HOOKDUMP Requests
NB.This old keylogger is designed for 16 bits and not win32 system, that's why ntdvm.exe is required.
In red, the creation of the log.
# Time sent Dur. Process Thread ID DeviceObject IRP Request IRP Flags Nested FileObject FsContext FsContext2 FO Flags Path Status More info
1 12:30:20.421 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_OPEN F9436C94 00000000 00000000 00000000 C:[-=Error 0xc000000d Getting Name=-] STATUS_SUCCESS FILE_OPEN CreOpts: 0x00200000 Access: 0x00000080 Share: 0x00000007 Attrib: 0 Result: 00000038 AllocationSize: 00000000-00000000 EndOfFile: 00000000-00000000 Attrib: 0x00000010
2 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 819D3F28 00000000 00000000 00000002 C: STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
3 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No 819D3F28 E1723958 E272FED8 00040002 C: STATUS_SUCCESS FileBothDirectoryInformation (FileMask = Documents and Setting)
4 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No 819D3F28 E1723958 E272FED8 00040002 C: STATUS_SUCCESS
5 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No 819D3F28 E1723958 E272FED8 00044002 C: STATUS_SUCCESS
6 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 819D3F28 00000000 00000000 00000002 C:Documents and Settings STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
7 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No 819D3F28 E17620D0 E1762268 00040002 C:Documents and Settings STATUS_SUCCESS FileBothDirectoryInformation (FileMask = All User)
8 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No 819D3F28 E17620D0 E1762268 00040002 C:Documents and Settings STATUS_SUCCESS
9 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No 819D3F28 E17620D0 E1762268 00044002 C:Documents and Settings STATUS_SUCCESS
10 12:30:20.421 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_OPEN F9436C94 00000000 00000000 00000000 C:[-=Error 0xc000000d Getting Name=-] STATUS_SUCCESS FILE_OPEN CreOpts: 0x00200000 Access: 0x00000080 Share: 0x00000007 Attrib: 0 Result: 00000038 AllocationSize: 00000000-00000000 EndOfFile: 00000000-00000000 Attrib: 0x00000013
11 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 819D3F28 00000000 00000000 00000002 C: STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
12 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No 819D3F28 E1723958 E272FED8 00040002 C: STATUS_SUCCESS FileBothDirectoryInformation (FileMask = Documents and Setting)
13 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No 819D3F28 E1723958 E272FED8 00040002 C: STATUS_SUCCESS
14 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No 819D3F28 E1723958 E272FED8 00044002 C: STATUS_SUCCESS
15 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 819D3F28 00000000 00000000 00000002 C:Documents and Settings STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
16 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No 819D3F28 E17620D0 E1762268 00040002 C:Documents and Settings STATUS_SUCCESS FileBothDirectoryInformation (FileMask = Administrateur.POSTE)
17 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No 819D3F28 E17620D0 E1762268 00040002 C:Documents and Settings STATUS_SUCCESS
18 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No 819D3F28 E17620D0 E1762268 00044002 C:Documents and Settings STATUS_SUCCESS
19 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 819D3F28 00000000 00000000 00000002 C:Documents and SettingsAdministrateur.POSTE2 STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
20 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No 819D3F28 E1762D20 E272FED8 00040002 C:Documents and SettingsAdministrateur.POSTE2 STATUS_SUCCESS FileBothDirectoryInformation (FileMask = Application Dat)
21 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No 819D3F28 E1762D20 E272FED8 00040002 C:Documents and SettingsAdministrateur.POSTE2 STATUS_SUCCESS
22 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No 819D3F28 E1762D20 E272FED8 00044002 C:Documents and SettingsAdministrateur.POSTE2 STATUS_SUCCESS
