 96: big5.nls, 97: bios1.rom, 98: bios4.rom, 99: bitsprx2.dll, 100: bitsprx3.dll, 101: bitsprx4.dll, 102: blackbox.dll, 103: blastcln.exe, 104: bootcfg.exe, 105: bootok.exe, 106: bootvid.dll, 107: bootvrfy.exe, 108: bopomofo.nls, 109: bopomofo.uce, 110: browselc.dll, 111: browser.dll, 112: browseui.dll, 113: browsewm.dll, 114: bthci.dll, 115: bthprops.cpl, 116: bthserv.dll, 117: btpanui.dll, 118: cabinet.dll, 119: cabview.dll, 120: cacls.exe, 121: calc.exe, 122: camocx.dll, 123: capesnpn.dll, 124: cards.dll, 125: CatRoot, 126: CatRoot2, 127: catsrv.dll, 128: catsrvps.dll, 129: catsrvut.dll, 130: ccfgnt.dll, 131: cdfview.dll, 132: cdm.dll, 133: cdmodem.dll, 134: cdosys.dll, 135: cdplayer.exe.manifest, 136: certcli.dll, 137: certmgr.dll, 138: certmgr.msc, 139: cewmdm.dll, 140: cfgbkend.dll, 141: cfgmgr32.dll, 142: chajei.ime, 143: charmap.exe, 144: chcp.com, 145: chkdsk.exe, 146: chkntfs.exe, 147: ChsBrKr.dll, 148: chtbrkr.dll, 149: ciadmin.dll, 150: ciadv.msc, 151: cic.dll, 152: cidaemon.exe, 153: CINTLGNT.IME, 154: ciodm.dll, 155: cipher.exe, 156: cisvc.exe, 157: ckcnv.exe, 158: clb.dll, 159: clbcatex.dll, 160: clbcatq.dll, 161: cleanmgr.exe, 162: cliconf.chm, 163: cliconfg.dll, 164: cliconfg.exe, 165: cliconfg.rll, 166: clipbrd.exe, 167: clipsrv.exe, 168: clusapi.dll, 169: cmcfg32.dll, 170: cmd.exe, 171: cmdial32.dll, 172: cmdl32.exe, 173: cmdlib.wsc, 174: cmmgr32.hlp, 175: cmmon32.exe, 176: cmos.ram, 177: cmpbk32.dll, 178: cmprops.dll, 179: cmsetACL.dll, 180: cmstp.exe, 181: cmutil.dll, 182: cnbjmon.dll, 183: cnetcfg.dll, 184: cnvfat.dll, 185: colbact.dll, 186: Com, 187: comaddin.dll, 188: comcat.dll, 189: comctl32.dll, 190: comdlg32.dll, 191: comm.drv, 192: command.com, 193: commdlg.dll, 194: comp.exe, 195: compact.exe, 196: compatUI.dll, 197: compmgmt.msc, 198: compobj.dll, 199: compstui.dll, 200: comrepl.dll, 201: comres.dll, 202: comsnap.dll, 203: comsvcs.dll, 204: comuid.dll, 205: config, 206: CONFIG.NT, 207: CONFIG.TMP, 208: confmsp.dll, 209: conime.exe, 210: console.dll, 211: control.exe, 212: convert.exe, 213: corpol.dll, 214: country.sys, 215: credssp.dll, 216: credui.dll, 217: crtdll.dll, 218: crypt32.dll, 219: cryptdlg.dll, 220: cryptdll.dll, 221: cryptext.dll, 222: cryptnet.dll, 223: cryptsvc.dll, 224: cryptui.dll, 225: cscdll.dll, 226: cscript.exe, 227: cscui.dll, 228: csrsrv.dll, 229: csrss.exe, 230: csseqchk.dll, 231: ctfmon.exe, 232: ctl3d32.dll, 233: ctl3dv2.dll, 234: ctype.nls, 235: c_037.nls, 236: c_10000.nls, 237: c_10001.nls, 238: c_10002.nls, 239: c_10003.nls, 240: c_10006.nls, 241: c_10007.nls, 242: c_10008.nls, 243: c_10010.nls, 244: c_10017."
"21:50:34.8853234","Lab10-03.exe","1128","QueryDirectory","C:\WINDOWS\system32","SUCCESS","0: dssec.dat, 1: dssec.dll, 2: dssenh.dll, 3: dsuiext.dll, 4: dswave.dll, 5: dumprep.exe, 6: duser.dll, 7: dvdplay.exe, 8: dvdupgrd.exe, 9: dwwin.exe, 10: dx7vb.dll, 11: dx8vb.dll, 12: dxdiag.exe, 13: dxdiagn.dll, 14: dxmasf.dll, 15: dxtmsft.dll, 16: dxtrans.dll, 17: eapolqec.dll, 18: eapp3hst.dll, 19: eappcfg.dll, 20: eappgnui.dll, 21: eapphost.dll, 22: eappprxy.dll, 23: eapqec.dll, 24: eapsvc.dll, 25: edit.com, 26: edit.hlp, 27: edlin.exe, 28: efsadu.dll, 29: ega.cpi, 30: els.dll, 31: emptyregdb.dat, 32: encapi.dll, 33: encdec.dll, 34: EqnClass.Dll, 35: ersvc.dll, 36: es.dll, 37: esent.dll, 38: esent97.dll, 39: esentprf.dll, 40: esentprf.hxx, 41: esentprf.ini, 42: esentutl.exe, 43: eudcedit.exe, 44: eula.txt, 45: eventcls.dll, 46: eventcreate.exe, 47: eventlog.dll, 48: eventquery.vbs, 49: eventtriggers.exe, 50: eventvwr.exe, 51: eventvwr.msc, 52: exe2bin.exe, 53: expand.exe, 54: export, 55: expsrv.dll, 56: extmgr.dll, 57: extrac32.exe, 58: exts.dll, 59: f3ahvoas.dll, 60: fastopen.exe, 61: faultrep.dll, 62: fc.exe, 63: fde.dll, 64: fdeploy.dll, 65: feclient.dll, 66: femgrate.exe, 67: filemgmt.dll, 68: find.exe, 69: findstr.exe, 70: finger.exe, 71: firewall.cpl, 72: fixmapi.exe, 73: fldrclnr.dll, 74: fltlib.dll, 75: fltMc.exe, 76: fmifs.dll, 77: FNTCACHE.DAT, 78: fontext.dll, 79: fontsub.dll, 80: fontview.exe, 81: forcedos.exe, 82: format.com, 83: framebuf.dll, 84: freecell.exe, 85: fsmgmt.msc, 86: fsquirt.exe, 87: fsusd.dll, 88: fsutil.exe, 89: ftp.exe, 90: ftsrch.dll, 91: fwcfg.dll, 92: g711codc.ax, 93: gb2312.uce, 94: gcdef.dll, 95: gdi.exe, 96: gdi32.dll, 97: geo.nls, 98: getmac.exe, 99: getuname.dll, 100: glmf32.dll, 101: glu32.dll, 102: gpedit.dll, 103: gpedit.msc, 104: gpkcsp.dll, 105: gpkrsrc.dll, 106: gpresult.exe, 107: gptext.dll, 108: gpupdate.exe, 109: graftabl.com, 110: graphics.com, 111: graphics.pro, 112: grpconv.exe, 113: h323.tsp, 114: h323log.txt, 115: h323msp.dll, 116: hal.dll, 117: hccoin.dll, 118: hdwwiz.cpl, 119: help.exe, 120: hhctrl.ocx, 121: hhsetup.dll, 122: hid.dll, 123: hidphone.tsp, 124: himem.sys, 125: hlink.dll, 126: hnetcfg.dll, 127: hnetmon.dll, 128: hnetwiz.dll, 129: homepage.inf, 130: hostname.exe, 131: hotplug.dll, 132: hticons.dll, 133: html.iec, 134: httpapi.dll, 135: htui.dll, 136: hypertrm.dll, 137: iac25_32.ax, 138: ias, 139: iasacct.dll, 140: iasads.dll, 141: iashlpr.dll, 142: iasnap.dll, 143: iaspolcy.dll, 144: iasrad.dll, 145: iasrecst.dll, 146: iassam.dll, 147: iassdo.dll, 148: iassvcs.dll, 149: icaapi.dll, 150: iccvid.dll, 151: icfgnt5.dll, 152: icm32.dll, 153: icmp.dll, 154: icmui.dll, 155: icsxml, 156: icwdial.dll, 157: icwphbk.dll, 158: ideograf.uce, 159: idq.dll, 160: ie4uinit.exe, 161: ieakeng.dll, 162: ieaksie.dll, 163: ieakui.dll, 164: iedkcs32.dll, 165: ieencode.dll, 166: iepeers.dll, 167: iernonce.dll, 168: iesetup.dll, 169: ieuinit.inf, 170: iexpress.exe, 171: ifmon.dll, 172: ifsutil.dll, 173: igmpagnt.dll, 174: iissuba.dll, 175: ils.dll, 176: imaadp32.acm, 177: imagehlp.dll, 178: imapi.exe, 179: IME, 180: imegen.tpl, 181: imekr61.ime, 182: imeshare.dll, 183: imgutil.dll, 184: imjp81.ime, 185: imjp81k.dll, 186: imm32.dll, 187: inetcfg.dll, 188: inetcomm.dll, 189: inetcpl.cpl, 190: inetcplc.dll, 191: inetmib1.dll, 192: inetpp.dll, 193: inetppui.dll, 194: inetres.dll, 195: inetsrv, 196: infosoft.dll, 197: initpki.dll, 198: input.dll, 199: inseng.dll, 200: instcat.sql, 201: intl.cpl, 202: iologmsg.dll, 203: ipconf.tsp, 204: ipconfig.exe, 205: iphlpapi.dll, 206: ipmontr.dll, 207: ipnathlp.dll, 208: ippromon.dll, 209: iprop.dll, 210: iprtprio.dll, 211: iprtrmgr.dll, 212: ipsec6.exe, 213: ipsecsnp.dll, 214: ipsecsvc.dll, 215: ipsmsnap.dll, 216: ipv6.exe, 217: ipv6mon.dll, 218: ipxmontr.dll, 219: ipxpromn.dll, 220: ipxrip.dll, 221: ipxroute.exe, 222: ipxrtmgr.dll, 223: ipxsap.dll, 224: ipxwan.dll, 225: ir32_32.dll, 226: ir41_32.ax, 227: ir41_qc.dll, 228: ir41_qcx.dll, 229: ir50_32.dll, 230: ir50_qc.dll, 231: ir50_qcx.dll, 232: irclass.dll, 233: irftp.exe, 234: irmon.dll, 235: irprops.cpl, 236: isign32.dll, 237: isrdbg32.dll, 238: itircl.dll, 239: itss.dll, 240: iuengine.d"
"21:50:34.8855987","Lab10-03.exe","1128","QueryDirectory","C:\WINDOWS\system32","SUCCESS","0: mfc40u.dll, 1: mfc42.dll, 2: mfc42loc.dll, 3: mfc42u.dll, 4: mfc71.dll, 5: mfc71u.dll, 6: mfcsubs.dll, 7: mgmtapi.dll, 8: mib.bin, 9: Microsoft, 10: microsoft.managementconsole.dll, 11: midimap.dll, 12: miglibnt.dll, 13: migpwd.exe, 14: mimefilt.dll, 15: miniime.tpl, 16: mlang.dat, 17: mlang.dll, 18: mll_hp.dll, 19: mll_mtf.dll, 20: mll_qic.dll, 21: Mlwx486.sys, 22: mmc.exe, 23: mmcbase.dll, 24: mmcex.dll, 25: mmcfxcommon.dll, 26: mmcndmgr.dll, 27: mmcperf.exe, 28: mmcshext.dll, 29: mmdriver.inf, 30: mmdrv.dll, 31: mmfutil.dll, 32: mmsys.cpl, 33: mmsystem.dll, 34: mmtask.tsk, 35: mmutilse.dll, 36: mnmdd.dll, 37: mnmsrvc.exe, 38: mobsync.dll, 39: mobsync.exe, 40: mode.com, 41: modemui.dll, 42: modex.dll, 43: more.com, 44: moricons.dll, 45: mountvol.exe, 46: mouse.drv, 47: mp43dmod.dll, 48: mp4sdmod.dll, 49: mpeg2data.ax, 50: mpg2splt.ax, 51: mpg4dmod.dll, 52: mpg4ds32.ax, 53: mplay32.exe, 54: mpnotify.exe, 55: mpr.dll, 56: mprapi.dll, 57: mprddm.dll, 58: mprdim.dll, 59: mprmsg.dll, 60: mprui.dll, 61: mqad.dll, 62: mqbkup.exe, 63: mqcertui.dll, 64: mqdscli.dll, 65: mqgentr.dll, 66: mqise.dll, 67: mqlogmgr.dll, 68: mqoa.dll, 69: mqoa.tlb, 70: mqoa10.tlb, 71: mqoa20.tlb, 72: mqperf.dll, 73: mqperf.ini, 74: mqprfsym.h, 75: mqqm.dll, 76: mqrt.dll, 77: mqrtdep.dll, 78: mqsec.dll, 79: mqsnap.dll, 80: mqsvc.exe, 81: mqtgsvc.exe, 82: mqtrig.dll, 83: mqupgrd.dll, 84: mqutil.dll, 85: mrinfo.exe, 86: msaatext.dll, 87: msacm.dll, 88: msacm32.dll, 89: msacm32.drv, 90: msadds32.ax, 91: msadp32.acm, 92: msafd.dll, 93: msapsspc.dll, 94: msasn1.dll, 95: msaud32.acm, 96: msaudite.dll, 97: mscat32.dll, 98: mscdexnt.exe, 99: mscms.dll, 100: msconf.dll, 101: mscoree.dll, 102: mscorier.dll, 103: mscories.dll, 104: mscpx32r.dLL, 105: mscpxl32.dLL, 106: MSCTF.dll, 107: MSCTFIME.IME, 108: MSCTFP.dll, 109: msdadiag.dll, 110: msdart.dll, 111: msdatsrc.tlb, 112: msdayi.tbl, 113: msdmo.dll, 114: MsDtc, 115: msdtc.exe, 116: msdtclog.dll, 117: msdtcprf.h, 118: msdtcprf.ini, 119: msdtcprx.dll, 120: msdtctm.dll, 121: msdtcuiu.dll, 122: msdxm.ocx, 123: msdxmlc.dll, 124: msencode.dll, 125: msexch40.dll, 126: msexcl40.dll, 127: msftedit.dll, 128: msg.exe, 129: msg711.acm, 130: msg723.acm, 131: msgina.dll, 132: msgsm32.acm, 133: msgsvc.dll, 134: msh261.drv, 135: msh263.drv, 136: mshearts.exe, 137: mshta.exe, 138: mshtml.dll, 139: mshtml.tlb, 140: mshtmled.dll, 141: mshtmler.dll, 142: msi.dll, 143: msident.dll, 144: msidle.dll, 145: msidntld.dll, 146: msieftp.dll, 147: msiexec.exe, 148: msihnd.dll, 149: msimg32.dll, 150: msimsg.dll, 151: MSIMTF.dll, 152: msir3jp.dll, 153: msir3jp.lex, 154: msisip.dll, 155: msjet40.dll, 156: msjetoledb40.dll, 157: msjint40.dll, 158: msjter40.dll, 159: msjtes40.dll, 160: mslbui.dll, 161: msls31.dll, 162: msltus40.dll, 163: msnetobj.dll, 164: msnsspc.dll, 165: msobjs.dll, 166: msoeacct.dll, 167: msoert2.dll, 168: msorc32r.dll, 169: msorcl32.dll, 170: mspaint.exe, 171: mspatcha.dll, 172: mspbde40.dll, 173: mspmsnsv.dll, 174: mspmsp.dll, 175: msports.dll, 176: msprivs.dll, 177: msr2c.dll, 178: msr2cenu.dll, 179: msratelc.dll, 180: msrating.dll, 181: msrclr40.dll, 182: msrd2x40.dll, 183: msrd3x40.dll, 184: msrecr40.dll, 185: msrepl40.dll, 186: msrle32.dll, 187: mssap.dll, 188: msscds32.ax, 189: msscp.dll, 190: msscript.ocx, 191: mssha.dll, 192: msshavmsg.dll, 193: mssign32.dll, 194: mssip32.dll, 195: msswch.dll, 196: msswchx.exe, 197: mstask.dll, 198: mstext40.dll, 199: mstime.dll, 200: mstinit.exe, 201: mstlsapi.dll, 202: mstsc.exe, 203: mstscax.dll, 204: msutb.dll, 205: msv1_0.dll, 206: msvbvm50.dll, 207: msvbvm60.dll, 208: msvcirt.dll, 209: msvcp50.dll, 210: msvcp60.dll, 211: msvcr71.dll, 212: msvcrt.dll, 213: msvcrt20.dll, 214: msvcrt40.dll, 215: msvfw32.dll, 216: msvidc32.dll, 217: msvidctl.dll, 218: msvideo.dll, 219: msw3prt.dll, 220: mswdat10.dll, 221: mswebdvd.dll, 222: mswmdm.dll, 223: mswsock.dll, 224: mswstr10.dll, 225: msxbde40.dll, 226: msxml.dll, 227: msxml2.dll, 228: msxml2r.dll, 229: msxml3.dll, 230: msxml3r.dll, 231: msxml6.dll, 232: msxml6r.dll, 233: msxmlr.dll, 234: msyuv.dll, 235: mtxclu.dll, 236: mtxdm.dll, "
"21:50:34.8857598","Lab10-03.exe","1128","QueryDirectory","C:\WINDOWS\system32","SUCCESS","0: phoncode.tbl, 1: phonptr.tbl, 2: photometadatahandler.dll, 3: photowiz.dll, 4: pid.dll, 5: pid.inf, 6: pid.PNF, 7: pidgen.dll, 8: pifmgr.dll, 9: ping.exe, 10: ping6.exe, 11: PINTLGNT.IME, 12: PINTLPAD.HLP, 13: PINTLPAE.HLP, 14: pjlmon.dll, 15: plustab.dll, 16: pmspl.dll, 17: pngfilt.dll, 18: pnrpnsp.dll, 19: polstore.dll, 20: powercfg.cpl, 21: powercfg.exe, 22: powrprof.dll, 23: prc.nls, 24: prcp.nls, 25: prfc0804.dat, 26: prfd0804.dat, 27: prfh0804.dat, 28: prfi0804.dat, 29: prflbmsg.dll, 30: print.exe, 31: printui.dll, 32: prncnfg.vbs, 33: prndrvr.vbs, 34: prnjobs.vbs, 35: prnmngr.vbs, 36: prnport.vbs, 37: prnqctl.vbs, 38: proctexe.ocx, 39: prodspec.ini, 40: profmap.dll, 41: progman.exe, 42: proquota.exe, 43: proxycfg.exe, 44: psapi.dll, 45: psbase.dll, 46: pschdcnt.h, 47: pschdprf.dll, 48: pschdprf.ini, 49: pscript.sep, 50: psnppagn.dll, 51: pstorec.dll, 52: pstorsvc.dll, 53: pubprn.vbs, 54: qagent.dll, 55: qagentrt.dll, 56: qappsrv.exe, 57: qasf.dll, 58: qcap.dll, 59: qcliprov.dll, 60: qdv.dll, 61: qdvd.dll, 62: qedit.dll, 63: qedwipes.dll, 64: qmgr.dll, 65: qmgrprxy.dll, 66: qosname.dll, 67: qprocess.exe, 68: quartz.dll, 69: query.dll, 70: quick.ime, 71: qutil.dll, 72: qwinsta.exe, 73: racpldlg.dll, 74: ras, 75: rasadhlp.dll, 76: rasapi32.dll, 77: rasauto.dll, 78: rasautou.exe, 79: raschap.dll, 80: rasctrnm.h, 81: rasctrs.dll, 82: rasctrs.ini, 83: rasdial.exe, 84: rasdlg.dll, 85: rasman.dll, 86: rasmans.dll, 87: rasmontr.dll, 88: rasmxs.dll, 89: rasphone.exe, 90: rasppp.dll, 91: rasqec.dll, 92: rasrad.dll, 93: rassapi.dll, 94: rasser.dll, 95: rastapi.dll, 96: rastls.dll, 97: rcbdyctl.dll, 98: rcimlby.exe, 99: rcp.exe, 100: rdchost.dll, 101: rdpcfgex.dll, 102: rdpclip.exe, 103: rdpdd.dll, 104: rdpsnd.dll, 105: rdpwsx.dll, 106: rdsaddin.exe, 107: rdshost.exe, 108: recover.exe, 109: redir.exe, 110: reg.exe, 111: regapi.dll, 112: regedt32.exe, 113: regini.exe, 114: regsvc.dll, 115: regsvr32.exe, 116: regwiz.exe, 117: regwizc.dll, 118: ReinstallBackups, 119: relog.exe, 120: remotepg.dll, 121: remotesp.tsp, 122: rend.dll, 123: replace.exe, 124: reset.exe, 125: Restore, 126: resutils.dll, 127: rexec.exe, 128: rhttpaa.dll, 129: riched20.dll, 130: riched32.dll, 131: rnr20.dll, 132: romanime.ime, 133: route.exe, 134: routemon.exe, 135: routetab.dll, 136: rpcns4.dll, 137: rpcrt4.dll, 138: rpcss.dll, 139: rsaci.rat, 140: rsaenh.dll, 141: rsfsaps.dll, 142: rsh.exe, 143: rshx32.dll, 144: rsm.exe, 145: rsmps.dll, 146: rsmsink.exe, 147: rsmui.exe, 148: rsnotify.exe, 149: rsop.msc, 150: rsopprov.exe, 151: rsvp.exe, 152: rsvp.ini, 153: rsvpcnts.h, 154: rsvpmsg.dll, 155: rsvpperf.dll, 156: rsvpsp.dll, 157: rtcshare.exe, 158: rtipxmib.dll, 159: rtm.dll, 160: rtutils.dll, 161: runas.exe, 162: rundll32.exe, 163: runonce.exe, 164: rwinsta.exe, 165: safrcdlg.dll, 166: safrdm.dll, 167: safrslv.dll, 168: samlib.dll, 169: samsrv.dll, 170: sapi.cpl.manifest, 171: savedump.exe, 172: sbe.dll, 173: sbeio.dll, 174: sc.exe, 175: scarddlg.dll, 176: scardssp.dll, 177: scardsvr.exe, 178: sccbase.dll, 179: sccsccp.dll, 180: scecli.dll, 181: scesrv.dll, 182: schannel.dll, 183: schedsvc.dll, 184: schtasks.exe, 185: sclgntfy.dll, 186: scochs.dll, 187: scredir.dll, 188: scriptpw.dll, 189: scrnsave.scr, 190: scrobj.dll, 191: scrrnchs.dll, 192: scrrun.dll, 193: sdbinst.exe, 194: sdhcinst.dll, 195: sdpblb.dll, 196: secedit.exe, 197: seclogon.dll, 198: secpol.msc, 199: secupd.dat, 200: secupd.sig, 201: secur32.dll, 202: security.dll, 203: sendcmsg.dll, 204: sendmail.dll, 205: sens.dll, 206: sensapi.dll, 207: senscfg.dll, 208: serialui.dll, 209: servdeps.dll, 210: services.exe, 211: services.msc, 212: serwvdrv.dll, 213: sessmgr.exe, 214: sethc.exe, 215: Setup, 216: setup.bmp, 217: setup.exe, 218: setupapi.dll, 219: setupdll.dll, 220: setupn.exe, 221: setver.exe, 222: sfc.dll, 223: sfc.exe, 224: sfcfiles.dll, 225: sfc_os.dll, 226: sfmapi.dll, 227: shadow.exe, 228: share.exe, 229: shdoclc.dll, 230: shdocvw.dll, 231: shell.dll, 232: shell32.dll, 233: ShellExt, 234: shellstyle.dll, 235: shfolder.dll, 236: shgina.dll, 237: shiftjis.uce, 238: shimeng.dll, 239: sh"
"21:50:34.8859672","Lab10-03.exe","1128","QueryDirectory","C:\WINDOWS\system32","SUCCESS","0: usrrtosa.dll, 1: usrsdpia.dll, 2: usrshuta.exe, 3: usrsvpia.dll, 4: usrv42a.dll, 5: usrv80a.dll, 6: usrvoica.dll, 7: usrvpa.dll, 8: utildll.dll, 9: utilman.exe, 10: uxtheme.dll, 11: v7vga.rom, 12: vbajet32.dll, 13: vbicodec.ax, 14: vbisurf.ax, 15: vbschs.dll, 16: vbscript.dll, 17: vcdex.dll, 18: vdmdbg.dll, 19: vdmredir.dll, 20: ver.dll, 21: verclsid.exe, 22: verifier.dll, 23: verifier.exe, 24: version.dll, 25: vfpodbc.dll, 26: vga.dll, 27: vga.drv, 28: vga256.dll, 29: vga64k.dll, 30: vjoy.dll, 31: vmGuestLib.dll, 32: vmGuestLibJava.dll, 33: vmhgfs.dll, 34: VMUpgradeAtShutdownWXP.dll, 35: vmwogl32.dll, 36: VMWSU_V1_0.DLL, 37: vmx_fb.dll, 38: vmx_mode.dll, 39: vsocklib.dll, 40: vssadmin.exe, 41: vssapi.dll, 42: vssvc.exe, 43: vss_ps.dll, 44: vwipxspx.dll, 45: vwipxspx.exe, 46: w32time.dll, 47: w32tm.exe, 48: w32topl.dll, 49: w3ssl.dll, 50: watchdog.sys, 51: wavemsp.dll, 52: wbcache.deu, 53: wbcache.enu, 54: wbcache.esn, 55: wbcache.fra, 56: wbcache.ita, 57: wbcache.nld, 58: wbcache.sve, 59: wbdbase.deu, 60: wbdbase.enu, 61: wbdbase.esn, 62: wbdbase.fra, 63: wbdbase.ita, 64: wbdbase.nld, 65: wbdbase.sve, 66: wbem, 67: wdigest.dll, 68: wdl.trm, 69: wdmaud.drv, 70: webcheck.dll, 71: webclnt.dll, 72: webfldrs.msi, 73: webhits.dll, 74: webvw.dll, 75: wextract.exe, 76: wfwnet.drv, 77: wiaacmgr.exe, 78: wiadefui.dll, 79: wiadss.dll, 80: wiascr.dll, 81: wiaservc.dll, 82: wiasf.ax, 83: wiashext.dll, 84: wiavideo.dll, 85: wiavusd.dll, 86: wifeman.dll, 87: win.com, 88: win32k.sys, 89: win32spl.dll, 90: win87em.dll, 91: WINABC.CNT, 92: WINABC.CWD, 93: WINABC.HLP, 94: WINABC.IME, 95: WINABC.OVL, 96: winar30.ime, 97: winbrand.dll, 98: winchat.exe, 99: windowscodecs.dll, 100: windowscodecsext.dll, 101: WindowsLogon.manifest, 102: winfax.dll, 103: WINGB.IME, 104: winhelp.hlp, 105: winhlp32.exe, 106: winhttp.dll, 107: winime.ime, 108: wininet.dll, 109: winipsec.dll, 110: winlogon.exe, 111: winmine.exe, 112: winmm.dll, 113: winmsd.exe, 114: winnls.dll, 115: winntbbu.dll, 116: winoldap.mod, 117: WINPY.IME, 118: WINPY.MB, 119: winrnr.dll, 120: wins, 121: winscard.dll, 122: winshfhc.dll, 123: winsock.dll, 124: WINSP.IME, 125: WINSP.MB, 126: winspool.drv, 127: winspool.exe, 128: winsrv.dll, 129: winsta.dll, 130: winstrm.dll, 131: wintrust.dll, 132: winver.exe, 133: WINZM.IME, 134: WINZM.MB, 135: wkssvc.dll, 136: wlanapi.dll, 137: wldap32.dll, 138: wlnotify.dll, 139: wmadmod.dll, 140: wmadmoe.dll, 141: wmasf.dll, 142: wmdmlog.dll, 143: wmdmps.dll, 144: wmerrCHS.dll, 145: wmerror.dll, 146: wmi.dll, 147: wmidx.dll, 148: wmimgmt.msc, 149: wmiprop.dll, 150: wmiscmgr.dll, 151: wmnetmgr.dll, 152: wmp.dll, 153: wmp.ocx, 154: wmpasf.dll, 155: wmpcd.dll, 156: wmpcore.dll, 157: wmpdxm.dll, 158: wmphoto.dll, 159: wmploc.dll, 160: wmpshell.dll, 161: wmpui.dll, 162: wmsdmod.dll, 163: wmsdmoe.dll, 164: wmsdmoe2.dll, 165: wmspdmod.dll, 166: wmspdmoe.dll, 167: wmstream.dll, 168: wmv8ds32.ax, 169: wmvcore.dll, 170: wmvdmod.dll, 171: wmvdmoe2.dll, 172: wmvds32.ax, 173: wow32.dll, 174: wowdeb.exe, 175: wowexec.exe, 176: wowfax.dll, 177: wowfaxui.dll, 178: wpa.dbl, 179: wpabaln.exe, 180: wpnpinst.exe, 181: write.exe, 182: ws2help.dll, 183: ws2_32.dll, 184: wscntfy.exe, 185: wscript.exe, 186: wscsvc.dll, 187: wscui.cpl, 188: wsecedit.dll, 189: wshatm.dll, 190: wshbth.dll, 191: wshchs.dll, 192: wshcon.dll, 193: wshext.dll, 194: wship6.dll, 195: wshirda.dll, 196: wshisn.dll, 197: wshnetbs.dll, 198: wshom.ocx, 199: WshRm.dll, 200: wshtcpip.dll, 201: wsnmp32.dll, 202: wsock32.dll, 203: wstdecod.dll, 204: wstpager.ax, 205: wstrenderer.ax, 206: wtsapi32.dll, 207: wuapi.dll, 208: wuauclt.exe, 209: wuauclt1.exe, 210: wuaucpl.cpl, 211: wuaucpl.cpl.manifest, 212: wuaueng.dll, 213: wuaueng1.dll, 214: wuauserv.dll, 215: wucltui.dll, 216: wupdmgr.exe, 217: wups.dll, 218: wuweb.dll, 219: wzcdlg.dll, 220: wzcsapi.dll, 221: wzcsvc.dll, 222: xactsrv.dll, 223: xcopy.exe, 224: xenroll.dll, 225: xircom, 226: xjis.nls, 227: xmllite.dll, 228: xmlprov.dll, 229: xmlprovi.dll, 230: xolehlp.dll, 231: xpob2res.dll, 232: xpsp1res.dll, 233: xpsp2res.dll, 234: xpsp3res.dll, 235: zh-CHS, 236"
