| / Cracking 2
/ Cracking II..iso / Tools / ApiHooks 2.2 / ApiHooks.exe
| < prev |
| MS-DOS/Windows or OS/2 Executable | 2000-04-11 | 4.0 KB |
MacOS 8.1
|
Win98
|
DOS
view JSON data
|
view as text| Confidence | Program | Detection | Match Type | Support |
|---|---|---|---|---|
| 100% | dexvert | LZEXE Packed (archive/lzexePacked) | magic | Supported |
| 100% | dexvert | MS-DOS/Windows or OS/2 Executable (executable/exe) | magic | Supported |
| 1% | dexvert | Ady's GLUE Packed (archive/adysGLUEPacked) | ext | Unsupported |
| 1% | dexvert | BlacK FiST Packed (archive/blackFiSTPacked) | ext | Unsupported |
| 1% | dexvert | CauseWay Compressor Packed (archive/causeWayCompressorPacked) | ext | Unsupported |
| 1% | dexvert | CExe compressed Win32 executable (archive/cExeCompressedWin32Executable) | ext | Unsupported |
| 1% | dexvert | cIPHATOR Protected (archive/ciphatorProtected) | ext | Unsupported |
| 1% | dexvert | CRYPACK Protected (archive/crypackProtected) | ext | Unsupported |
| 1% | dexvert | CRYPTEXE Proterctd (archive/cryptexeProtected) | ext | Unsupported |
| 1% | dexvert | Crypt Light Show Protected (archive/cryptLightShowProtected) | ext | Unsupported |
| 1% | dexvert | DaRKSToP Proterctd (archive/darkstopProtected) | ext | Unsupported |
| 1% | dexvert | DiskImager SFX Image (archive/diskImagerSFXImage) | ext | Unsupported |
| 1% | dexvert | DJP Packed (archive/djpPacked) | ext | Unsupported |
| 1% | dexvert | .NETZ Packed (archive/dotNETZPacked) | ext | Unsupported |
| 1% | dexvert | Exe32Pack Packed (archive/exe32PackPacked) | ext | Unsupported |
| 1% | dexvert | EXE Manager Protected (archive/exeManagerProtected) | ext | Unsupported |
| 1% | dexvert | EXETOOLS Protected (archive/exetoolsProtected) | ext | Unsupported |
| 1% | dexvert | EZip Packed (archive/ezipPacked) | ext | Unsupported |
| 1% | dexvert | FSG Packed (archive/fsgPacked) | ext | Unsupported |
| 1% | dexvert | HackStop Protected (archive/hackStopProtected) | ext | Unsupported |
| 1% | dexvert | kkrunchy Packed (archive/kkcrunchPacked) | ext | Unsupported |
| 1% | dexvert | mbp SHRINK Packed (archive/mbpSHRINKPacked) | ext | Unsupported |
| 1% | dexvert | MEGALITE Packed (archive/megalitePacked) | ext | Unsupported |
| 1% | dexvert | Mess Protected (archive/messProtected) | ext | Unsupported |
| 1% | dexvert | Mew Packed (archive/mewPacked) | ext | Unsupported |
| 1% | dexvert | MPRESS Packed (archive/mpressPacked) | ext | Unsupported |
| 1% | dexvert | NOS Packer Packed (archive/nosPackerPacked) | ext | Unsupported |
| 1% | dexvert | NTShell Protected (archive/ntShellProtected) | ext | Unsupported |
| 1% | dexvert | Pack MasterPacked (archive/packMasterPacked) | ext | Unsupported |
| 1% | dexvert | PE Diminisher Packed (archive/peDiminisherPacked) | ext | Unsupported |
| 1% | dexvert | Petite Packed (archive/petitePacked) | ext | Unsupported |
| 1% | dexvert | PeX Packed (archive/pexPacked) | ext | Unsupported |
| 1% | dexvert | PKLITE32 Packed (archive/pklite32Packed) | ext | Unsupported |
| 1% | dexvert | PowerBatch Packed (archive/powerBatchPacked) | ext | Unsupported |
| 1% | dexvert | protector Protected (archive/protectorProtected) | ext | Unsupported |