23 12:30:20.421 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_OPEN F9436C94 00000000 00000000 00000000 C:[-=Error 0xc000000d Getting Name=-] STATUS_SUCCESS FILE_OPEN CreOpts: 0x00200000 Access: 0x00000080 Share: 0x00000007 Attrib: 0 Result: 00000038 AllocationSize: 00000000-00000000 EndOfFile: 00000000-00000000 Attrib: 0x00000010
24 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 819D3F28 00000000 00000000 00000002 C: STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
25 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No 819D3F28 E1723958 E272FED8 00040002 C: STATUS_SUCCESS FileBothDirectoryInformation (FileMask = Program File)
26 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No 819D3F28 E1723958 E272FED8 00040002 C: STATUS_SUCCESS
27 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No 819D3F28 E1723958 E272FED8 00044002 C: STATUS_SUCCESS
28 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 819D3F28 00000000 00000000 00000002 C:Program Files STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
29 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No 819D3F28 E1853D20 E1853EB8 00040002 C:Program Files STATUS_SUCCESS FileBothDirectoryInformation (FileMask = Fichiers commun)
30 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No 819D3F28 E1853D20 E1853EB8 00040002 C:Program Files STATUS_SUCCESS
31 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No 819D3F28 E1853D20 E1853EB8 00044002 C:Program Files STATUS_SUCCESS
32 12:30:20.421 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_OPEN F9436C94 00000000 00000000 00000000 C:[-=Error 0xc000000d Getting Name=-] STATUS_SUCCESS FILE_OPEN CreOpts: 0x00200000 Access: 0x00000080 Share: 0x00000007 Attrib: 0 Result: 00000038 AllocationSize: 00000000-00000000 EndOfFile: 00000000-00000000 Attrib: 0x00000011
33 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 819D3F28 00000000 00000000 00000002 C: STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
34 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No 819D3F28 E1723958 E272FED8 00040002 C: STATUS_SUCCESS FileBothDirectoryInformation (FileMask = Program File)
35 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No 819D3F28 E1723958 E272FED8 00040002 C: STATUS_SUCCESS
36 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No 819D3F28 E1723958 E272FED8 00044002 C: STATUS_SUCCESS
37 12:30:20.421 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_OPEN F9436C94 00000000 00000000 00000000 C:[-=Error 0xc000000d Getting Name=-] STATUS_SUCCESS FILE_OPEN CreOpts: 0x00200000 Access: 0x00000080 Share: 0x00000007 Attrib: 0 Result: 00000038 AllocationSize: 00000000-00000000 EndOfFile: 00000000-00000000 Attrib: 0x00000010
38 12:30:20.421 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_OPEN F9436C94 00000000 00000000 00000000 C:[-=Error 0xc000000d Getting Name=-] STATUS_SUCCESS FILE_OPEN CreOpts: 0x00200000 Access: 0x00000080 Share: 0x00000007 Attrib: 0 Result: 00000038 AllocationSize: 00000000-00000000 EndOfFile: 00000000-00000000 Attrib: 0x00000010
39 12:30:20.421 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_OPEN F9436C94 00000000 00000000 00000000 C:[-=Error 0xc000000d Getting Name=-] STATUS_SUCCESS FILE_OPEN CreOpts: 0x00200000 Access: 0x00000080 Share: 0x00000007 Attrib: 0 Result: 00000038 AllocationSize: 00000000-00000000 EndOfFile: 00000000-00000000 Attrib: 0x00000010
40 12:30:20.421 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_OPEN F9436C94 00000000 00000000 00000000 C:[-=Error 0xc000000d Getting Name=-] STATUS_SUCCESS FILE_OPEN CreOpts: 0x00200000 Access: 0x00000080 Share: 0x00000007 Attrib: 0 Result: 00000038 AllocationSize: 00000000-00000000 EndOfFile: 00000000-00000000 Attrib: 0x00000010
41 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 819D3F28 00000000 00000000 00000002 C: STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
42 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No 819D3F28 E1723958 E272FED8 00040002 C: STATUS_SUCCESS FileBothDirectoryInformation (FileMask = Documents and Setting)
43 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No 819D3F28 E1723958 E272FED8 00040002 C: STATUS_SUCCESS
44 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No 819D3F28 E1723958 E272FED8 00044002 C: STATUS_SUCCESS