"21:50:34.8860949","Lab10-03.exe","1128","QueryDirectory","C:\WINDOWS\system32","NO MORE FILES",""
"21:50:34.8861970","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32","SUCCESS",""
"21:50:34.8863869","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\ntdll.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8865178","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\ntdll.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8865282","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\ntdll.dll","SUCCESS","AllocationSize: 589,824, EndOfFile: 589,312, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8865482","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\ntdll.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8867204","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\kernel32.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8868784","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\kernel32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8868885","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\kernel32.dll","SUCCESS","AllocationSize: 1,150,976, EndOfFile: 1,150,464, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8869126","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\kernel32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8870679","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\unicode.nls","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8871871","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\unicode.nls","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8871967","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\unicode.nls","SUCCESS","AllocationSize: 90,112, EndOfFile: 89,588, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8872160","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\unicode.nls","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8873665","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\locale.nls","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8875789","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\locale.nls","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8875973","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\locale.nls","SUCCESS","AllocationSize: 266,240, EndOfFile: 265,948, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8876181","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\locale.nls","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8879209","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\sorttbls.nls","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8882243","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\sorttbls.nls","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8882362","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\sorttbls.nls","SUCCESS","AllocationSize: 24,576, EndOfFile: 23,044, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8882572","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\sorttbls.nls","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8884197","Lab10-03.exe","1128","CreateFile","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8885386","Lab10-03.exe","1128","CreateFileMapping","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8885483","Lab10-03.exe","1128","QueryStandardInformationFile","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS","AllocationSize: 24,576, EndOfFile: 24,576, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8885679","Lab10-03.exe","1128","CreateFileMapping","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8894315","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\advapi32.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8895969","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\advapi32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8896106","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\advapi32.dll","SUCCESS","AllocationSize: 675,840, EndOfFile: 674,816, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8896346","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\advapi32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8898237","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\rpcrt4.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8899736","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\rpcrt4.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8899844","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\rpcrt4.dll","SUCCESS","AllocationSize: 585,728, EndOfFile: 584,704, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8900044","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\rpcrt4.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8901771","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\secur32.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8902977","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\secur32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8903076","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\secur32.dll","SUCCESS","AllocationSize: 57,344, EndOfFile: 56,320, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8903272","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\secur32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8904805","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\ole32.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8905988","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\ole32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8906084","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\ole32.dll","SUCCESS","AllocationSize: 1,290,240, EndOfFile: 1,287,168, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8906275","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\ole32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8907809","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\gdi32.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8908992","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\gdi32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8909087","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\gdi32.dll","SUCCESS","AllocationSize: 286,720, EndOfFile: 285,184, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8909290","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\gdi32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8910941","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\user32.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8912154","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\user32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8912253","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\user32.dll","SUCCESS","AllocationSize: 577,536, EndOfFile: 574,976, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8912446","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\user32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8914309","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\msvcrt.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8915507","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\msvcrt.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8915604","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\msvcrt.dll","SUCCESS","AllocationSize: 344,064, EndOfFile: 343,040, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8915797","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\msvcrt.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8917319","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\oleaut32.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8918711","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\oleaut32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8918811","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\oleaut32.dll","SUCCESS","AllocationSize: 552,960, EndOfFile: 551,936, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8919004","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\oleaut32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8920521","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8921704","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8921801","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","AllocationSize: 110,592, EndOfFile: 110,080, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8921993","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8923595","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\lpk.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8924792","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\lpk.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8924887","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\lpk.dll","SUCCESS","AllocationSize: 24,576, EndOfFile: 22,016, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8925080","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\lpk.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8926593","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\usp10.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8927780","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\usp10.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8927875","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\usp10.dll","SUCCESS","AllocationSize: 409,600, EndOfFile: 406,016, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8928071","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\usp10.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8929577","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\ctype.nls","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8930755","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\ctype.nls","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8930850","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\ctype.nls","SUCCESS","AllocationSize: 12,288, EndOfFile: 8,386, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8931040","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\ctype.nls","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8932541","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\sortkey.nls","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8933867","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\sortkey.nls","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8933970","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\sortkey.nls","SUCCESS","AllocationSize: 266,240, EndOfFile: 262,148, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8934163","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\sortkey.nls","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8935690","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\rpcss.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8936884","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\rpcss.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8936979","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\rpcss.dll","SUCCESS","AllocationSize: 401,408, EndOfFile: 399,360, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8937168","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\rpcss.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8938670","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8940224","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8940328","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","AllocationSize: 217,088, EndOfFile: 216,064, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8940520","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8942034","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8943289","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8943388","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","AllocationSize: 299,008, EndOfFile: 296,960, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8943583","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8945220","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8946490","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8946584","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","AllocationSize: 499,712, EndOfFile: 498,688, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8946776","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8948281","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\comres.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8949718","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\comres.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8949817","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\comres.dll","SUCCESS","AllocationSize: 618,496, EndOfFile: 615,936, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8950014","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\comres.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8951525","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\version.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8952703","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\version.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8952798","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\version.dll","SUCCESS","AllocationSize: 20,480, EndOfFile: 18,944, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8952993","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\version.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8953854","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\Registration\R000000000007.CLB","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8954386","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\Registration\R000000000007.clb","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8954485","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\Registration\R000000000007.clb","SUCCESS","AllocationSize: 24,576, EndOfFile: 22,264, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8954683","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\Registration\R000000000007.clb","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8956190","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\winlogon.exe","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8957529","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\winlogon.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8957630","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\winlogon.exe","SUCCESS","AllocationSize: 495,616, EndOfFile: 493,056, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8957826","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\winlogon.exe","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8959446","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","Desired Access: Read Data/List Directory, Read Attributes, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.8960629","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READWRITE"
"21:50:34.8960724","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","AllocationSize: 5,537,792, EndOfFile: 5,535,744, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.8960920","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.8962549","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\ntdll.dll","SUCCESS",""
"21:50:34.8963802","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\kernel32.dll","SUCCESS",""
"21:50:34.8965055","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\unicode.nls","SUCCESS",""
"21:50:34.8966298","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\locale.nls","SUCCESS",""
"21:50:34.8967533","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\sorttbls.nls","SUCCESS",""
"21:50:34.8968937","Lab10-03.exe","1128","CloseFile","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS",""
"21:50:34.8970198","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\advapi32.dll","SUCCESS",""
"21:50:34.8971598","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\rpcrt4.dll","SUCCESS",""
"21:50:34.8972842","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\secur32.dll","SUCCESS",""
"21:50:34.8974090","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\ole32.dll","SUCCESS",""
"21:50:34.8975321","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\gdi32.dll","SUCCESS",""
"21:50:34.8976549","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\user32.dll","SUCCESS",""
"21:50:34.8977776","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\msvcrt.dll","SUCCESS",""
"21:50:34.8979867","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\oleaut32.dll","SUCCESS",""
"21:50:34.8981348","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
"21:50:34.8982602","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\lpk.dll","SUCCESS",""
"21:50:34.8984103","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\usp10.dll","SUCCESS",""
"21:50:34.8985360","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\ctype.nls","SUCCESS",""
"21:50:34.8986593","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\sortkey.nls","SUCCESS",""
"21:50:34.8987819","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\rpcss.dll","SUCCESS",""
"21:50:34.8989054","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\uxtheme.dll","SUCCESS",""
"21:50:34.8990293","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\MSCTF.dll","SUCCESS",""
"21:50:34.8991533","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\clbcatq.dll","SUCCESS",""
"21:50:34.8992774","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\comres.dll","SUCCESS",""
"21:50:34.8994101","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\version.dll","SUCCESS",""
"21:50:34.8994858","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\Registration\R000000000007.clb","SUCCESS",""
"21:50:34.8996174","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\winlogon.exe","SUCCESS",""