| 1% | dexvert | py2exe Packed (archive/py2exePacked) | ext | Unsupported |
| 1% | dexvert | PyInstaller Packed (archive/pyInstallerPacked) | ext | Unsupported |
| 1% | dexvert | SECURE Protected (archive/secureProtected) | ext | Unsupported |
| 1% | dexvert | Spoon Studio Packed (archive/spoonStudioPacked) | ext | Unsupported |
| 1% | dexvert | tElock Packed (archive/telockPacked) | ext | Unsupported |
| 1% | dexvert | The Builder Packed (archive/theBuilderPacked) | ext | Unsupported |
| 1% | dexvert | The Patcher Packed (archive/thePatcherPacked) | ext | Unsupported |
| 1% | dexvert | 32Lite Packed (archive/thirtyTwoLitePacked) | ext | Unsupported |
| 1% | dexvert | TinyProt Protected (archive/tinyProtProtected) | ext | Unsupported |
| 1% | dexvert | (Win)Upack Packed (archive/winUpackPacked) | ext | Unsupported |
| 1% | dexvert | Yoda's Crypte Protected (archive/yodasCrypterProtected) | ext | Unsupported |
| 1% | dexvert | MS-DOS PMODE extender executable (executable/msdosPMODEExtenderExecutable) | ext | Unsupported |
| 1% | dexvert | Sony Playstation Executable (executable/sonyPlaystationExe) | ext | Unsupported |
| 1% | dexvert | Novell Netware Virtual Loadable Module (other/novellNetwareVirtualLoadableModule) | ext | Unsupported |
| 100% | file | PE32 executable (GUI) Intel 80386, for MS Windows, 2 sections | default | |
| 99% | file | data | default | |
| 42% | TrID | Win32 Executable (generic) | default | |
| 19% | TrID | LZEXE compressed DOS executable (mod) | default | |
| 19% | TrID | Generic Win/DOS Executable | default | |
| 19% | TrID | DOS Executable Generic | default | |
| 100% | siegfried | x-fmt/411 Windows Portable Executable | default | |
| 100% | gt2 | Ist eine ausf�hrbare Win32 Datei | default | |
| 100% | binwalkID | Microsoft executable, portable (PE) | default | |
| 100% | xdgMime | application/vnd.microsoft.portable-executable | default (weak) |
+--------+-------------------------+-------------------------+--------+--------+
|00000000| 4d 5a 40 00 01 00 00 00 | 02 00 04 00 ff ff 02 00 |MZ@.....|........|
|00000010| 40 00 00 00 0e 00 00 00 | 1c 00 00 00 00 00 00 00 |@.......|........|
|00000020| 57 69 6e 33 32 20 6f 6e | 6c 79 21 0d 0a 24 0e b4 |Win32 on|ly!..$..|
|00000030| 09 ba 00 00 1f cd 21 b8 | 01 4c cd 21 40 00 00 00 |......!.|.L.!@...|
|00000040| 50 45 00 00 4c 01 02 00 | 5b 2a f3 38 00 00 00 00 |PE..L...|[*.8....|
|00000050| 00 00 00 00 e0 00 0f 01 | 0b 01 05 00 00 0e 00 00 |........|........|
|00000060| 00 08 00 00 00 00 00 00 | 0a 17 00 00 00 10 00 00 |........|........|
|00000070| 00 20 00 00 00 00 40 00 | 00 10 00 00 00 02 00 00 |. ....@.|........|
|00000080| 04 00 00 00 00 00 00 00 | 04 00 00 00 00 00 00 00 |........|........|
|00000090| 00 30 00 00 00 02 00 00 | 2d 9e 00 00 02 00 00 00 |.0......|-.......|
|000000a0| 00 00 10 00 00 10 00 00 | 00 00 10 00 00 10 00 00 |........|........|
|000000b0| 00 00 00 00 10 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000c0| 00 10 00 00 50 00 00 00 | 00 00 00 00 00 00 00 00 |....P...|........|