45 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 819D3F28 00000000 00000000 00000002 C:Documents and Settings STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
46 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No 819D3F28 E17620D0 E1762268 00040002 C:Documents and Settings STATUS_SUCCESS FileBothDirectoryInformation (FileMask = Administrateur.POSTE)
47 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No 819D3F28 E17620D0 E1762268 00040002 C:Documents and Settings STATUS_SUCCESS
48 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No 819D3F28 E17620D0 E1762268 00044002 C:Documents and Settings STATUS_SUCCESS
49 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 819D3F28 00000000 00000000 00000002 C:WINDOWS STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100020 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
50 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF22F840 E1723958 E1723AF0 00040002 C: STATUS_SUCCESS
51 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No FF22F840 E1723958 E1723AF0 00044002 C: STATUS_SUCCESS
52 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF22F840 00000000 00000000 00000002 C:WINDOWSTEMP STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100020 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
53 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No 819D3F28 E171C0D0 E272FED8 00040002 C:WINDOWS STATUS_SUCCESS
54 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No 819D3F28 E171C0D0 E272FED8 00044002 C:WINDOWS STATUS_SUCCESS
55 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 819D3F28 00000000 00000000 00000002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMP STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100020 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
56 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF22F840 E1BC4CE0 E1BC4E78 00040002 C:WINDOWSTEMP STATUS_SUCCESS
57 12:30:20.421 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No FF22F840 E1BC4CE0 E1BC4E78 00044002 C:WINDOWSTEMP STATUS_SUCCESS
58 12:30:20.437 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_OPEN F9436C94 00000000 00000000 00000000 C:[-=Error 0xc000000d Getting Name=-] STATUS_SUCCESS FILE_OPEN CreOpts: 0x00200000 Access: 0x00000080 Share: 0x00000007 Attrib: 0 Result: 00000038 AllocationSize: 00000000-00006000 EndOfFile: 00000000-00005500 Attrib: 0x00000020
59 12:30:20.437 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF22F840 00000000 00000000 00000002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHOOKDUMP.EXE STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000060 Access: 0x001200A9 Share: 0x00000007 Attrib: 0 Result: FILE_OPENED
60 12:30:20.437 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_STANDARD_INFO FF22F840 E159D758 E15493C0 000C0042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHOOKDUMP.EXE STATUS_SUCCESS AllocationSize: 00000000-00006000 EndOfFile: 00000000-00005500 NumberOfLinks: 1 DeletePending: 0 Directory: 0
61 12:30:20.437 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_STANDARD_INFO FF22F840 E159D758 E15493C0 000C0042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHOOKDUMP.EXE STATUS_SUCCESS AllocationSize: 00000000-00006000 EndOfFile: 00000000-00005500 NumberOfLinks: 1 DeletePending: 0 Directory: 0
62 12:30:20.437 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_OPEN F9436C94 00000000 00000000 00000000 C:[-=Error 0xc000000d Getting Name=-] STATUS_SUCCESS FILE_OPEN CreOpts: 0x00200000 Access: 0x00000080 Share: 0x00000007 Attrib: 0 Result: 00000038 AllocationSize: 00000000-00003000 EndOfFile: 00000000-00002700 Attrib: 0x00000020
63 12:30:20.437 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No 81A83D18 00000000 00000000 00000002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHOOKDMP.DLL STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000060 Access: 0x001200A9 Share: 0x00000007 Attrib: 0 Result: FILE_OPENED
64 12:30:20.437 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_STANDARD_INFO 81A83D18 E22E00D0 E1A71008 000C0042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHOOKDMP.DLL STATUS_SUCCESS AllocationSize: 00000000-00003000 EndOfFile: 00000000-00002700 NumberOfLinks: 1 DeletePending: 0 Directory: 0