"21:50:34.8997467","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS",""
"21:50:34.8999094","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\ntdll.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9000272","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\ntdll.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9000779","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\ntdll.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9002303","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\kernel32.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9003566","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\kernel32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9003990","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\kernel32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9005724","Lab10-03.exe","1128","CreateFile","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9006841","Lab10-03.exe","1128","CreateFileMapping","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9007213","Lab10-03.exe","1128","CreateFileMapping","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9008696","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\advapi32.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9009831","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\advapi32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9010205","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\advapi32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9011784","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\rpcrt4.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9012929","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\rpcrt4.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9013303","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\rpcrt4.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9015153","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\secur32.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9016303","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\secur32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9016669","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\secur32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9018150","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\ole32.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9019296","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\ole32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9019662","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\ole32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9021129","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\gdi32.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9022382","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\gdi32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9022753","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\gdi32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9024328","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\user32.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9025726","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\user32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9026096","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\user32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9027605","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\msvcrt.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9028740","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\msvcrt.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9029109","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\msvcrt.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9030573","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\oleaut32.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9031829","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\oleaut32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9032209","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\oleaut32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9033691","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9034835","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9035201","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9037098","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\lpk.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9038463","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\lpk.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9039002","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\lpk.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9040730","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\usp10.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9042028","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\usp10.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9042484","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\usp10.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9043958","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9045102","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9045575","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9047449","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9048607","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9048977","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9050457","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9051851","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9052223","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9053699","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\comres.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9054845","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\comres.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9055206","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\comres.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9056826","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\version.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9058034","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\version.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9058401","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\version.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9059870","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","Desired Access: Execute/Traverse, Disposition: Open, Options: Non-Directory File, Attributes: N, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9061015","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9061387","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9062841","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\ntdll.dll","SUCCESS",""
"21:50:34.9064053","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\kernel32.dll","SUCCESS",""
"21:50:34.9065253","Lab10-03.exe","1128","CloseFile","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS",""
"21:50:34.9066674","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\advapi32.dll","SUCCESS",""
"21:50:34.9067976","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\rpcrt4.dll","SUCCESS",""
"21:50:34.9069183","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\secur32.dll","SUCCESS",""
"21:50:34.9070382","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\ole32.dll","SUCCESS",""
"21:50:34.9071585","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\gdi32.dll","SUCCESS",""
"21:50:34.9073099","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\user32.dll","SUCCESS",""
"21:50:34.9074294","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\msvcrt.dll","SUCCESS",""
"21:50:34.9075491","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\oleaut32.dll","SUCCESS",""
"21:50:34.9076873","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
"21:50:34.9078333","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\lpk.dll","SUCCESS",""
"21:50:34.9079734","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\usp10.dll","SUCCESS",""
"21:50:34.9080992","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\uxtheme.dll","SUCCESS",""
"21:50:34.9082246","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\MSCTF.dll","SUCCESS",""
"21:50:34.9083647","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\clbcatq.dll","SUCCESS",""
"21:50:34.9085074","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\comres.dll","SUCCESS",""
"21:50:34.9086270","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\version.dll","SUCCESS",""
"21:50:34.9087475","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS",""
"21:50:34.9087824","Lab10-03.exe","1128","CloseFile","C:","SUCCESS",""
"21:50:34.9089471","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Lab10-03.exe","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9091576","Lab10-03.exe","1128","CreateFile","C:\Documents and Settings\Administrator\桌面\lab","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Attributes: n/a, ShareMode: Read, Write, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9092479","Lab10-03.exe","1128","FileSystemControl","C:\Documents and Settings\Administrator\桌面\lab","SUCCESS","Control: FSCTL_IS_VOLUME_MOUNTED"
"21:50:34.9094323","Lab10-03.exe","1128","QueryOpen","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe.Local","NAME NOT FOUND",""
"21:50:34.9099529","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\kernel32.dll","SUCCESS","Image Base: 0x7c800000, Image Size: 0x11e000"
"21:50:34.9102127","Lab10-03.exe","1128","RegOpenKey","HKLM\System\CurrentControlSet\Control\Terminal Server","SUCCESS","Desired Access: Read"
"21:50:34.9102436","Lab10-03.exe","1128","RegQueryValue","HKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0"
"21:50:34.9102609","Lab10-03.exe","1128","RegCloseKey","HKLM\System\CurrentControlSet\Control\Terminal Server","SUCCESS",""
"21:50:34.9107266","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\advapi32.dll","SUCCESS","Image Base: 0x77da0000, Image Size: 0xa9000"
"21:50:34.9109168","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\rpcrt4.dll","SUCCESS","Image Base: 0x77e50000, Image Size: 0x92000"
"21:50:34.9113328","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\secur32.dll","SUCCESS","Image Base: 0x77fc0000, Image Size: 0x11000"
"21:50:34.9119403","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\ole32.dll","SUCCESS","Image Base: 0x76990000, Image Size: 0x13d000"
"21:50:34.9121690","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\gdi32.dll","SUCCESS","Image Base: 0x77ef0000, Image Size: 0x49000"
"21:50:34.9123959","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\user32.dll","SUCCESS","Image Base: 0x77d10000, Image Size: 0x90000"
"21:50:34.9126541","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\msvcrt.dll","SUCCESS","Image Base: 0x77be0000, Image Size: 0x58000"
"21:50:34.9129319","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\oleaut32.dll","SUCCESS","Image Base: 0x770f0000, Image Size: 0x8b000"
"21:50:34.9130278","Lab10-03.exe","1128","RegOpenKey","HKLM\System\CurrentControlSet\Control\Terminal Server","SUCCESS","Desired Access: Read"
"21:50:34.9130557","Lab10-03.exe","1128","RegQueryValue","HKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0"
"21:50:34.9130709","Lab10-03.exe","1128","RegCloseKey","HKLM\System\CurrentControlSet\Control\Terminal Server","SUCCESS",""
"21:50:34.9131330","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secur32.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9131595","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RPCRT4.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9131714","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ADVAPI32.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9131929","Lab10-03.exe","1128","RegOpenKey","HKLM\System\CurrentControlSet\Control\Terminal Server","SUCCESS","Desired Access: Read"
"21:50:34.9132128","Lab10-03.exe","1128","RegQueryValue","HKLM\System\CurrentControlSet\Control\Terminal Server\TSAppCompat","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0"
"21:50:34.9132200","Lab10-03.exe","1128","RegQueryValue","HKLM\System\CurrentControlSet\Control\Terminal Server\TSUserEnabled","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0"
"21:50:34.9132312","Lab10-03.exe","1128","RegCloseKey","HKLM\System\CurrentControlSet\Control\Terminal Server","SUCCESS",""
"21:50:34.9132463","Lab10-03.exe","1128","RegOpenKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon","SUCCESS","Desired Access: Read"
"21:50:34.9132629","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\LeakTrack","NAME NOT FOUND","Length: 144"
"21:50:34.9133204","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon","SUCCESS",""
"21:50:34.9133316","Lab10-03.exe","1128","RegOpenKey","HKLM","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9135095","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Diagnostics","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9135340","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USER32.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9136338","Lab10-03.exe","1128","RegOpenKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Query Value"
"21:50:34.9136566","Lab10-03.exe","1128","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\SafeDllSearchMode","NAME NOT FOUND","Length: 16"
"21:50:34.9136688","Lab10-03.exe","1128","RegCloseKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS",""
"21:50:34.9139984","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\imm32.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 110,592, EndOfFile: 110,080, FileAttributes: A"
"21:50:34.9141829","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9143145","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9143257","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","AllocationSize: 110,592, EndOfFile: 110,080, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.9143547","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9145588","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
"21:50:34.9150632","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\imm32.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 110,592, EndOfFile: 110,080, FileAttributes: A"
"21:50:34.9152640","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9153849","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9153950","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","AllocationSize: 110,592, EndOfFile: 110,080, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.9154141","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9155483","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
"21:50:34.9157699","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\imm32.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 110,592, EndOfFile: 110,080, FileAttributes: A"
"21:50:34.9162549","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\imm32.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9163909","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9164288","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\imm32.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9164471","Lab10-03.exe","1128","RegOpenKey","HKLM\System\CurrentControlSet\Control\SafeBoot\Option","NAME NOT FOUND","Desired Access: Query Value, Set Value"
"21:50:34.9164623","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers","SUCCESS","Desired Access: Query Value"
"21:50:34.9164799","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers\TransparentEnabled","SUCCESS","Type: REG_DWORD, Length: 4, Data: 1"
"21:50:34.9164928","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers","SUCCESS",""
"21:50:34.9165056","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers","NAME NOT FOUND","Desired Access: Query Value"
"21:50:34.9166557","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\imm32.dll","SUCCESS",""
"21:50:34.9168750","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\imm32.dll","SUCCESS","Image Base: 0x76300000, Image Size: 0x1d000"
"21:50:34.9169301","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IMM32.DLL","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9171417","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\imm32.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 110,592, EndOfFile: 110,080, FileAttributes: A"
"21:50:34.9171678","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ntdll.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9171765","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kernel32.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9171892","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\GDI32.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9171968","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msvcrt.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9172156","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ole32.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9172345","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\OLEAUT32.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9174021","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\imm32.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 110,592, EndOfFile: 110,080, FileAttributes: A"
"21:50:34.9174187","Lab10-03.exe","1128","RegOpenKey","HKLM\System\CurrentControlSet\Control\Error Message Instrument\","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9174673","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\GRE_Initialize","SUCCESS","Desired Access: Read"
"21:50:34.9174858","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\DisableMetaFiles","NAME NOT FOUND","Length: 20"
"21:50:34.9175113","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\GRE_Initialize","SUCCESS",""
"21:50:34.9176261","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Compatibility32","SUCCESS","Desired Access: Read"
"21:50:34.9176444","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32\Lab10-03","NAME NOT FOUND","Length: 172"
"21:50:34.9176546","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Compatibility32","SUCCESS",""
"21:50:34.9176628","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\IME Compatibility","SUCCESS","Desired Access: Read"
"21:50:34.9176790","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IME Compatibility\Lab10-03","NAME NOT FOUND","Length: 172"
"21:50:34.9176882","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IME Compatibility","SUCCESS",""