|000000d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000000f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000100| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000110| 00 00 00 00 00 00 00 00 | b0 10 00 00 60 00 00 00 |........|....`...|
|00000120| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000130| 00 00 00 00 00 00 00 00 | 20 00 00 00 00 00 00 00 |........| .......|
|00000140| 14 0d 00 00 00 10 00 00 | 00 0e 00 00 00 02 00 00 |........|........|
|00000150| 00 00 00 00 00 00 00 00 | 00 00 00 00 20 00 00 e0 |........|.... ...|
|00000160| 20 00 00 00 00 00 00 00 | 75 07 00 00 00 20 00 00 | .......|u.... ..|
|00000170| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000180| 00 00 00 00 40 00 00 c0 | 20 20 20 20 20 20 20 20 |....@...| |
|00000190| 68 74 74 70 3a 2f 2f 65 | 6c 69 63 7a 2e 63 6a 62 |http://e|licz.cjb|
|000001a0| 2e 6e 65 74 20 20 20 20 | 20 20 20 20 20 20 20 20 |.net | |
|000001b0| 68 74 74 70 3a 2f 2f 65 | 6c 69 63 7a 2e 74 73 78 |http://e|licz.tsx|
|000001c0| 2e 6f 72 67 20 20 20 20 | 20 20 20 20 20 20 20 20 |.org | |
|000001d0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001e0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|000001f0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000200| 50 10 00 00 00 00 00 00 | 00 00 00 00 28 12 00 00 |P.......|....(...|
|00000210| b0 10 00 00 98 10 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000220| 44 12 00 00 f8 10 00 00 | a0 10 00 00 00 00 00 00 |D.......|........|
|00000230| 00 00 00 00 8c 12 00 00 | 00 11 00 00 00 00 00 00 |........|........|
|00000240| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000250| 10 11 00 00 24 11 00 00 | 36 11 00 00 48 11 00 00 |....$...|6...H...|
|00000260| 64 11 00 00 78 11 00 00 | 84 11 00 00 96 11 00 00 |d...x...|........|
|00000270| a4 11 00 00 b4 11 00 00 | c2 11 00 00 d0 11 00 00 |........|........|
|00000280| e0 11 00 00 ee 11 00 00 | fa 11 00 00 0e 12 00 00 |........|........|
|00000290| 1c 12 00 00 00 00 00 00 | 36 12 00 00 00 00 00 00 |........|6.......|
|000002a0| 50 12 00 00 6c 12 00 00 | 7c 12 00 00 00 00 00 00 |P...l...||.......|
|000002b0| 10 11 00 00 24 11 00 00 | 36 11 00 00 48 11 00 00 |....$...|6...H...|
|000002c0| 64 11 00 00 78 11 00 00 | 84 11 00 00 96 11 00 00 |d...x...|........|
|000002d0| a4 11 00 00 b4 11 00 00 | c2 11 00 00 d0 11 00 00 |........|........|
|000002e0| e0 11 00 00 ee 11 00 00 | fa 11 00 00 0e 12 00 00 |........|........|
|000002f0| 1c 12 00 00 00 00 00 00 | 36 12 00 00 00 00 00 00 |........|6.......|
|00000300| 50 12 00 00 6c 12 00 00 | 7c 12 00 00 00 00 00 00 |P...l...||.......|
|00000310| 3a 01 47 65 74 4d 6f 64 | 75 6c 65 48 61 6e 64 6c |:.GetMod|uleHandl|
|00000320| 65 41 00 00 53 01 47 65 | 74 50 72 6f 63 41 64 64 |eA..S.Ge|tProcAdd|
|00000330| 72 65 73 73 00 00 da 00 | 47 65 74 43 6f 6d 6d 61 |ress....|GetComma|
|00000340| 6e 64 4c 69 6e 65 41 00 | 8f 00 45 78 70 61 6e 64 |ndLineA.|..Expand|
|00000350| 45 6e 76 69 72 6f 6e 6d | 65 6e 74 53 74 72 69 6e |Environm|entStrin|
|00000360| 67 73 41 00 29 01 47 65 | 74 46 75 6c 6c 50 61 74 |gsA.).Ge|tFullPat|
|00000370| 68 4e 61 6d 65 41 00 00 | 35 03 6c 73 74 72 6c 65 |hNameA..|5.lstrle|
|00000380| 6e 41 00 00 47 00 43 72 | 65 61 74 65 50 72 6f 63 |nA..G.Cr|eateProc|