65 12:30:20.437 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_STANDARD_INFO 81A83D18 E22E00D0 E1A71008 000C0042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHOOKDMP.DLL STATUS_SUCCESS AllocationSize: 00000000-00003000 EndOfFile: 00000000-00002700 NumberOfLinks: 1 DeletePending: 0 Directory: 0
66 12:30:20.437 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_OPEN F9436C94 00000000 00000000 00000000 C:[-=Error 0xc000000d Getting Name=-] STATUS_SUCCESS FILE_OPEN CreOpts: 0x00200000 Access: 0x00000080 Share: 0x00000007 Attrib: 0 Result: 00000038 AllocationSize: 00000000-00004000 EndOfFile: 00000000-00003640 Attrib: 0x00000020
67 12:30:20.437 0 ntvdm.exe 208 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FE968038 00000000 00000000 00000002 C:WINDOWSSYSTEM32TOOLHELP.DLL STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000060 Access: 0x001200A9 Share: 0x00000007 Attrib: 0 Result: FILE_OPENED
68 12:30:20.437 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_STANDARD_INFO FE968038 E21F85C8 E151F860 000C0042 C:WINDOWSSYSTEM32TOOLHELP.DLL STATUS_SUCCESS AllocationSize: 00000000-00004000 EndOfFile: 00000000-00003640 NumberOfLinks: 1 DeletePending: 0 Directory: 0
69 12:30:20.437 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_STANDARD_INFO FE968038 E21F85C8 E151F860 000C0042 C:WINDOWSSYSTEM32TOOLHELP.DLL STATUS_SUCCESS AllocationSize: 00000000-00004000 EndOfFile: 00000000-00003640 NumberOfLinks: 1 DeletePending: 0 Directory: 0
70 12:30:20.453 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_STANDARD_INFO FF22F840 E159D758 E15493C0 000C0042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHOOKDUMP.EXE STATUS_SUCCESS AllocationSize: 00000000-00006000 EndOfFile: 00000000-00005500 NumberOfLinks: 1 DeletePending: 0 Directory: 0
71 12:30:20.453 0 ntvdm.exe 208 FE887848 FASTIO_QUERY_STANDARD_INFO FF22F840 E159D758 E15493C0 000C0042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHOOKDUMP.EXE STATUS_SUCCESS AllocationSize: 00000000-00006000 EndOfFile: 00000000-00005500 NumberOfLinks: 1 DeletePending: 0 Directory: 0
72 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF20F868 00000000 00000000 00000002 C:WINDOWSAppPatchsysmain.sdb STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000060 Access: 0x00120089 Share: 0x00000001 Attrib: 0x00000080 Result: FILE_OPENED
73 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_QUERY_STANDARD_INFO FF20F868 E18450D0 E1A40238 00040042 C:WINDOWSAppPatchsysmain.sdb STATUS_SUCCESS AllocationSize: 00000000-00123000 EndOfFile: 00000000-00122B8C NumberOfLinks: 1 DeletePending: 0 Directory: 0
74 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_QUERY_STANDARD_INFO FF20F868 E18450D0 E1A40238 00040042 C:WINDOWSAppPatchsysmain.sdb STATUS_SUCCESS AllocationSize: 00000000-00123000 EndOfFile: 00000000-00122B8C NumberOfLinks: 1 DeletePending: 0 Directory: 0
75 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_QUERY_STANDARD_INFO FF20F868 E18450D0 E1A40238 00040042 C:WINDOWSAppPatchsysmain.sdb STATUS_SUCCESS AllocationSize: 00000000-00123000 EndOfFile: 00000000-00122B8C NumberOfLinks: 1 DeletePending: 0 Directory: 0
76 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF0E5BC8 00000000 00000000 00000002 C:WINDOWSAppPatchsystest.sdb STATUS_OBJECT_NAME_NOT_FOUND FILE_OPEN CreOpts: 0x00000060 Access: 0x00120089 Share: 0x00000001 Attrib: 0x00000080 Result: FILE_SUPERSEDED
77 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF0E5BC8 00000000 00000000 00000002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMP STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
78 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No FF0E5BC8 E1603D20 E272FED8 00040002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMP STATUS_SUCCESS FileBothDirectoryInformation (FileMask = HOOKDUMP.EX)
79 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF0E5BC8 E1603D20 E272FED8 00040002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMP STATUS_SUCCESS
80 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No FF0E5BC8 E1603D20 E272FED8 00044002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMP STATUS_SUCCESS