"21:50:34.9178803","Lab10-03.exe","1128","QueryOpen","C:\Documents and Settings\Administrator\桌面\lab\LPK.DLL","NAME NOT FOUND",""
"21:50:34.9181214","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\lpk.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 24,576, EndOfFile: 22,016, FileAttributes: A"
"21:50:34.9184562","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\lpk.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9186767","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\lpk.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9187360","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\lpk.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9188706","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\lpk.dll","SUCCESS",""
"21:50:34.9191897","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\lpk.dll","SUCCESS","Image Base: 0x62c20000, Image Size: 0x9000"
"21:50:34.9194743","Lab10-03.exe","1128","QueryOpen","C:\Documents and Settings\Administrator\桌面\lab\USP10.dll","NAME NOT FOUND",""
"21:50:34.9204780","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\usp10.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 409,600, EndOfFile: 406,016, FileAttributes: A"
"21:50:34.9214727","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\usp10.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9216618","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\usp10.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9217217","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\usp10.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9218531","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\usp10.dll","SUCCESS",""
"21:50:34.9223608","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\usp10.dll","SUCCESS","Image Base: 0x73fa0000, Image Size: 0x6b000"
"21:50:34.9224079","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\USP10.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9224755","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LPK.DLL","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9227678","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows","SUCCESS","Desired Access: Read"
"21:50:34.9227895","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs","SUCCESS","Type: REG_SZ, Length: 2, Data: "
"21:50:34.9228477","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows","SUCCESS",""
"21:50:34.9240313","Lab10-03.exe","1128","QueryNameInformationFile","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","BUFFER OVERFLOW","Name: \D"
"21:50:34.9240482","Lab10-03.exe","1128","QueryNameInformationFile","C:\Documents and Settings\Administrator\桌面\lab\Lab10-03.exe","SUCCESS","Name: \Documents and Settings\Administrator\桌面\lab\Lab10-03.exe"
"21:50:34.9240796","Lab10-03.exe","1128","RegSetValue","HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed","SUCCESS","Type: REG_BINARY, Length: 80, Data: BE 39 53 A4 C6 2A 7B 3A 0B 7A 36 6B 55 04 FB F2"
"21:50:34.9242355","Lab10-03.exe","1128","SetEndOfFileInformationFile","C:\WINDOWS\system32\config\software.LOG","SUCCESS","EndOfFile: 8,192"
"21:50:34.9244509","Lab10-03.exe","1128","SetEndOfFileInformationFile","C:\WINDOWS\system32\config\software.LOG","SUCCESS","EndOfFile: 8,192"
"21:50:34.9246463","Lab10-03.exe","1128","SetEndOfFileInformationFile","C:\WINDOWS\system32\config\software.LOG","SUCCESS","EndOfFile: 16,384"
"21:50:34.9249151","Lab10-03.exe","1128","RegOpenKey","HKLM\SYSTEM\CurrentControlSet\Control\Session Manager","SUCCESS","Desired Access: Read"
"21:50:34.9249391","Lab10-03.exe","1128","RegQueryValue","HKLM\System\CurrentControlSet\Control\Session Manager\CriticalSectionTimeout","SUCCESS","Type: REG_DWORD, Length: 4, Data: 2592000"
"21:50:34.9249515","Lab10-03.exe","1128","RegCloseKey","HKLM\System\CurrentControlSet\Control\Session Manager","SUCCESS",""
"21:50:34.9249605","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Ole","SUCCESS","Desired Access: Read"
"21:50:34.9249758","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\Ole\RWLockResourceTimeOut","NAME NOT FOUND","Length: 144"
"21:50:34.9249867","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\Ole","SUCCESS",""
"21:50:34.9249957","Lab10-03.exe","1128","RegOpenKey","HKCR\Interface","SUCCESS","Desired Access: Read"
"21:50:34.9252792","Lab10-03.exe","1128","RegCloseKey","HKCR\Interface","SUCCESS",""
"21:50:34.9252858","Lab10-03.exe","1128","RegOpenKey","HKCR\Interface\{00020400-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:34.9253097","Lab10-03.exe","1128","RegCloseKey","HKCR\Interface\{00020400-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:34.9253358","Lab10-03.exe","1128","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLEAUT","NAME NOT FOUND","Desired Access: Query Value"
"21:50:34.9253543","Lab10-03.exe","1128","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLEAUT\UserEra","NAME NOT FOUND","Desired Access: Query Value, Enumerate Sub Keys"
"21:50:34.9253629","Lab10-03.exe","1128","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLEAUT","NAME NOT FOUND","Desired Access: Query Value"
"21:50:34.9255015","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Rpc\PagedBuffers","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9255111","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Rpc","SUCCESS","Desired Access: Read"
"21:50:34.9255258","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\Rpc\MaxRpcSize","NAME NOT FOUND","Length: 144"
"21:50:34.9255371","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\Rpc","SUCCESS",""
"21:50:34.9255463","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Lab10-03.exe\RpcThreadPoolThrottle","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9255738","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Policies\Microsoft\Windows NT\Rpc","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9256750","Lab10-03.exe","1128","RegSetValue","HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed","SUCCESS","Type: REG_BINARY, Length: 80, Data: E4 E7 AE 5F B2 34 C5 61 A0 7F 02 96 2F BC 63 1C"
"21:50:34.9257627","Lab10-03.exe","1128","RegSetValue","HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed","SUCCESS","Type: REG_BINARY, Length: 80, Data: 60 FF 2C 66 45 BE 3C 35 94 B9 8B 03 97 AE 64 48"
"21:50:34.9258245","Lab10-03.exe","1128","RegSetValue","HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed","SUCCESS","Type: REG_BINARY, Length: 80, Data: ED A3 BA F9 8B A1 F0 94 5F AC 49 4D 7B 98 8C 6B"
"21:50:34.9258855","Lab10-03.exe","1128","RegSetValue","HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed","SUCCESS","Type: REG_BINARY, Length: 80, Data: 3B D4 40 A7 90 75 6F E3 43 7B D0 F2 0B 1B 60 6F"
"21:50:34.9259463","Lab10-03.exe","1128","RegSetValue","HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed","SUCCESS","Type: REG_BINARY, Length: 80, Data: A0 76 2E 4F AC 5C 17 6D 87 FD 24 E2 A3 90 08 31"
"21:50:34.9260068","Lab10-03.exe","1128","RegSetValue","HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed","SUCCESS","Type: REG_BINARY, Length: 80, Data: 39 F3 22 DD 53 06 E9 C8 3A 27 37 25 8E 1D 9F 87"
"21:50:34.9260673","Lab10-03.exe","1128","RegSetValue","HKLM\SOFTWARE\Microsoft\Cryptography\RNG\Seed","SUCCESS","Type: REG_BINARY, Length: 80, Data: D1 10 56 48 FC 1E 8C AD D3 E4 70 DE EB 1D 35 C5"
"21:50:34.9268572","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\rpcss.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:31, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 401,408, EndOfFile: 399,360, FileAttributes: A"
"21:50:34.9270011","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\rpcss.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9271203","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\rpcss.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9271322","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\rpcss.dll","SUCCESS","AllocationSize: 401,408, EndOfFile: 399,360, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.9271518","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\rpcss.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9272874","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\rpcss.dll","SUCCESS",""
"21:50:34.9276087","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 217,088, EndOfFile: 216,064, FileAttributes: A"
"21:50:34.9277500","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9278636","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9278732","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","AllocationSize: 217,088, EndOfFile: 216,064, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.9278922","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9280074","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\uxtheme.dll","SUCCESS",""
"21:50:34.9281890","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 217,088, EndOfFile: 216,064, FileAttributes: A"
"21:50:34.9283436","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9284595","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9285039","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9286310","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\uxtheme.dll","SUCCESS",""
"21:50:34.9288761","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","Image Base: 0x5adc0000, Image Size: 0x37000"
"21:50:34.9289350","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uxtheme.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9291336","Lab10-03.exe","1128","RegOpenKey","HKCU","SUCCESS","Desired Access: Read/Write"
"21:50:34.9291503","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Microsoft\Windows\CurrentVersion\ThemeManager","SUCCESS","Desired Access: Query Value"
"21:50:34.9291672","Lab10-03.exe","1128","RegQueryValue","HKCU\Software\Microsoft\Windows\CurrentVersion\ThemeManager\Compositing","NAME NOT FOUND","Length: 144"
"21:50:34.9291803","Lab10-03.exe","1128","RegCloseKey","HKCU\Software\Microsoft\Windows\CurrentVersion\ThemeManager","SUCCESS",""
"21:50:34.9291934","Lab10-03.exe","1128","RegCloseKey","HKCU","SUCCESS",""
"21:50:34.9292106","Lab10-03.exe","1128","RegOpenKey","HKCU","SUCCESS","Desired Access: Read"
"21:50:34.9292243","Lab10-03.exe","1128","RegOpenKey","HKCU\Control Panel\Desktop","SUCCESS","Desired Access: Query Value"
"21:50:34.9292387","Lab10-03.exe","1128","RegQueryValue","HKCU\Control Panel\Desktop\LameButtonText","NAME NOT FOUND","Length: 144"
"21:50:34.9292515","Lab10-03.exe","1128","RegCloseKey","HKCU\Control Panel\Desktop","SUCCESS",""
"21:50:34.9292641","Lab10-03.exe","1128","RegCloseKey","HKCU","SUCCESS",""
"21:50:34.9296792","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 217,088, EndOfFile: 216,064, FileAttributes: A"
"21:50:34.9302213","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 217,088, EndOfFile: 216,064, FileAttributes: A"
"21:50:34.9304010","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\uxtheme.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 217,088, EndOfFile: 216,064, FileAttributes: A"
"21:50:34.9305736","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 299,008, EndOfFile: 296,960, FileAttributes: A"
"21:50:34.9307158","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9308340","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9308451","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","AllocationSize: 299,008, EndOfFile: 296,960, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.9308865","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9310414","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\MSCTF.dll","SUCCESS",""
"21:50:34.9313639","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 299,008, EndOfFile: 296,960, FileAttributes: A"
"21:50:34.9315494","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9316800","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9317725","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9319409","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\MSCTF.dll","SUCCESS",""
"21:50:34.9323845","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\MSCTF.dll","SUCCESS","Image Base: 0x74680000, Image Size: 0x4c000"
"21:50:34.9325314","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSCTF.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9327710","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\ntdll.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 589,824, EndOfFile: 589,312, FileAttributes: A"
"21:50:34.9329897","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\imm32.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 110,592, EndOfFile: 110,080, FileAttributes: A"
"21:50:34.9331099","Lab10-03.exe","1128","RegOpenKey","HKLM\SOFTWARE\Microsoft\CTF\Compatibility\Lab10-03.exe","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9331210","Lab10-03.exe","1128","RegOpenKey","HKLM\SOFTWARE\Microsoft\CTF\SystemShared\","SUCCESS","Desired Access: Read"
"21:50:34.9331387","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\CTF\SystemShared\CUAS","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0"
"21:50:34.9331636","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\CTF\SystemShared","SUCCESS",""
"21:50:34.9332130","Lab10-03.exe","1128","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9332299","Lab10-03.exe","1128","RegOpenKey","HKCU\Keyboard Layout\Toggle","SUCCESS","Desired Access: Read"
"21:50:34.9332483","Lab10-03.exe","1128","RegQueryValue","HKCU\Keyboard Layout\Toggle\Language Hotkey","SUCCESS","Type: REG_SZ, Length: 4, Data: 1"
"21:50:34.9332579","Lab10-03.exe","1128","RegQueryValue","HKCU\Keyboard Layout\Toggle\Language Hotkey","SUCCESS","Type: REG_SZ, Length: 4, Data: 1"
"21:50:34.9332645","Lab10-03.exe","1128","RegQueryValue","HKCU\Keyboard Layout\Toggle\Layout Hotkey","SUCCESS","Type: REG_SZ, Length: 4, Data: 2"
"21:50:34.9332705","Lab10-03.exe","1128","RegQueryValue","HKCU\Keyboard Layout\Toggle\Layout Hotkey","SUCCESS","Type: REG_SZ, Length: 4, Data: 2"
"21:50:34.9332821","Lab10-03.exe","1128","RegCloseKey","HKCU\Keyboard Layout\Toggle","SUCCESS",""
"21:50:34.9334500","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\kernel32.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 1,150,976, EndOfFile: 1,150,464, FileAttributes: A"
"21:50:34.9334716","Lab10-03.exe","1128","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9334881","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9334984","Lab10-03.exe","1128","RegOpenKey","HKCU\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"21:50:34.9335142","Lab10-03.exe","1128","RegQueryValue","HKCU\Control Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"21:50:34.9335253","Lab10-03.exe","1128","RegCloseKey","HKCU\Control Panel\Desktop","SUCCESS",""
"21:50:34.9335369","Lab10-03.exe","1128","RegCloseKey","HKCU","SUCCESS",""
"21:50:34.9335518","Lab10-03.exe","1128","RegOpenKey","HKLM\SOFTWARE\Microsoft\CTF\","SUCCESS","Desired Access: Read"
"21:50:34.9335780","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\CTF\EnableAnchorContext","NAME NOT FOUND","Length: 144"
"21:50:34.9335884","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\CTF","SUCCESS",""
"21:50:34.9342371","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Read"
"21:50:34.9342539","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\COM3\Com+Enabled","SUCCESS","Type: REG_DWORD, Length: 4, Data: 1"
"21:50:34.9342659","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\COM3","SUCCESS",""
"21:50:34.9344242","Lab10-03.exe","1128","QueryOpen","C:\Documents and Settings\Administrator\桌面\lab\CLBCATQ.DLL","NAME NOT FOUND",""
"21:50:34.9345729","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","CreationTime: 2022-10-1 19:34:39, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:34:39, AllocationSize: 499,712, EndOfFile: 498,688, FileAttributes: A"
"21:50:34.9347156","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9348299","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9348683","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9349975","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\clbcatq.dll","SUCCESS",""
"21:50:34.9352106","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\clbcatq.dll","SUCCESS","Image Base: 0x76fa0000, Image Size: 0x7f000"
"21:50:34.9354453","Lab10-03.exe","1128","QueryOpen","C:\Documents and Settings\Administrator\桌面\lab\COMRes.dll","NAME NOT FOUND",""
"21:50:34.9362367","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\comres.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:39:59, AllocationSize: 618,496, EndOfFile: 615,936, FileAttributes: A"
"21:50:34.9364438","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\comres.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9365811","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\comres.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9366212","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\comres.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9367464","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\comres.dll","SUCCESS",""
"21:50:34.9369971","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\comres.dll","SUCCESS","Image Base: 0x77020000, Image Size: 0x9a000"
"21:50:34.9372269","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\version.dll","SUCCESS","Image Base: 0x77bd0000, Image Size: 0x8000"
"21:50:34.9372873","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\COMRes.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9373044","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VERSION.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9373153","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CLBCATQ.DLL","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9373673","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3\Debug","NAME NOT FOUND","Desired Access: All Access"
"21:50:34.9373772","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3\Debug","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9373887","Lab10-03.exe","1128","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS","Desired Access: Read"
"21:50:34.9374086","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\Ole\MinimumFreeMemPercentageToCreateProcess","NAME NOT FOUND","Length: 144"
"21:50:34.9374158","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\Ole\MinimumFreeMemPercentageToCreateObject","NAME NOT FOUND","Length: 144"
"21:50:34.9374386","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\Ole","SUCCESS",""