|00000390| 65 73 73 41 00 00 1e 00 | 43 6c 6f 73 65 48 61 6e |essA....|CloseHan|
|000003a0| 64 6c 65 00 54 02 52 65 | 73 75 6d 65 54 68 72 65 |dle.T.Re|sumeThre|
|000003b0| 61 64 00 00 8c 00 45 78 | 69 74 50 72 6f 63 65 73 |ad....Ex|itProces|
|000003c0| 73 00 8e 01 47 65 74 56 | 65 72 73 69 6f 6e 00 00 |s...GetV|ersion..|
|000003d0| ee 02 56 69 72 74 75 61 | 6c 41 6c 6c 6f 63 00 00 |..Virtua|lAlloc..|
|000003e0| f1 02 56 69 72 74 75 61 | 6c 46 72 65 65 00 2d 03 |..Virtua|lFree.-.|
|000003f0| 6c 73 74 72 63 6d 70 69 | 57 00 40 02 52 65 61 64 |lstrcmpi|W.@.Read|
|00000400| 50 72 6f 63 65 73 73 4d | 65 6d 6f 72 79 00 11 02 |ProcessM|emory...|
|00000410| 4f 70 65 6e 50 72 6f 63 | 65 73 73 00 2c 03 6c 73 |OpenProc|ess.,.ls|
|00000420| 74 72 63 6d 70 69 41 00 | 4b 45 52 4e 45 4c 33 32 |trcmpiA.|KERNEL32|
|00000430| 2e 64 6c 6c 00 00 c3 01 | 4d 65 73 73 61 67 65 42 |.dll....|MessageB|
|00000440| 6f 78 41 00 55 53 45 52 | 33 32 2e 64 6c 6c 00 00 |oxA.USER|32.dll..|
|00000450| 02 00 45 73 74 61 62 6c | 69 73 68 41 70 69 48 6f |..Establ|ishApiHo|
|00000460| 6f 6b 73 54 69 6d 65 4e | 54 41 00 00 0a 00 4c 6f |oksTimeN|TA....Lo|
|00000470| 61 64 41 6e 64 43 61 6c | 6c 41 00 00 0e 00 55 6e |adAndCal|lA....Un|
|00000480| 6c 6f 61 64 4d 6f 64 75 | 6c 65 41 00 41 70 69 48 |loadModu|leA.ApiH|
|00000490| 6f 6f 6b 73 2e 64 6c 6c | 00 00 00 00 00 00 00 00 |ooks.dll|........|
|000004a0| e8 12 40 00 1b 13 40 00 | 2f 13 40 00 43 13 40 00 |..@...@.|/.@.C.@.|
|000004b0| 58 13 40 00 ba 13 40 00 | ce 13 40 00 28 16 40 00 |X.@...@.|..@.(.@.|
|000004c0| 3e 16 40 00 51 16 40 00 | 41 70 69 48 6f 6f 6b 73 |>.@.Q.@.|ApiHooks|
|000004d0| 20 66 6f 72 20 57 69 6e | 33 32 2c 20 76 65 72 73 | for Win|32, vers|
|000004e0| 69 6f 6e 20 32 2e 32 00 | 48 6f 6f 6b 73 20 65 73 |ion 2.2.|Hooks es|
|000004f0| 74 61 62 6c 69 73 68 65 | 64 2e 00 4d 6f 64 75 6c |tablishe|d..Modul|
|00000500| 65 20 6c 6f 61 64 65 64 | 2e 00 4d 6f 64 75 6c 65 |e loaded|..Module|
|00000510| 20 75 6e 6c 6f 61 64 65 | 64 2e 00 45 78 63 65 70 | unloade|d..Excep|
|00000520| 74 69 6f 6e 20 6f 63 63 | 75 72 72 65 64 21 00 43 |tion occ|urred!.C|
|00000530| 61 6e 27 74 20 6f 70 65 | 6e 20 70 72 6f 63 65 73 |an't ope|n proces|
|00000540| 73 21 00 52 65 6d 6f 74 | 65 20 41 6c 6c 6f 63 20 |s!.Remot|e Alloc |
|00000550| 66 61 69 6c 65 64 21 00 | 48 6f 6f 6b 73 20 63 61 |failed!.|Hooks ca|
|00000560| 6e 27 74 20 62 65 20 66 | 6f 75 6e 64 2c 0a 61 72 |n't be f|ound,.ar|
|00000570| 65 20 61 6c 72 65 61 64 | 79 20 70 72 65 73 65 6e |e alread|y presen|
|00000580| 74 0a 6f 72 20 61 72 65 | 20 69 6e 76 61 6c 69 64 |t.or are| invalid|
|00000590| 21 00 43 61 6e 27 74 20 | 6c 6f 61 64 20 6d 6f 64 |!.Can't |load mod|
|000005a0| 75 6c 65 21 00 4d 6f 64 | 75 6c 65 20 73 74 69 6c |ule!.Mod|ule stil|
|000005b0| 6c 20 6c 6f 61 64 65 64 | 21 00 52 65 6d 6f 74 65 |l loaded|!.Remote|
|000005c0| 20 46 72 65 65 20 66 61 | 69 6c 65 64 21 00 41 70 | Free fa|iled!.Ap|
|000005d0| 69 48 6f 6f 6b 73 20 3c | 2d 3e 3c 6e 20 7c 20 6f |iHooks <|-><n | o|
|000005e0| 20 7c 20 6c 20 7c 20 6d | 20 7c 20 75 3e 5b 71 20 | | l | m| | u>[q |
|000005f0| 7c 20 72 5d 20 3c 48 6f | 6f 6b 73 20 7c 20 4d 6f || r] <Ho|oks | Mo|
|00000600| 64 75 6c 65 3e 20 3c 54 | 61 72 67 65 74 20 7c 20 |dule> <T|arget | |