81 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_QUERY_OPEN F9EEFC94 00000000 00000000 00000000 C:[-=Error 0xc000000d Getting Name=-] STATUS_SUCCESS FILE_OPEN CreOpts: 0x00200000 Access: 0x00000080 Share: 0x00000007 Attrib: 0 Result: 00000038 AllocationSize: 00000000-00006000 EndOfFile: 00000000-00005500 Attrib: 0x00000020
82 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF0E5BC8 00000000 00000000 00000002 C: STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
83 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No FF0E5BC8 E1723958 E1723AF0 00040002 C: STATUS_SUCCESS FileBothDirectoryInformation (FileMask = DOCUME~)
84 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF0E5BC8 E1723958 E1723AF0 00040002 C: STATUS_SUCCESS
85 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No FF0E5BC8 E1723958 E1723AF0 00044002 C: STATUS_SUCCESS
86 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF0E5BC8 00000000 00000000 00000002 C:DOCUME~1 STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
87 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No FF0E5BC8 E17620D0 E1762268 00040002 C:DOCUME~1 STATUS_SUCCESS FileBothDirectoryInformation (FileMask = ADMINI~1.PO)
88 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF0E5BC8 E17620D0 E1762268 00040002 C:DOCUME~1 STATUS_SUCCESS
89 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No FF0E5BC8 E17620D0 E1762268 00044002 C:DOCUME~1 STATUS_SUCCESS
90 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF0E5BC8 00000000 00000000 00000002 C:DOCUME~1ADMINI~1.POS STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
91 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No FF0E5BC8 E1762D20 E272FED8 00040002 C:DOCUME~1ADMINI~1.POS STATUS_SUCCESS FileBothDirectoryInformation (FileMask = MESDOC~)
92 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF0E5BC8 E1762D20 E272FED8 00040002 C:DOCUME~1ADMINI~1.POS STATUS_SUCCESS
93 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No FF0E5BC8 E1762D20 E272FED8 00044002 C:DOCUME~1ADMINI~1.POS STATUS_SUCCESS
94 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF0E5BC8 00000000 00000000 00000002 C:DOCUME~1ADMINI~1.POSMESDOC~1 STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
95 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No FF0E5BC8 E1249D20 E272FED8 00040002 C:DOCUME~1ADMINI~1.POSMESDOC~1 STATUS_SUCCESS FileBothDirectoryInformation (FileMask = MESVID~)
96 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF0E5BC8 E1249D20 E272FED8 00040002 C:DOCUME~1ADMINI~1.POSMESDOC~1 STATUS_SUCCESS
97 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No FF0E5BC8 E1249D20 E272FED8 00044002 C:DOCUME~1ADMINI~1.POSMESDOC~1 STATUS_SUCCESS
98 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF0E5BC8 00000000 00000000 00000002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1 STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
99 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No FF0E5BC8 E10850D0 E272FED8 00040002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1 STATUS_SUCCESS FileBothDirectoryInformation (FileMask = HOOKDUM)
100 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF0E5BC8 E10850D0 E272FED8 00040002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1 STATUS_SUCCESS
101 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No FF0E5BC8 E10850D0 E272FED8 00044002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1 STATUS_SUCCESS
102 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF0E5BC8 00000000 00000000 00000002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMP STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000021 Access: 0x00100001 Share: 0x00000003 Attrib: 0 Result: FILE_OPENED
103 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_DIRECTORY_CONTROL/IRP_MN_QUERY_DIRECTORY 00000800 No FF0E5BC8 E1603D20 E272FED8 00040002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMP STATUS_SUCCESS FileBothDirectoryInformation (FileMask = HOOKDUMP.EX)
104 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF0E5BC8 E1603D20 E272FED8 00040002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMP STATUS_SUCCESS