"21:50:34.9375306","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\Registration","SUCCESS","CreationTime: 2022-10-1 19:34:47, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2022-10-1 19:35:35, ChangeTime: 2022-10-1 19:35:35, AllocationSize: 0, EndOfFile: 0, FileAttributes: D"
"21:50:34.9375506","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Read"
"21:50:34.9375657","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\COM3\Com+Enabled","SUCCESS","Type: REG_DWORD, Length: 4, Data: 1"
"21:50:34.9375779","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\COM3","SUCCESS",""
"21:50:34.9376141","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9376327","Lab10-03.exe","1128","RegOpenKey","HKCR","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9376578","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9376872","Lab10-03.exe","1128","RegOpenKey","HKU","SUCCESS","Desired Access: Notify"
"21:50:34.9377095","Lab10-03.exe","1128","RegOpenKey","HKCR","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9377247","Lab10-03.exe","1128","RegOpenKey","HKU","SUCCESS","Desired Access: Notify"
"21:50:34.9377424","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9377605","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9377788","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9377976","Lab10-03.exe","1128","RegOpenKey","HKCR","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9378147","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9378313","Lab10-03.exe","1128","RegOpenKey","HKU","SUCCESS","Desired Access: Notify"
"21:50:34.9378488","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9378670","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9378853","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9379118","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Read"
"21:50:34.9379258","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion","SUCCESS","Type: REG_BINARY, Length: 8, Data: 07 00 00 00 00 00 00 00"
"21:50:34.9379371","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\COM3","SUCCESS",""
"21:50:34.9380646","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\Registration\R000000000007.clb","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9381205","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\Registration\R000000000007.clb","SUCCESS","AllocationSize: 24,576, EndOfFile: 22,264, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.9382350","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\Registration\R000000000007.clb","SUCCESS","Offset: 0, Length: 22,264"
"21:50:34.9383666","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\Registration\R000000000007.clb","SUCCESS",""
"21:50:34.9384197","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Read"
"21:50:34.9384361","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion","SUCCESS","Type: REG_BINARY, Length: 8, Data: 07 00 00 00 00 00 00 00"
"21:50:34.9384485","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\COM3","SUCCESS",""
"21:50:34.9384690","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:34.9384755","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:34.9384917","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:34.9384986","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAs","NAME NOT FOUND","Desired Access: Query Value"
"21:50:34.9385057","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\TreatAs","NAME NOT FOUND","Desired Access: Query Value"
"21:50:34.9385170","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:34.9385226","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Read"
"21:50:34.9385399","Lab10-03.exe","1128","RegCloseKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:34.9385489","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:34.9385546","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:34.9385686","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:34.9385751","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:34.9385916","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:34.9386017","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:34.9386084","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:34.9386145","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:34.9386234","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:34.9386415","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9386589","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32","SUCCESS","Query: Name"
"21:50:34.9386670","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9386865","Lab10-03.exe","1128","RegQueryValue","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32\LocalServer32","NAME NOT FOUND","Length: 144"
"21:50:34.9386971","Lab10-03.exe","1128","RegQueryValue","HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32\LocalServer32","NAME NOT FOUND","Length: 144"
"21:50:34.9387081","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32","SUCCESS",""
"21:50:34.9387237","Lab10-03.exe","1128","RegCloseKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32","SUCCESS",""
"21:50:34.9387352","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:34.9387416","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:34.9387474","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:34.9387563","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:34.9387627","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:34.9387686","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocServerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:34.9387774","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:34.9387836","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:34.9387899","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandler32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:34.9387987","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:34.9388053","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandlerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:34.9388115","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\InprocHandlerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:34.9388210","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:34.9388273","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9388428","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32","SUCCESS","Query: Name"
"21:50:34.9388476","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9388640","Lab10-03.exe","1128","RegQueryValue","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32\(Default)","SUCCESS","Type: REG_SZ, Length: 74, Data: ""C:\Program Files\liebao\liebao.exe"""
"21:50:34.9388748","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32","SUCCESS",""
"21:50:34.9388895","Lab10-03.exe","1128","RegCloseKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32","SUCCESS",""
"21:50:34.9389054","Lab10-03.exe","1128","RegCloseKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:34.9389299","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:34.9389355","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:34.9389542","Lab10-03.exe","1128","RegCloseKey","HKCU\Software\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:34.9393459","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\winlogon.exe","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:31, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-4 18:47:25, AllocationSize: 495,616, EndOfFile: 493,056, FileAttributes: A"
"21:50:34.9394898","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\winlogon.exe","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9396031","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\winlogon.exe","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9396130","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\winlogon.exe","SUCCESS","AllocationSize: 495,616, EndOfFile: 493,056, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:34.9396321","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\winlogon.exe","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9397745","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\winlogon.exe","SUCCESS",""
"21:50:34.9401138","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Ole","SUCCESS","Desired Access: Read"
"21:50:34.9401297","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\Ole\MaximumAllowedAllocationSize","NAME NOT FOUND","Length: 144"
"21:50:34.9401410","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\Ole","SUCCESS",""
"21:50:34.9402935","Lab10-03.exe","1128","QueryOpen","C:\Documents and Settings\Administrator\桌面\lab\xpsp2res.dll","NAME NOT FOUND",""
"21:50:34.9404396","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:34, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:40:01, AllocationSize: 5,537,792, EndOfFile: 5,535,744, FileAttributes: A"
"21:50:34.9405798","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:34.9406974","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:34.9407502","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:34.9408717","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS",""
"21:50:34.9416727","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\xpsp2res.dll","SUCCESS","Image Base: 0xa80000, Image Size: 0x549000"
"21:50:34.9417673","Lab10-03.exe","1128","RegOpenKey","HKCU","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9417960","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Policies\Microsoft\Control Panel\Desktop","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9418133","Lab10-03.exe","1128","RegOpenKey","HKCU\Control Panel\Desktop","SUCCESS","Desired Access: Read"
"21:50:34.9418331","Lab10-03.exe","1128","RegQueryValue","HKCU\Control Panel\Desktop\MultiUILanguageId","NAME NOT FOUND","Length: 256"
"21:50:34.9418449","Lab10-03.exe","1128","RegCloseKey","HKCU\Control Panel\Desktop","SUCCESS",""
"21:50:34.9418575","Lab10-03.exe","1128","RegCloseKey","HKCU","SUCCESS",""
"21:50:34.9418934","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Maximum Allowed"
"21:50:34.9419096","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:34.9419159","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\AppID\Lab10-03.exe","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9419225","Lab10-03.exe","1128","RegOpenKey","HKCR\AppID\Lab10-03.exe","NAME NOT FOUND","Desired Access: Read"
"21:50:34.9419320","Lab10-03.exe","1128","RegOpenKey","HKLM\SOFTWARE\Microsoft\OLE","SUCCESS","Desired Access: Read"
"21:50:34.9419470","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\Ole\DefaultAccessPermission","NAME NOT FOUND","Length: 144"
"21:50:34.9419613","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\Ole","SUCCESS",""
"21:50:34.9419797","Lab10-03.exe","1128","RegOpenKey","HKLM\System\CurrentControlSet\Control\ComputerName","SUCCESS","Desired Access: Read"
"21:50:34.9420013","Lab10-03.exe","1128","RegOpenKey","HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName","SUCCESS","Desired Access: Read"
"21:50:34.9420169","Lab10-03.exe","1128","RegQueryValue","HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName\ComputerName","SUCCESS","Type: REG_SZ, Length: 32, Data: BONELEE-B1632A4"
"21:50:34.9420282","Lab10-03.exe","1128","RegCloseKey","HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName","SUCCESS",""
"21:50:34.9420411","Lab10-03.exe","1128","RegCloseKey","HKLM\System\CurrentControlSet\Control\ComputerName","SUCCESS",""
"21:50:34.9425749","Lab10-03.exe","1128","RegOpenKey","HKLM\System\CurrentControlSet\Control\Lsa","SUCCESS","Desired Access: Query Value"
"21:50:34.9425983","Lab10-03.exe","1128","RegQueryValue","HKLM\System\CurrentControlSet\Control\Lsa\EveryoneIncludesAnonymous","SUCCESS","Type: REG_DWORD, Length: 4, Data: 0"
"21:50:34.9426077","Lab10-03.exe","1128","RegCloseKey","HKLM\System\CurrentControlSet\Control\Lsa","SUCCESS",""
"21:50:34.9426516","Lab10-03.exe","1128","RegOpenKey","HKLM\System\CurrentControlSet\Control\ComputerName","SUCCESS","Desired Access: Read"
"21:50:34.9426706","Lab10-03.exe","1128","RegOpenKey","HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName","SUCCESS","Desired Access: Read"
"21:50:34.9426852","Lab10-03.exe","1128","RegQueryValue","HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName\ComputerName","SUCCESS","Type: REG_SZ, Length: 32, Data: BONELEE-B1632A4"
"21:50:34.9427203","Lab10-03.exe","1128","RegCloseKey","HKLM\System\CurrentControlSet\Control\ComputerName\ActiveComputerName","SUCCESS",""
"21:50:34.9427364","Lab10-03.exe","1128","RegCloseKey","HKLM\System\CurrentControlSet\Control\ComputerName","SUCCESS",""
"21:50:34.9427737","Lab10-03.exe","1128","Thread Create","","SUCCESS","Thread ID: 884"
"21:50:34.9430728","Lab10-03.exe","1128","Thread Create","","SUCCESS","Thread ID: 608"
"21:50:35.6218507","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6219670","spoolsv.exe","1556","CreateFile","C:\WINDOWS","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6221262","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6223263","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32\spool","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6227067","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32\spool\drivers","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6230035","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32\spool\drivers\w32x86","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6233280","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6235213","spoolsv.exe","1556","CreateFile","C:\WINDOWS","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6237298","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6238869","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32\spool","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6240762","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32\spool\drivers","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6243330","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32\spool\drivers\w32x86","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6246283","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6247130","spoolsv.exe","1556","CreateFile","C:\WINDOWS","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6248795","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6250335","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32\spool","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6252299","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32\spool\drivers","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6254955","spoolsv.exe","1556","CreateFile","C:\WINDOWS\system32\spool\drivers\w32x86","NAME COLLISION","Desired Access: Read Data/List Directory, Synchronize, Disposition: Create, Options: Directory, Synchronous IO Non-Alert, Attributes: N, ShareMode: Read, Write, AllocationSize: 0"
"21:50:35.6822706","Lab10-03.exe","1128","Thread Create","","SUCCESS","Thread ID: 1740"
"21:50:35.6824601","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6824673","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.6824753","Lab10-03.exe","1128","RegOpenKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}","SUCCESS","Desired Access: Read"
"21:50:35.6824932","Lab10-03.exe","1128","RegQueryKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}","SUCCESS","Query: Name"
"21:50:35.6825038","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32","NAME NOT FOUND","Desired Access: Read"
"21:50:35.6825139","Lab10-03.exe","1128","RegOpenKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32","SUCCESS","Desired Access: Read"
"21:50:35.6825285","Lab10-03.exe","1128","RegQueryKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32","SUCCESS","Query: Name"
"21:50:35.6825377","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6825492","Lab10-03.exe","1128","RegQueryValue","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32\(Default)","SUCCESS","Type: REG_SZ, Length: 78, Data: {00020424-0000-0000-C000-000000000046}"
"21:50:35.6825618","Lab10-03.exe","1128","RegCloseKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32","SUCCESS",""
"21:50:35.6825777","Lab10-03.exe","1128","RegCloseKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}","SUCCESS",""
"21:50:35.6825919","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Read"
"21:50:35.6826071","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion","SUCCESS","Type: REG_BINARY, Length: 8, Data: 07 00 00 00 00 00 00 00"
"21:50:35.6826187","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\COM3","SUCCESS",""
"21:50:35.6826356","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Read"
"21:50:35.6826495","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion","SUCCESS","Type: REG_BINARY, Length: 8, Data: 07 00 00 00 00 00 00 00"
"21:50:35.6826602","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\COM3","SUCCESS",""
"21:50:35.6826718","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6826780","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.6826848","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.6826996","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6827084","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\TreatAs","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.6827178","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\TreatAs","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.6827493","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6827566","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Read"
"21:50:35.6827771","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.6827868","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6827932","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.6828003","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.6828152","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6828255","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6828360","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6828512","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Query: Name"
"21:50:35.6828606","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6828710","Lab10-03.exe","1128","RegQueryValue","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\InprocServer32","NAME NOT FOUND","Length: 144"
"21:50:35.6828946","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS",""