|00000610| 50 49 44 20 7c 20 41 4c | 4c 3e 20 5b 50 61 72 61 |PID | AL|L> [Para|
|00000620| 6d 65 74 65 72 73 5d 0a | 6e 20 3d 20 63 72 65 61 |meters].|n = crea|
|00000630| 74 65 20 6e 65 77 20 70 | 72 6f 63 65 73 73 20 61 |te new p|rocess a|
|00000640| 6e 64 20 61 70 70 6c 79 | 20 48 6f 6f 6b 73 20 20 |nd apply| Hooks |
|00000650| 6f 20 3d 20 6f 70 65 6e | 20 65 78 69 73 74 69 6e |o = open| existin|
|00000660| 67 20 70 72 6f 63 65 73 | 73 20 20 61 6e 64 20 61 |g proces|s and a|
|00000670| 70 70 6c 79 20 48 6f 6f | 6b 73 0a 6c 20 20 3d 20 |pply Hoo|ks.l = |
|00000680| 63 72 65 61 74 65 20 6e | 65 77 20 70 72 6f 63 65 |create n|ew proce|
|00000690| 73 73 20 61 6e 64 20 6c | 6f 61 64 20 4d 6f 64 75 |ss and l|oad Modu|
|000006a0| 6c 65 20 20 6d 20 3d 20 | 6f 70 65 6e 20 65 78 69 |le m = |open exi|
|000006b0| 73 74 69 6e 67 20 70 72 | 6f 63 65 73 73 20 20 61 |sting pr|ocess a|
|000006c0| 6e 64 20 6c 6f 61 64 20 | 4d 6f 64 75 6c 65 0a 75 |nd load |Module.u|
|000006d0| 20 3d 20 6f 70 65 6e 20 | 65 78 69 73 74 69 6e 67 | = open |existing|
|000006e0| 20 70 72 6f 63 65 73 73 | 20 20 61 6e 64 20 75 6e | process| and un|
|000006f0| 6c 6f 61 64 20 4d 6f 64 | 75 6c 65 0a 71 20 3d 20 |load Mod|ule.q = |
|00000700| 6e 6f 20 6d 73 67 20 62 | 6f 78 20 69 66 20 61 6c |no msg b|ox if al|
|00000710| 6c 20 77 65 6e 74 20 4f | 4b 20 20 20 72 20 3d 20 |l went O|K r = |
|00000720| 6e 6f 20 6d 73 67 20 62 | 6f 78 20 61 74 20 61 6c |no msg b|ox at al|
|00000730| 6c 0a 48 6f 6f 6b 73 20 | 3d 20 6d 6f 64 75 6c 65 |l.Hooks |= module|
|00000740| 20 63 6f 6e 74 61 69 6e | 69 6e 67 20 68 6f 6f 6b | contain|ing hook|
|00000750| 20 70 72 6f 63 65 64 75 | 72 65 73 20 20 20 4d 6f | procedu|res Mo|
|00000760| 64 75 6c 65 20 3d 20 6d | 6f 64 75 6c 65 20 74 6f |dule = m|odule to|
|00000770| 20 28 75 6e 29 6c 6f 61 | 64 0a 54 61 72 67 65 74 | (un)loa|d.Target|
|00000780| 20 3d 20 70 72 6f 63 65 | 73 73 20 77 68 65 72 65 | = proce|ss where|
|00000790| 20 74 6f 20 61 70 70 6c | 79 20 68 6f 6f 6b 73 20 | to appl|y hooks |
|000007a0| 20 20 50 49 44 20 3d 20 | 49 44 20 6f 66 20 54 61 | PID = |ID of Ta|
|000007b0| 72 67 65 74 20 70 72 6f | 63 65 73 73 20 61 73 20 |rget pro|cess as |
|000007c0| 30 78 20 68 65 78 61 64 | 65 63 69 6d 61 6c 20 6e |0x hexad|ecimal n|
|000007d0| 75 6d 62 65 72 0a 41 4c | 4c 20 3d 20 61 6c 6c 20 |umber.AL|L = all |
|000007e0| 70 72 6f 63 65 73 73 65 | 73 20 61 72 65 20 54 61 |processe|s are Ta|
|000007f0| 72 67 65 74 73 20 20 20 | 50 61 72 61 6d 65 74 65 |rgets |Paramete|
|00000800| 72 73 20 3d 20 63 6f 6d | 6d 61 6e 64 20 6c 69 6e |rs = com|mand lin|
|00000810| 65 20 70 61 72 61 6d 65 | 74 65 72 73 20 66 6f 72 |e parame|ters for|
|00000820| 20 54 61 72 67 65 74 00 | 43 61 6e 27 74 20 63 72 | Target.|Can't cr|
|00000830| 65 61 74 65 20 70 72 6f | 63 65 73 73 21 00 50 72 |eate pro|cess!.Pr|
|00000840| 6f 63 65 73 73 20 6e 6f | 74 20 66 6f 75 6e 64 21 |ocess no|t found!|
|00000850| 00 54 69 6d 65 20 6f 75 | 74 21 00 4b 45 52 4e 45 |.Time ou|t!.KERNE|
|00000860| 4c 33 32 2e 64 6c 6c 00 | 43 72 65 61 74 65 54 6f |L32.dll.|CreateTo|
|00000870| 6f 6c 68 65 6c 70 33 32 | 53 6e 61 70 73 68 6f 74 |olhelp32|Snapshot|