105 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No FF0E5BC8 E1603D20 E272FED8 00044002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMP STATUS_SUCCESS
106 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF20F868 E18450D0 E1A40238 00040042 C:WINDOWSAppPatchsysmain.sdb STATUS_SUCCESS
107 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No FF20F868 E18450D0 E1A40238 00044042 C:WINDOWSAppPatchsysmain.sdb STATUS_SUCCESS
108 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF20F868 00000000 00000000 00000002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000060 Access: 0x00120089 Share: 0x00000007 Attrib: 0 Result: FILE_OPENED
109 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_LOCK FF20F868 E14B40D0 E1A40238 00040042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS
110 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_QUERY_STANDARD_INFO FF20F868 E14B40D0 E1A40238 00040042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS AllocationSize: 00000000-00000108 EndOfFile: 00000000-00000104 NumberOfLinks: 1 DeletePending: 0 Directory: 0
111 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_READ 00000900 No FF20F868 E14B40D0 E1A40238 00040042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS Offset 00000000-00000000 ToRead 104 Read 104
112 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_UNLOCK_SINGLE FF20F868 E14B40D0 E1A40238 000C0042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_RANGE_NOT_LOCKED
113 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF20F868 E14B40D0 E1A40238 000C0042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS
114 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF04D8F0 00000000 00000000 00000002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000060 Access: 0x00120089 Share: 0x00000007 Attrib: 0 Result: FILE_OPENED
115 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_LOCK FF04D8F0 E14B40D0 E14B4228 00040042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS
116 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_QUERY_STANDARD_INFO FF04D8F0 E14B40D0 E14B4228 00040042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS AllocationSize: 00000000-00000108 EndOfFile: 00000000-00000104 NumberOfLinks: 1 DeletePending: 0 Directory: 0
117 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_READ 00000900 No FF04D8F0 E14B40D0 E14B4228 00040042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS Offset 00000000-00000000 ToRead 104 Read 104
118 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_UNLOCK_SINGLE FF04D8F0 E14B40D0 E14B4228 000C0042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_RANGE_NOT_LOCKED
119 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF04D8F0 E14B40D0 E14B4228 000C0042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS
120 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLOSE 00000404 No FF04D8F0 E14B40D0 E14B4228 00044042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS
121 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CREATE 00000884 No FF04D8F0 00000000 00000000 00000002 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS FILE_OPEN CreOpts: 0x00000060 Access: 0x00120089 Share: 0x00000007 Attrib: 0 Result: FILE_OPENED
122 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_LOCK FF04D8F0 E14B40D0 E14B4228 00040042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS
123 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_QUERY_STANDARD_INFO FF04D8F0 E14B40D0 E14B4228 00040042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS AllocationSize: 00000000-00000108 EndOfFile: 00000000-00000104 NumberOfLinks: 1 DeletePending: 0 Directory: 0
124 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_READ 00000900 No FF04D8F0 E14B40D0 E14B4228 00040042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS Offset 00000000-00000000 ToRead 104 Read 104
125 12:30:20.453 0 ntvdm.exe 3928 FE887848 FASTIO_UNLOCK_SINGLE FF04D8F0 E14B40D0 E14B4228 000C0042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_RANGE_NOT_LOCKED
126 12:30:20.453 0 ntvdm.exe 3928 FE887848 FE9519A8 IRP_MJ_CLEANUP 00000404 No FF04D8F0 E14B40D0 E14B4228 000C0042 C:DOCUME~1ADMINI~1.POSMESDOC~1MESVID~1HOOKDUMPHookDump.ini STATUS_SUCCESS
127 12:30:20.453 0
Publicité