"21:50:35.6829042","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6829146","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6829343","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6829524","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6829636","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6829740","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6829831","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6830021","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6830124","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6830273","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Query: Name"
"21:50:35.6830369","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6830473","Lab10-03.exe","1128","RegQueryValue","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\(Default)","SUCCESS","Type: REG_SZ, Length: 26, Data: oleaut32.dll"
"21:50:35.6830586","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS",""
"21:50:35.6830687","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6830783","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandler32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6830884","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandler32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6830971","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6831064","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandlerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6831165","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandlerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6831252","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6831346","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6831446","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6831530","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6831624","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6831721","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6831813","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6831870","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.6831933","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.6832081","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6832169","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6832262","Lab10-03.exe","1128","RegQueryValue","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\AppID","NAME NOT FOUND","Length: 144"
"21:50:35.6832373","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.6832506","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.6833243","Lab10-03.exe","1128","RegCloseKey","HKCU\Software\Classes","SUCCESS",""
"21:50:35.6833356","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Read"
"21:50:35.6833526","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion","SUCCESS","Type: REG_BINARY, Length: 8, Data: 07 00 00 00 00 00 00 00"
"21:50:35.6833645","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\COM3","SUCCESS",""
"21:50:35.6833778","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Read"
"21:50:35.6834117","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion","SUCCESS","Type: REG_BINARY, Length: 8, Data: 07 00 00 00 00 00 00 00"
"21:50:35.6834243","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\COM3","SUCCESS",""
"21:50:35.6834366","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6834435","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.6834507","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.6834660","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6834758","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\TreatAs","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.6834854","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\TreatAs","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.6834937","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6834990","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Read"
"21:50:35.6835164","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.6835252","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6835309","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.6835383","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.6835524","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6835615","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6835717","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6835867","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Query: Name"
"21:50:35.6835960","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6836064","Lab10-03.exe","1128","RegQueryValue","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\InprocServer32","NAME NOT FOUND","Length: 144"
"21:50:35.6836173","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS",""
"21:50:35.6836263","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6836352","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6836449","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6836532","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6836621","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6836719","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6836803","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6836889","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6836986","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6837129","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Query: Name"
"21:50:35.6837220","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6837318","Lab10-03.exe","1128","RegQueryValue","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\(Default)","SUCCESS","Type: REG_SZ, Length: 26, Data: oleaut32.dll"
"21:50:35.6842221","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS",""
"21:50:35.6842332","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6842437","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandler32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6842542","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandler32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6842637","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6842728","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandlerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6842826","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocHandlerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6842915","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6843006","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6843113","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6843694","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6843786","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6843920","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\LocalServer","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6844008","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6844199","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.6844266","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.6844660","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6844745","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6844839","Lab10-03.exe","1128","RegQueryValue","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\AppID","NAME NOT FOUND","Length: 144"
"21:50:35.6844954","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.6845090","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.6845250","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6845309","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.6845455","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.6845607","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6845693","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\TreatAs","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.6845795","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\TreatAs","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.6845949","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.6846240","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6846320","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.6846398","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.6846579","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6846889","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6847022","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6847205","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Query: Name"
"21:50:35.6847330","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6847454","Lab10-03.exe","1128","RegQueryValue","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel","SUCCESS","Type: REG_SZ, Length: 10, Data: Both"
"21:50:35.6847577","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}\InprocServer32","SUCCESS",""
"21:50:35.6848214","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020424-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.6850300","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\rpcrt4.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:35, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 585,728, EndOfFile: 584,704, FileAttributes: A"
"21:50:35.6852244","Lab10-03.exe","1128","QueryOpen","C:\Documents and Settings\Administrator\桌面\lab\SXS.DLL","NAME NOT FOUND",""
"21:50:35.6859441","Lab10-03.exe","1128","QueryOpen","C:\WINDOWS\system32\sxs.dll","SUCCESS","CreationTime: 2008-4-14 20:00:00, LastAccessTime: 2022-10-4 21:50:35, LastWriteTime: 2008-4-14 20:00:00, ChangeTime: 2022-10-1 19:31:26, AllocationSize: 708,608, EndOfFile: 705,024, FileAttributes: A"
"21:50:35.6861143","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\sxs.dll","SUCCESS","Desired Access: Execute/Traverse, Synchronize, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Attributes: n/a, ShareMode: Read, Delete, AllocationSize: n/a, OpenResult: Opened"
"21:50:35.6862770","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\sxs.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_EXECUTE"
"21:50:35.6863180","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\sxs.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:35.6865135","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\sxs.dll","SUCCESS",""
"21:50:35.6866943","Lab10-03.exe","1128","Load Image","C:\WINDOWS\system32\sxs.dll","SUCCESS","Image Base: 0x75e00000, Image Size: 0xae000"
"21:50:35.6867432","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SXS.DLL","NAME NOT FOUND","Desired Access: Read"
"21:50:35.6868411","Lab10-03.exe","1128","RegOpenKey","HKLM\System\Setup","SUCCESS","Desired Access: Read, WOW64_64Key"
"21:50:35.6868551","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpsp2res.dll","NAME NOT FOUND","Desired Access: Read"
"21:50:35.6868700","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6868777","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.6868851","Lab10-03.exe","1128","RegOpenKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32","SUCCESS","Desired Access: Query Value"
"21:50:35.6869030","Lab10-03.exe","1128","RegQueryKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32","SUCCESS","Query: Name"
"21:50:35.6869229","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6869362","Lab10-03.exe","1128","RegQueryValue","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32\(Default)","SUCCESS","Type: REG_SZ, Length: 78, Data: {00020424-0000-0000-C000-000000000046}"
"21:50:35.6869443","Lab10-03.exe","1128","RegQueryKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32","SUCCESS","Query: Name"
"21:50:35.6869536","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6869634","Lab10-03.exe","1128","RegQueryValue","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32\(Default)","SUCCESS","Type: REG_SZ, Length: 78, Data: {00020424-0000-0000-C000-000000000046}"
"21:50:35.6869766","Lab10-03.exe","1128","RegCloseKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\ProxyStubClsid32","SUCCESS",""
"21:50:35.6870313","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6870378","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\Forward","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.6870443","Lab10-03.exe","1128","RegOpenKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\Forward","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.6870540","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6870601","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6870664","Lab10-03.exe","1128","RegOpenKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6870992","Lab10-03.exe","1128","RegQueryKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib","SUCCESS","Query: Name"
"21:50:35.6871095","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6871195","Lab10-03.exe","1128","RegQueryValue","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib\(Default)","SUCCESS","Type: REG_SZ, Length: 78, Data: {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}"
"21:50:35.6871264","Lab10-03.exe","1128","RegQueryKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib","SUCCESS","Query: Name"
"21:50:35.6871355","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6871520","Lab10-03.exe","1128","RegQueryValue","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib\(Default)","SUCCESS","Type: REG_SZ, Length: 78, Data: {EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}"
"21:50:35.6871589","Lab10-03.exe","1128","RegQueryKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib","SUCCESS","Query: Name"
"21:50:35.6871691","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6871791","Lab10-03.exe","1128","RegQueryValue","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib\Version","SUCCESS","Type: REG_SZ, Length: 8, Data: 1.1"
"21:50:35.6871858","Lab10-03.exe","1128","RegQueryKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib","SUCCESS","Query: Name"
"21:50:35.6871944","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6872057","Lab10-03.exe","1128","RegQueryValue","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib\Version","SUCCESS","Type: REG_SZ, Length: 8, Data: 1.1"
"21:50:35.6872207","Lab10-03.exe","1128","RegCloseKey","HKCR\Interface\{D30C1661-CDAF-11D0-8A3E-00C04FC9E26E}\TypeLib","SUCCESS",""
"21:50:35.6872299","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6872359","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6872429","Lab10-03.exe","1128","RegOpenKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6872600","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}","SUCCESS","Query: Name"
"21:50:35.6872690","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6872782","Lab10-03.exe","1128","RegEnumKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}","SUCCESS","Index: 0, Name: 1.1"
"21:50:35.6872850","Lab10-03.exe","1128","RegEnumKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}","NO MORE ENTRIES","Index: 1, Length: 288"
"21:50:35.6872910","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}","SUCCESS","Query: Name"
"21:50:35.6873000","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6873161","Lab10-03.exe","1128","RegOpenKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6873318","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1","SUCCESS","Query: Name"
"21:50:35.6873403","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6873498","Lab10-03.exe","1128","RegEnumKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1","SUCCESS","Index: 0, Name: 0"
"21:50:35.6873601","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1","SUCCESS","Query: Name"
"21:50:35.6873689","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6875640","Lab10-03.exe","1128","RegOpenKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6875904","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0","SUCCESS","Query: Name"
"21:50:35.6876003","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6878152","Lab10-03.exe","1128","RegOpenKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6879805","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win32","SUCCESS","Query: Name"
"21:50:35.6879926","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6880279","Lab10-03.exe","1128","RegQueryValue","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win32\(Default)","SUCCESS","Type: REG_SZ, Length: 64, Data: C:\WINDOWS\system32\shdocvw.dll"
"21:50:35.6880360","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win32","SUCCESS","Query: Name"
"21:50:35.6880463","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6880560","Lab10-03.exe","1128","RegQueryValue","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win32\(Default)","SUCCESS","Type: REG_SZ, Length: 64, Data: C:\WINDOWS\system32\shdocvw.dll"
"21:50:35.6888918","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"21:50:35.6890662","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 0, Length: 64"
"21:50:35.6894924","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 240, Length: 4"
"21:50:35.6896490","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 244, Length: 20"
"21:50:35.6898658","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 488, Length: 40"
"21:50:35.6901785","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 528, Length: 40"
"21:50:35.6903603","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 568, Length: 40"
"21:50:35.6906170","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 893,440, Length: 16"
"21:50:35.6908582","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 893,456, Length: 8"
"21:50:35.6910258","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 902,384, Length: 2"
"21:50:35.6916960","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 893,464, Length: 8"
"21:50:35.6919889","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 902,392, Length: 2"
"21:50:35.6923837","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 902,394, Length: 14"
"21:50:35.6925354","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 893,472, Length: 8"
"21:50:35.6926679","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 902,424, Length: 2"
"21:50:35.6933533","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 902,426, Length: 14"
"21:50:35.6939082","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 893,608, Length: 16"
"21:50:35.6943692","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 893,624, Length: 8"
"21:50:35.6945811","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 895,256, Length: 16"
"21:50:35.6947482","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 895,272, Length: 8"
"21:50:35.6963636","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","Offset: 899,552, Length: 16"