|00000880| 00 50 72 6f 63 65 73 73 | 33 32 46 69 72 73 74 00 |.Process|32First.|
|00000890| 50 72 6f 63 65 73 73 33 | 32 4e 65 78 74 00 4e 54 |Process3|2Next.NT|
|000008a0| 44 4c 4c 2e 64 6c 6c 00 | 4e 74 51 75 65 72 79 49 |DLL.dll.|NtQueryI|
|000008b0| 6e 66 6f 72 6d 61 74 69 | 6f 6e 50 72 6f 63 65 73 |nformati|onProces|
|000008c0| 73 00 4e 74 51 75 65 72 | 79 53 79 73 74 65 6d 49 |s.NtQuer|ySystemI|
|000008d0| 6e 66 6f 72 6d 61 74 69 | 6f 6e 00 57 33 c0 b1 22 |nformati|on.W3.."|
|000008e0| 88 07 ac 84 c0 74 21 38 | c8 74 03 4e b1 20 ac aa |.....t!8|.t.N. ..|
|000008f0| 84 c0 74 11 38 c8 75 f6 | c6 47 ff 00 ac 84 c0 74 |..t.8.u.|.G.....t|
|00000900| 04 3c 20 76 f7 b0 01 4e | 5f c3 8b 35 b0 10 40 00 |.< v...N|_..5..@.|
|00000910| 8b 3d b4 10 40 00 68 9e | 16 40 00 ff d6 8b d8 68 |.=..@.h.|.@.....h|
|00000920| a8 16 40 00 53 ff d7 a3 | 0c 20 40 00 68 c2 16 40 |..@.S...|. @.h..@|
|00000930| 00 53 ff d7 a3 10 20 40 | 00 68 5b 16 40 00 ff d6 |.S.... @|.h[.@...|
|00000940| 8b d8 68 68 16 40 00 53 | ff d7 a3 00 20 40 00 68 |..hh.@.S|.... @.h|
|00000950| 81 16 40 00 53 ff d7 a3 | 04 20 40 00 68 90 16 40 |..@.S...|. @.h..@|
|00000960| 00 53 ff d7 a3 08 20 40 | 00 fc ff 15 b8 10 40 00 |.S.... @|......@.|
|00000970| 8b f0 bf 70 26 40 00 e8 | 5f ff ff ff 85 c0 74 2e |...p&@..|_.....t.|
|00000980| e8 56 ff ff ff 85 c0 74 | 25 8b 1f e8 4b ff ff ff |.V.....t|%...K...|
|00000990| 85 c0 74 1a 8b ee 68 04 | 01 00 00 68 68 24 40 00 |..t...h.|...hh$@.|
|000009a0| 57 ff 15 bc 10 40 00 e8 | 2f ff ff ff 85 c0 0f 84 |W....@..|/.......|
|000009b0| 30 01 00 00 68 04 01 00 | 00 68 6c 25 40 00 57 ff |0...h...|.hl%@.W.|
|000009c0| 15 bc 10 40 00 e8 11 ff | ff ff 0f 94 05 74 27 40 |...@....|.....t'@|
|000009d0| 00 bf 68 24 40 00 8b c3 | 0d 20 20 20 20 8b c8 c1 |..h$@...|. ...|
|000009e0| e9 10 80 f9 71 74 0c 80 | f9 72 75 0e c6 05 ac 19 |....qt..|.ru.....|
|000009f0| 40 00 eb c6 05 ad 19 40 | 00 10 3c 2d 0f 85 e2 00 |@......@|..<-....|
|00000a00| 00 00 c1 e8 08 3c 6e 0f | 84 df 00 00 00 3c 6f 74 |.....<n.|.....<ot|
|00000a10| 4a c6 05 59 19 40 00 11 | c7 05 a0 12 40 00 fb 12 |J..Y.@..|....@...|
|00000a20| 40 00 c7 05 b0 12 40 00 | 92 13 40 00 3c 6c 0f 84 |@.....@.|..@.<l..|
|00000a30| b8 00 00 00 3c 6d 74 23 | c6 05 59 19 40 00 2c c7 |....<mt#|..Y.@.,.|
|00000a40| 05 a0 12 40 00 0a 13 40 | 00 c7 05 b0 12 40 00 a5 |...@...@|.....@..|
|00000a50| 13 40 00 3c 75 0f 85 89 | 00 00 00 50 6a 08 2b d2 |.@.<u...|...Pj.+.|
|00000a60| 66 b8 00 20 be 6c 25 40 | 00 0b 06 59 66 3d 30 78 |f.. .l%@|...Yf=0x|
|00000a70| 75 19 66 ad ac 2c 30 7c | 0f 3c 09 7e 04 24 df 2c |u.f..,0||.<.~.$.,|
|00000a80| 07 c1 e2 04 0a d0 e2 ec | 59 eb 28 81 3e 41 4c 4c |........|Y.(.>ALL|
|00000a90| 00 75 0b e8 c0 03 00 00 | 40 74 0c 59 eb 22 56 e8 |.u......|@t.Y."V.|
|00000aa0| 44 01 00 00 83 f8 ff 6a | 08 8b d0 58 59 0f 84 ef |D......j|...XY...|
|00000ab0| 00 00 00 89 15 14 20 40 | 00 83 0d 18 20 40 00 ff |...... @|.... @..|
|00000ac0| 80 f9 6f 75 7e 8b cf 41 | 8a 01 3c 5c 74 14 3c 00 |..ou~..A|..<\t.<.|
|00000ad0| 75 f5 50 54 57 68 04 01 | 00 00 57 ff 15 c0 10 40 |u.PTWh..|..W....@|
|00000ae0| 00 58 eb 5f 6a 06 58 e9 | b6 00 00 00 80 3d 74 27 |.X._j.X.|.....=t'|
|00000af0| 40 00 00 74 12 bd 6c 25 | 40 00 55 ff 15 c4 10 40 |@..t..l%|@.U....@|
|00000b00| 00 66 c7 04 28 20 00 c6 | 05 14 24 40 00 44 2b db |.f..( ..|..$@.D+.|
|00000b10| 68 58 24 40 00 68 14 24 | 40 00 53 53 6a 14 53 53 |hX$@.h.$|@.SSj.SS|
|00000b20| 53 55 53 ff 15 c8 10 40 | 00 85 c0 6a 07 58 74 72 |SUS....@|...j.Xtr|
|00000b30| ff 35 60 24 40 00 83 0d | 18 20 40 00 ff 8f 05 14 |.5`$@...|. @.....|
|00000b40| 20 40 00 be 14 20 40 00 | 2b c0 8b c8 ad 40 91 74 | @... @.|+....@.t|
|00000b50| 51 49 6a 00 6a 01 51 57 | eb 00 c7 44 24 08 10 27 |QIj.j.QW|...D$..'|
|00000b60| 00 00 ff 15 00 11 40 00 | 59 eb df ff 15 04 11 40 |......@.|Y......@|
|00000b70| 00 8b c8 6a 00 83 f9 09 | 58 77 cf 6a 04 85 c9 58 |...j....|Xw.j...X|
|00000b80| 74 c8 8b c1 eb c4 ff 15 | 08 11 40 00 5a 8b c8 6a |t.......|..@.Z..j|
|00000b90| 04 83 f9 09 58 77 b3 6a | 00 85 c9 58 74 ac 8b c1 |....Xw.j|...Xt...|
|00000ba0| eb a8 50 8b 14 85 a0 12 | 40 00 85 c0 74 00 6a 00 |..P.....|@...t.j.|
|00000bb0| 68 c8 12 40 00 52 6a 00 | ff 15 f8 10 40 00 8b 1d |h..@.Rj.|....@...|
|00000bc0| 5c 24 40 00 85 db 74 1a | ff 35 58 24 40 00 ff 15 |\$@...t.|.5X$@...|
|00000bd0| cc 10 40 00 53 ff 15 d0 | 10 40 00 53 ff 15 cc 10 |..@.S...|.@.S....|
|00000be0| 40 00 ff 15 d4 10 40 00 | 55 8b ec 81 c4 60 f8 ff |@.....@.|U....`..|
|00000bf0| ff 53 56 57 8b 45 08 89 | 45 fc 8d bd 68 fa ff ff |.SVW.E..|E...h...|
|00000c00| 8b 75 08 33 c0 89 7d b4 | ac 66 ab 3c 5c 75 06 89 |.u.3..}.|.f.<\u..|
|00000c10| 7d b4 89 75 fc 84 c0 75 | ef ff 15 d8 10 40 00 85 |}..u...u|.....@..|
|00000c20| c0 0f 88 b6 01 00 00 3c | 04 76 0c 8b 4d fc 3b 4d |.......<|.v..M.;M|
|00000c30| 08 0f 84 a6 01 00 00 bb | 00 50 00 00 6a 40 68 00 |........|.P..j@h.|
|00000c40| 10 00 00 53 6a 00 ff 15 | dc 10 40 00 85 c0 0f 84 |...Sj...|..@.....|
|00000c50| 84 01 00 00 8b f0 6a 00 | 53 56 6a 05 ff 15 10 20 |......j.|SVj.... |
|00000c60| 40 00 3d 04 00 00 c0 75 | 16 68 00 80 00 00 6a 00 |@.=....u|.h....j.|
|00000c70| 56 ff 15 e0 10 40 00 81 | c3 00 10 00 00 eb bd 2b |V....@..|.......+|
|00000c80| ff 85 c0 7c 3b 8b de eb | 07 83 3b 00 74 32 03 1b |...|;...|..;.t2..|
|00000c90| 8b 53 3c 0f b7 4b 38 85 | d2 74 ee 66 83 24 11 00 |.S<..K8.|.t.f.$..|
|00000ca0| ff 75 b4 52 ff 15 e4 10 | 40 00 85 c0 75 db 83 ff |.u.R....|@...u...|
|00000cb0| 7f 73 0d ff 73 44 8f 84 | bd 70 fc ff ff 47 eb c9 |.s..sD..|.p...G..|
|00000cc0| 68 00 80 00 00 6a 00 56 | ff 15 e0 10 40 00 85 ff |h....j.V|....@...|
|00000cd0| 0f 84 02 01 00 00 8b 4d | b4 8d 95 68 fa ff ff 8b |.......M|...h....|
|00000ce0| 84 bd 6c fc ff ff 3b ca | 0f 84 ed 00 00 00 8b 1d |..l...;.|........|
|00000cf0| e8 10 40 00 4f 0f 8c dd | 00 00 00 ff b4 bd 70 fc |..@.O...|......p.|
|00000d00| ff ff 6a 00 68 10 04 00 | 00 ff 15 ec 10 40 00 85 |..j.h...|.....@..|
|00000d10| c0 74 e1 6a ff 8b f0 8d | 4d 94 6a 00 6a 18 51 6a |.t.j....|M.j.j.Qj|
|00000d20| 00 56 ff 15 0c 20 40 00 | 85 c0 0f 8c 96 00 00 00 |.V... @.|........|
|00000d30| 8b 45 98 51 51 8b d4 83 | c0 08 6a 00 6a 08 52 50 |.E.QQ...|..j.j.RP|
|00000d40| 56 ff d3 85 c0 58 59 74 | 7d 85 c9 74 79 83 c1 14 |V....XYt|}..ty...|
|00000d50| 89 45 b0 8d 55 ac 6a 00 | 6a 04 52 51 56 ff d3 85 |.E..U.j.|j.RQV...|