"21:50:35.6965729","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","AllocationSize: 1,499,136, EndOfFile: 1,498,624, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:35.6971593","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
"21:50:35.6971704","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","AllocationSize: 1,499,136, EndOfFile: 1,498,624, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:35.6976803","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\shdocvw.dll","SUCCESS","SyncType: SyncTypeOther"
"21:50:35.6977399","Lab10-03.exe","1128","RegCloseKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0\win32","SUCCESS",""
"21:50:35.6977545","Lab10-03.exe","1128","RegCloseKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1\0","SUCCESS",""
"21:50:35.6977842","Lab10-03.exe","1128","RegCloseKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}\1.1","SUCCESS",""
"21:50:35.6978207","Lab10-03.exe","1128","RegCloseKey","HKCR\TypeLib\{EAB22AC0-30C1-11CF-A7EB-0000C05BAE0B}","SUCCESS",""
"21:50:35.6978538","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.6978610","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6978685","Lab10-03.exe","1128","RegOpenKey","HKCR\TypeLib","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6978847","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib","SUCCESS","Query: Name"
"21:50:35.6978956","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6979052","Lab10-03.exe","1128","RegOpenKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6979202","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.6979290","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6979385","Lab10-03.exe","1128","RegOpenKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6979541","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0","SUCCESS","Query: Name"
"21:50:35.6979627","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6979720","Lab10-03.exe","1128","RegOpenKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6979861","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0","SUCCESS","Query: Name"
"21:50:35.6979952","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6980157","Lab10-03.exe","1128","RegOpenKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6980362","Lab10-03.exe","1128","RegCloseKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32","SUCCESS",""
"21:50:35.6980493","Lab10-03.exe","1128","RegCloseKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0","SUCCESS",""
"21:50:35.6980579","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0","SUCCESS","Query: Name"
"21:50:35.6980664","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6980751","Lab10-03.exe","1128","RegOpenKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.6980889","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0","SUCCESS","Query: Name"
"21:50:35.6980981","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.6981077","Lab10-03.exe","1128","RegOpenKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32","SUCCESS","Desired Access: Query Value"
"21:50:35.6981216","Lab10-03.exe","1128","RegQueryKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32","SUCCESS","Query: Name"
"21:50:35.6981437","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.6981561","Lab10-03.exe","1128","RegQueryValue","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32\(Default)","SUCCESS","Type: REG_SZ, Length: 64, Data: C:\WINDOWS\system32\stdole2.tlb"
"21:50:35.6981736","Lab10-03.exe","1128","RegCloseKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0\win32","SUCCESS",""
"21:50:35.7002683","Lab10-03.exe","1128","CreateFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Desired Access: Generic Read, Disposition: Open, Options: Synchronous IO Non-Alert, Non-Directory File, Random Access, Attributes: n/a, ShareMode: Read, AllocationSize: n/a, OpenResult: Opened"
"21:50:35.7013226","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 0, Length: 64"
"21:50:35.7019090","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 192, Length: 4"
"21:50:35.7021775","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 196, Length: 20"
"21:50:35.7027379","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 440, Length: 40"
"21:50:35.7044831","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 512, Length: 16"
"21:50:35.7046050","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 528, Length: 8"
"21:50:35.7050999","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 672, Length: 2"
"21:50:35.7057247","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 674, Length: 14"
"21:50:35.7060898","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 544, Length: 16"
"21:50:35.7062499","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 560, Length: 8"
"21:50:35.7063707","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 592, Length: 16"
"21:50:35.7072429","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 608, Length: 8"
"21:50:35.7086727","Lab10-03.exe","1128","ReadFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","Offset: 640, Length: 16"
"21:50:35.7089621","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","AllocationSize: 20,480, EndOfFile: 16,896, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:35.7108353","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","SyncType: SyncTypeCreateSection, PageProtection: PAGE_READONLY"
"21:50:35.7108645","Lab10-03.exe","1128","QueryStandardInformationFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","AllocationSize: 20,480, EndOfFile: 16,896, NumberOfLinks: 1, DeletePending: False, Directory: False"
"21:50:35.7114727","Lab10-03.exe","1128","CreateFileMapping","C:\WINDOWS\system32\stdole2.tlb","SUCCESS","SyncType: SyncTypeOther"
"21:50:35.7115344","Lab10-03.exe","1128","RegCloseKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0\0","SUCCESS",""
"21:50:35.7115670","Lab10-03.exe","1128","RegCloseKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}\2.0","SUCCESS",""
"21:50:35.7115905","Lab10-03.exe","1128","RegCloseKey","HKCR\TypeLib\{00020430-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.7116066","Lab10-03.exe","1128","RegCloseKey","HKCR\TypeLib","SUCCESS",""
"21:50:35.7117113","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\Rpc","SUCCESS","Desired Access: Read"
"21:50:35.7117314","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\Rpc\UDTAlignmentPolicy","NAME NOT FOUND","Length: 144"
"21:50:35.7118662","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\Rpc","SUCCESS",""
"21:50:35.7120682","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.7120995","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.7121077","Lab10-03.exe","1128","RegOpenKey","HKCR\Interface\{00020400-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.7121257","Lab10-03.exe","1128","RegQueryKey","HKCR\Interface\{00020400-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7121369","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32","NAME NOT FOUND","Desired Access: Read"
"21:50:35.7121473","Lab10-03.exe","1128","RegOpenKey","HKCR\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32","SUCCESS","Desired Access: Read"
"21:50:35.7121615","Lab10-03.exe","1128","RegQueryKey","HKCR\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32","SUCCESS","Query: Name"
"21:50:35.7121703","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7121809","Lab10-03.exe","1128","RegQueryValue","HKCR\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32\(Default)","SUCCESS","Type: REG_SZ, Length: 78, Data: {00020420-0000-0000-C000-000000000046}"
"21:50:35.7121941","Lab10-03.exe","1128","RegCloseKey","HKCR\Interface\{00020400-0000-0000-C000-000000000046}\ProxyStubClsid32","SUCCESS",""
"21:50:35.7122069","Lab10-03.exe","1128","RegCloseKey","HKCR\Interface\{00020400-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.7122218","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Read"
"21:50:35.7122367","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion","SUCCESS","Type: REG_BINARY, Length: 8, Data: 07 00 00 00 00 00 00 00"
"21:50:35.7122483","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\COM3","SUCCESS",""
"21:50:35.7122654","Lab10-03.exe","1128","RegOpenKey","HKLM\Software\Microsoft\COM3","SUCCESS","Desired Access: Read"
"21:50:35.7122791","Lab10-03.exe","1128","RegQueryValue","HKLM\SOFTWARE\Microsoft\COM3\REGDBVersion","SUCCESS","Type: REG_BINARY, Length: 8, Data: 07 00 00 00 00 00 00 00"
"21:50:35.7122895","Lab10-03.exe","1128","RegCloseKey","HKLM\SOFTWARE\Microsoft\COM3","SUCCESS",""
"21:50:35.7123015","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.7123076","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.7123150","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.7123300","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7123387","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\TreatAs","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.7123491","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\TreatAs","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.7123582","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.7123637","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes","SUCCESS","Desired Access: Read"
"21:50:35.7123808","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.7123896","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.7123951","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.7124012","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.7124164","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7125120","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7125352","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.7125527","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Query: Name"
"21:50:35.7125634","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7125778","Lab10-03.exe","1128","RegQueryValue","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\InprocServer32","NAME NOT FOUND","Length: 144"
"21:50:35.7125892","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","SUCCESS",""
"21:50:35.7125984","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7126079","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7127326","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7127422","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7127515","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\LocalServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7128754","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\LocalServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7128852","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7128945","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7129045","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.7129190","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Query: Name"
"21:50:35.7129278","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7130049","Lab10-03.exe","1128","RegQueryValue","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\(Default)","SUCCESS","Type: REG_SZ, Length: 26, Data: oleaut32.dll"
"21:50:35.7130239","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","SUCCESS",""
"21:50:35.7130348","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7130452","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocHandler32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7130553","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocHandler32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7130640","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7130750","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocHandlerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7130849","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocHandlerX86","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7130938","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7131027","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\LocalServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7131123","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\LocalServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7131268","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7131592","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\LocalServer","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7131755","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\LocalServer","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7131871","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.7131957","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.7132042","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.7132232","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7132351","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7132479","Lab10-03.exe","1128","RegQueryValue","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\AppID","NAME NOT FOUND","Length: 144"
"21:50:35.7132815","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.7132968","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.7134040","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.7134109","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.7134177","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.7134330","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7134419","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\TreatAs","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.7134508","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\TreatAs","NAME NOT FOUND","Desired Access: Query Value"
"21:50:35.7135281","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.7135396","Lab10-03.exe","1128","RegQueryKey","HKCU\Software\Classes","SUCCESS","Query: Name"
"21:50:35.7135454","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}","NAME NOT FOUND","Desired Access: Read"
"21:50:35.7135518","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Desired Access: Read"
"21:50:35.7135662","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS","Query: Name"
"21:50:35.7135756","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7135855","Lab10-03.exe","1128","RegOpenKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Desired Access: Maximum Allowed"
"21:50:35.7135996","Lab10-03.exe","1128","RegQueryKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","SUCCESS","Query: Name"
"21:50:35.7136086","Lab10-03.exe","1128","RegOpenKey","HKCU\Software\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","NAME NOT FOUND","Desired Access: Maximum Allowed"
"21:50:35.7136182","Lab10-03.exe","1128","RegQueryValue","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32\ThreadingModel","SUCCESS","Type: REG_SZ, Length: 10, Data: Both"
"21:50:35.7136294","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32","SUCCESS",""
"21:50:35.7136428","Lab10-03.exe","1128","RegCloseKey","HKCR\CLSID\{00020420-0000-0000-C000-000000000046}","SUCCESS",""
"21:50:35.7139130","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\stdole2.tlb","SUCCESS",""
"21:50:35.7147379","Lab10-03.exe","1128","CloseFile","C:\WINDOWS\system32\shdocvw.dll","SUCCESS",""
"21:50:35.7149036","Lab10-03.exe","1128","RegCloseKey","HKCU\Software\Classes","SUCCESS",""
"21:50:36.0418654","services.exe","736","RegOpenKey","HKLM\System\CurrentControlSet\Services","SUCCESS","Desired Access: Read"
"21:50:36.0418900","services.exe","736","RegOpenKey","HKLM\System\CurrentControlSet\Services\CryptSvc","SUCCESS","Desired Access: Read"
"21:50:36.0419134","services.exe","736","RegCloseKey","HKLM\System\CurrentControlSet\Services","SUCCESS",""
"21:50:36.0419205","services.exe","736","RegOpenKey","HKLM\System\CurrentControlSet\Services","SUCCESS","Desired Access: Read"
"21:50:36.0419852","services.exe","736","RegOpenKey","HKLM\System\CurrentControlSet\Services\CryptSvc","SUCCESS","Desired Access: Read"
"21:50:36.0420084","services.exe","736","RegCloseKey","HKLM\System\CurrentControlSet\Services","SUCCESS",""
"21:50:36.0420203","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\ImagePath","BUFFER OVERFLOW","Length: 12"
"21:50:36.0420303","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\ImagePath","SUCCESS","Type: REG_EXPAND_SZ, Length: 90, Data: %SystemRoot%\system32\svchost.exe -k netsvcs"
"21:50:36.0420457","services.exe","736","RegCloseKey","HKLM\System\CurrentControlSet\Services\CryptSvc","SUCCESS",""
"21:50:36.0420544","services.exe","736","RegOpenKey","HKLM\System\CurrentControlSet\Services","SUCCESS","Desired Access: Read"
"21:50:36.0420787","services.exe","736","RegOpenKey","HKLM\System\CurrentControlSet\Services\CryptSvc","SUCCESS","Desired Access: Read"
"21:50:36.0421002","services.exe","736","RegCloseKey","HKLM\System\CurrentControlSet\Services","SUCCESS",""
"21:50:36.0421113","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\Type","SUCCESS","Type: REG_DWORD, Length: 4, Data: 32"
"21:50:36.0421195","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\Start","SUCCESS","Type: REG_DWORD, Length: 4, Data: 2"
"21:50:36.0421281","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\ErrorControl","SUCCESS","Type: REG_DWORD, Length: 4, Data: 1"
"21:50:36.0421364","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\Tag","NAME NOT FOUND","Length: 16"
"21:50:36.0421442","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\DependOnService","BUFFER OVERFLOW","Length: 12"
"21:50:36.0421527","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\DependOnService","SUCCESS","Type: REG_MULTI_SZ, Length: 14, Data: RpcSs"
"21:50:36.0421605","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\DependOnGroup","NAME NOT FOUND","Length: 12"
"21:50:36.0421686","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\Group","NAME NOT FOUND","Length: 12"
"21:50:36.0421761","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\DisplayName","BUFFER OVERFLOW","Length: 12"
"21:50:36.0421842","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\DisplayName","SUCCESS","Type: REG_SZ, Length: 46, Data: Cryptographic Services"
"21:50:36.0421978","services.exe","736","RegCloseKey","HKLM\System\CurrentControlSet\Services\CryptSvc","SUCCESS",""
"21:50:36.0422085","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\ObjectName","BUFFER OVERFLOW","Length: 12"
"21:50:36.0422172","services.exe","736","RegQueryValue","HKLM\System\CurrentControlSet\Services\CryptSvc\ObjectName","SUCCESS","Type: REG_SZ, Length: 24, Data: LocalSystem"
"21:50:36.0422323","services.exe","736","RegCloseKey","HKLM\System\CurrentControlSet\Services\CryptSvc","SUCCESS",""