|00000d60| c0 74 63 8b 45 ac eb 05 | 3b 45 ac 74 59 8d 55 b8 |.tc.E...|;E.tY.U.|
|00000d70| 83 e8 08 6a 00 6a 44 52 | 50 56 ff d3 85 c0 74 46 |...j.jDR|PV....tF|
|00000d80| 8b 4d b0 8b 45 c0 3b 4d | d0 75 dd 8d 95 60 f8 ff |.M..E.;M|.u...`..|
|00000d90| ff 0f b7 4d dc 52 51 6a | 00 51 52 ff 75 e0 56 ff |...M.RQj|.QR.u.V.|
|00000da0| d3 85 c0 59 5a 74 1f 8d | 85 68 fa ff ff 66 83 24 |...YZt..|.h...f.$|
|00000db0| 11 00 50 52 ff 15 e4 10 | 40 00 85 c0 75 08 59 ff |..PR....|@...u.Y.|
|00000dc0| b4 bd 70 fc ff ff 56 ff | 15 cc 10 40 00 58 83 f8 |..p...V.|...@.X..|
|00000dd0| ff 75 08 e9 1c ff ff ff | 83 c8 ff eb 74 83 cf ff |.u......|....t...|
|00000de0| 8d b5 6c fe ff ff 6a 00 | 6a 02 ff 15 00 20 40 00 |..l...j.|j.... @.|
|00000df0| 8b d8 3b c7 74 5b c7 06 | 28 01 00 00 56 53 ff 15 |..;.t[..|(...VS..|
|00000e00| 04 20 40 00 85 c0 74 40 | 8d 46 24 8b 4d fc 8b d0 |. @...t@|.F$.M...|
|00000e10| 3b 4d 08 74 05 8b 4d 08 | eb 12 80 38 00 74 0d 80 |;M.t..M.|...8.t..|
|00000e20| 38 5c 74 03 40 eb f3 40 | 8b d0 eb ee 51 52 ff 15 |8\t.@..@|....QR..|
|00000e30| f0 10 40 00 85 c0 75 06 | 8b bd 74 fe ff ff 56 53 |..@...u.|..t...VS|
|00000e40| ff 15 08 20 40 00 eb bc | 53 ff 15 cc 10 40 00 8b |... @...|S....@..|
|00000e50| c7 5f 5e 5b c9 c2 04 00 | 55 8b ec 81 c4 d8 fe ff |._^[....|U.......|
|00000e60| ff 53 56 57 bf 14 20 40 | 00 ff 15 d8 10 40 00 85 |.SVW.. @|.....@..|
|00000e70| c0 78 5b bb 00 50 00 00 | 6a 40 68 00 10 00 00 53 |.x[..P..|j@h....S|
|00000e80| 6a 00 ff 15 dc 10 40 00 | 8b f0 48 7c 29 6a 00 53 |j.....@.|..H|)j.S|
|00000e90| 56 6a 05 ff 15 10 20 40 | 00 3d 04 00 00 c0 75 16 |Vj.... @|.=....u.|
|00000ea0| 68 00 80 00 00 6a 00 56 | ff 15 e0 10 40 00 81 c3 |h....j.V|....@...|
|00000eb0| 00 10 00 00 eb c2 6a ff | 85 c0 58 7c 4f 8b de eb |......j.|..X|O...|
|00000ec0| 07 83 3b 00 74 46 03 1b | 8b 43 44 ab eb f3 8d b5 |..;.tF..|.CD.....|
|00000ed0| d8 fe ff ff 6a 00 6a 02 | ff 15 00 20 40 00 8b d8 |....j.j.|... @...|
|00000ee0| 83 f8 ff 74 27 c7 85 d8 | fe ff ff 28 01 00 00 56 |...t'...|...(...V|
|00000ef0| 53 ff 15 04 20 40 00 85 | c0 74 11 8b 85 e0 fe ff |S... @..|.t......|
|00000f00| ff ab 56 53 ff 15 08 20 | 40 00 eb eb 83 0f ff 5f |..VS... |@......_|
|00000f10| 5e 5b c9 c3 00 00 00 00 | 00 00 00 00 00 00 00 00 |^[......|........|
|00000f20| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000f30| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000f40| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000f50| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000f60| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000f70| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000f80| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000f90| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000fa0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000fb0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000fc0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000fd0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000fe0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
|00000ff0| 00 00 00 00 00 00 00 00 | 00 00 00 00 00 00 00 00 |........|........|
+--------+-------------------------+-------------------------+--------+--------+