 驱动安装注册服务那部分基本上看不到？？？EDR 检测如何做呢？？？todo。。。

 

把文件放到那个目录之后，点击执行就会跳出这个IE，然后不断的跳IE出来，到我打完这段话，已经跳了这么多的窗口出来了

 

 

然后我们开始分析，先是安装书上的开始静态分析

我们先分析的是exe文件

在KERNEL32.DLL里面我们发现这么几个有意思的函数CreateFile和WriteFile

 

 

然后我们查看这个ADVAPI32.DLL这个导入库

 

 

这个有一个比较让人感兴趣的导入函数就是OpenSCManagerA，还有StartServiceA以及CreateServiceA这三个导出函数，说明这个代码会创建一个服务在系统中

然后我们开始分析sys文件的导出函数有哪些

 

 

我们可以看到如下的一些函数

IoCreateDevice
IoCreateSymbolicLink
IoDeleteDevice
IoDeleteSymbolicLink
IoGetCurrentProcess
IofCompleteRequest
KeTickCount
RtlInitUnicodeString

 

我们每个函数都解释一下，首先是IoCreateDevice

在MSDN中，这个函数被定义为

The IoCreateDevice routine creates a device object for use by a driver.

翻译过来就是

IoCreateDevice例程创建供驱动程序使用的设备对象

这个例程会创建一个设备，对应的例程有IoDeleteDevice

下一个IoCreateSymbolicLink

IoCreateSymbolicLink例程在设备对象名称和设备的用户可见名称之间建立符号链接

对应的例程有IoDeleteSymbolicLink

下一个IoGetCurrentProcess

IoGetCurrentProcess例程返回一个指向当前进程的指针

下一个IofCompleteRequest

IoCompleteRequest例程指示调用者已完成给定I/O请求的所有处理，并将给定的IRP返回给I/O管理器

下一个是KeTickCount

检索自系统启动以来经过的毫秒数，最长为49.7天

下一个是RtlInitUnicodeString

初始化一个统计的Unicode字符串

书上说，从IoGetCurrentProcess这个例程可以看出，这个驱动或者在修改正在运行的进程，或者需要关于进程的信息

这个病毒好玩的地方在于，如果我们打算用任务管理器关闭这个进程的时候，会发现，根本没有这个进程，包括使用Process Explorer里面也是没有列出来

然后我们恢复快照，准备进行高级静态分析

首先我们找到程序开始的地方，开始分析

 

 

第一个调用的函数就OpenSCManagerA，这是一个用于打开服务控制的函数，说明程序打算在这里操作服务，这里我们就不着重分析各种跳转了

如果上面的OpenSCManagerA调用成功，就会开始执行下面这些代码

 

 

我们可以看到一个字符串变量被压入了栈中，C:\\Windows\\System32\\Lab10-03.sys，这就是我们那个驱动文件

然后这里我们忽略入参为0的参数，主要看不为0的参数

其中的一个是BinaryPathName，它的值是我们那个驱动文件的路径，这是用于指明服务的二进制文件的位置的参数，然后从上往下的下一个入参是dwErrorControl这个参数，这个参数是用于错误控制的，对于我们来说，没有太多的意义

我们注意到这里有个dwStartType这个参数，值为3

 

 

这个的意义就是

用户可以使用“服务”控制面板实用程序启动服务。 用户可以在“开始参数”字段中为服务指定参数。 服务控制程序可以启动服务并使用StartService函数指定其参数。

服务启动时，SCM执行以下步骤：

检索存储在数据库中的帐户信息。
登录服务帐户。
加载用户配置文件。
在暂停状态下创建服务。
将登录令牌分配给进程。
允许该过程执行。

下一个参数是dwServiceType，他的值为1，意义就是表明这是个驱动服务

 

 

最后的lpServiceName和lpDisplayName说明的是这个服务的名字是Process Helper

如果调用CreateServiceA成功的话，下面执行StartService，一旦执行这个之后，恶意驱动Lab10-03.sys就会被加载到内核中

 

 

一切顺利的话，就会执行下面这些代码

 

 

 

这里创建了一个文件在\\.\ProcHelper这个地方并作为一个句柄打开，还是如果一切顺利的话，会执行下面这个代码

 

 

这里有个新函数叫DeviceIoControl这个东西，这个函数的用途如下

将控制代码直接发送到指定的设备驱动程序，导致相应的设备执行相应的操作。

以及MSDN中的定义如下，顺便可以得出这个入参的列表

BOOL WINAPI DeviceIoControl(
  _In_        HANDLE       hDevice = eax,
  _In_        DWORD        dwIoControlCode = 0abcdef01h,
  _In_opt_    LPVOID       lpInBuffer = 0,
  _In_        DWORD        nInBufferSize = 0,
  _Out_opt_   LPVOID       lpOutBuffer = 0,
  _In_        DWORD        nOutBufferSize = 0,
  _Out_opt_   LPDWORD      lpBytesReturned = eax,
  _Inout_opt_ LPOVERLAPPED lpOverlapped = 0
);

 

这里我们需要分析一个这个DeviceIoControl的各种用途，按照书上的说法，这里DeviceIoControl的参数lpInBuffer和lpOutBuffer被设置为了Null也就是0很不寻常，这意味着这个请求没有发送任何的信息到内核驱动中(lpInBuffer = 0)，并且内核驱动的反馈也是没有的(lpOutBuffer = 0)，然后还有个古怪的地方就是dwIoControlCode的值是abcdedf01，这个值有点太人工了

 

 

然后下一个函数调用就是这个CoCreateInstance，这个函数在MSDN中的解释就是

创建与指定的CLSID关联的类的单个未初始化对象。

当您只想在本地系统上创建一个对象时调用CoCreateInstance。 要在远程系统上创建单个对象，请调用CoCreateInstanceEx函数。 要基于单个CLSID创建多个对象，请调用CoGetClassObject函数。

这是用于一个用于创建COM对象的

 

 

 

 

 

然后下一个函数如下，在调用SysAllocString之前，有个字符串被压入了栈中

http://www.malwareanalysisbook.com/ad.html

 

这就是我们会打开的那个广告页面的URL

 

 

 

最后在这里调用了Sleep函数休眠了0x7530h毫秒，然后就是一直循环这个代码块，直到你关机为止

接下来我们分析sys文件

见：https://blog.csdn.net/isinstance/article/details/79626369，太繁琐，和上一个类似，去内核调试运行看功能。

 

IoCreateSymbolicLink这个函数的功能是创建符号链接，通常在DriverEntry中调用。
wdk文档中对这个函数介绍如下：
The IoCreateSymbolicLink routine sets up a symbolic link between a device object name and a user-visible name for the device.
这句话的意思就是 IoCreateSymbolicLink在设备名和用户可见名字之间创建链接。
通常在调用IoCreateDevice创建设备对象的时候会传入设备名称。这个设备名称只能在内核层使用，只能被内核层的函数识别。如果IoCreateDevice中没有指定设备名称，那么I/O管理器会自动分配一个数字作为设备的名称。例如"\Device\00000001"。
如想要在用户层的应用程序中访问(比如调用CreateFile函数打开)，就需要创建符号链接，相当于为设备对象创建一个别名，供应用程序访问。应用层是无法直接通过设备名字来打开对象的，必须建立一个暴露给应用程序的符号链接。
比如：c盘的符号链接名称是"C:"，对应的设备名称是"\Device\HarddiskVolume1”
在驱动程序中，定义设备对象名称需要以L"\\device\\"开头，

 

 

应该就是对应下面这几个了！

 

 

 

 

 

 隐藏思路：

 

 和上面一个实验类似！修改链表节点方式来实现隐藏。

 

做隐藏的sys代码就是上面这个，

The IoGetCurrentProcess routine returns a pointer to the current process. Call PsGetCurrentProcess instead of IoGetCurrentProcess.

The IoCompleteRequest macro indicates that the caller has completed all processing for a given I/O request and is returning the given IRP to the I/O manager.

 

 

————————————————

2.一旦程序运行，你怎样停止它？

解答：书上的说法是重启，也只有这种把法了
3.它的内核组件做了什么操作？

解答： 修改了进程链接表的结构，隐藏了自己的LIST_ENTRY，通过那个偏移为0xe的函数，这个函数我们现在还不知道怎么知道把偏移量和函数名对应起来，因为我们也看了wdm.h，根本找不到这个函数，可执行文件调用了DeviceIoControl之后，驱动把进程隐藏
————————————————
 
原文链接：https://blog.csdn.net/isinstance/article/details/79626369