fb4077e5...1834

Monitored Processes

Process Overview

ID	PID	Monitor Reason	Integrity Level	Image Name	Command Line	Origin ID
#1	0xf04	Analysis Target	High (Elevated)	clifind.log.exe	"C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe"	-
#2	0xc34	Child Process	High (Elevated)	explorer.exe	C:\Windows\SysWOW64\explorer.exe	#1

Behavior Information - Sequential View

Process #1: clifind.log.exe

1423

Information	Value
ID	#1
File Name	c:\users\ciihmnxmn6ps\desktop\clifind.log.exe
Command Line	"C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe"
Initial Working Directory	C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor	Start Time: 00:00:35, Reason: Analysis Target
Unmonitor	End Time: 00:01:07, Reason: Self Terminated
Monitor Duration	00:00:32

OS Process Information

Information	Value
PID	0xf04
Parent PID	0x508 (c:\windows\explorer.exe)
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x F08 0x F0C 0x F10 0x FE4

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000010000	0x00010000	0x0002ffff	Private Memory	rw	-
pagefile_0x0000000000010000	0x00010000	0x0001ffff	Pagefile Backed Memory	rw	-
private_0x0000000000020000	0x00020000	0x00023fff	Private Memory	rw	-
private_0x0000000000030000	0x00030000	0x00030fff	Private Memory	rw	-
pagefile_0x0000000000040000	0x00040000	0x00053fff	Pagefile Backed Memory	r	-
private_0x0000000000060000	0x00060000	0x0009ffff	Private Memory	rw	-
display.pnf	0x00060000	0x00061fff	Memory Mapped File	r	-
pagefile_0x0000000000060000	0x00060000	0x00070fff	Pagefile Backed Memory	rw	-
private_0x0000000000080000	0x00080000	0x00080fff	Private Memory	rw	-
private_0x00000000000a0000	0x000a0000	0x0019ffff	Private Memory	rw	-
pagefile_0x00000000001a0000	0x001a0000	0x001a3fff	Pagefile Backed Memory	r	-
pagefile_0x00000000001b0000	0x001b0000	0x001b0fff	Pagefile Backed Memory	r	-
private_0x00000000001c0000	0x001c0000	0x001c1fff	Private Memory	rw	-
locale.nls	0x001d0000	0x0028dfff	Memory Mapped File	r	-
private_0x0000000000290000	0x00290000	0x002cffff	Private Memory	rw	-
private_0x00000000002d0000	0x002d0000	0x002dffff	Private Memory	rw	-
private_0x00000000002e0000	0x002e0000	0x003dffff	Private Memory	rw	-
private_0x00000000003e0000	0x003e0000	0x003e0fff	Private Memory	rw	-
private_0x00000000003f0000	0x003f0000	0x003f3fff	Private Memory	rw	-
clifind.log.exe	0x00400000	0x00449fff	Memory Mapped File	rwx	... Region Actions Download Dump Show YARA Matches
private_0x0000000000450000	0x00450000	0x0048ffff	Private Memory	rw	-
oleaccrc.dll	0x00490000	0x00491fff	Memory Mapped File	r	-
private_0x00000000004a0000	0x004a0000	0x004acfff	Private Memory	rwx	-
private_0x00000000004b0000	0x004b0000	0x004bffff	Private Memory	rw	-
private_0x00000000004b0000	0x004b0000	0x004c5fff	Private Memory	rw	-
pagefile_0x00000000004b0000	0x004b0000	0x004b4fff	Pagefile Backed Memory	rw	-
private_0x00000000004b0000	0x004b0000	0x004b0fff	Private Memory	rwx	-
private_0x00000000004b0000	0x004b0000	0x004effff	Private Memory	rw	-
pagefile_0x00000000004d0000	0x004d0000	0x004d4fff	Pagefile Backed Memory	rw	-
private_0x0000000000510000	0x00510000	0x0051ffff	Private Memory	rw	-
private_0x0000000000580000	0x00580000	0x0067ffff	Private Memory	rw	-
private_0x0000000000680000	0x00680000	0x0077ffff	Private Memory	rw	-
pagefile_0x0000000000780000	0x00780000	0x00907fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000910000	0x00910000	0x00a90fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000aa0000	0x00aa0000	0x01e9ffff	Pagefile Backed Memory	r	-
private_0x0000000001ea0000	0x01ea0000	0x01faffff	Private Memory	rw	-
private_0x0000000001ea0000	0x01ea0000	0x01f1ffff	Private Memory	rw	-
private_0x0000000001fa0000	0x01fa0000	0x01faffff	Private Memory	rw	-
private_0x0000000002030000	0x02030000	0x0203ffff	Private Memory	rw	-
sortdefault.nls	0x02040000	0x02376fff	Memory Mapped File	r	-
private_0x0000000002380000	0x02380000	0x0253ffff	Private Memory	rw	-
private_0x0000000002380000	0x02380000	0x0247ffff	Private Memory	rw	-
private_0x0000000002530000	0x02530000	0x0253ffff	Private Memory	rw	-
private_0x0000000002540000	0x02540000	0x0263ffff	Private Memory	rw	-
private_0x0000000002640000	0x02640000	0x0273ffff	Private Memory	rw	-
private_0x0000000002740000	0x02740000	0x0283ffff	Private Memory	rw	-
wow64cpu.dll	0x64ae0000	0x64ae7fff	Memory Mapped File	rwx	-
wow64win.dll	0x64af0000	0x64b62fff	Memory Mapped File	rwx	-
wow64.dll	0x64b70000	0x64bbefff	Memory Mapped File	rwx	-
winsta.dll	0x740b0000	0x740f3fff	Memory Mapped File	rwx	-
userenv.dll	0x74100000	0x74118fff	Memory Mapped File	rwx	-
rsaenh.dll	0x74120000	0x7414efff	Memory Mapped File	rwx	-
cryptsp.dll	0x74150000	0x74162fff	Memory Mapped File	rwx	-
dciman32.dll	0x74170000	0x74176fff	Memory Mapped File	rwx	-
ddraw.dll	0x74180000	0x7426afff	Memory Mapped File	rwx	-
glu32.dll	0x74270000	0x74294fff	Memory Mapped File	rwx	-
devobj.dll	0x742a0000	0x742c0fff	Memory Mapped File	rwx	-
winmmbase.dll	0x742d0000	0x742f2fff	Memory Mapped File	rwx	-
opengl32.dll	0x74300000	0x743dffff	Memory Mapped File	rwx	-
iertutil.dll	0x743e0000	0x746a0fff	Memory Mapped File	rwx	-
bcrypt.dll	0x746b0000	0x746cafff	Memory Mapped File	rwx	-
oleacc.dll	0x746d0000	0x74722fff	Memory Mapped File	rwx	-
msacm32.dll	0x74730000	0x74747fff	Memory Mapped File	rwx	-
urlmon.dll	0x74750000	0x748affff	Memory Mapped File	rwx	-
version.dll	0x748b0000	0x748b7fff	Memory Mapped File	rwx	-
wininet.dll	0x748c0000	0x74ae3fff	Memory Mapped File	rwx	-
comctl32.dll	0x74af0000	0x74b81fff	Memory Mapped File	rwx	-
winspool.drv	0x74b90000	0x74bf6fff	Memory Mapped File	rwx	-
uxtheme.dll	0x74c20000	0x74c94fff	Memory Mapped File	rwx	-
apphelp.dll	0x74ca0000	0x74d30fff	Memory Mapped File	rwx	-
bcryptprimitives.dll	0x74d40000	0x74d98fff	Memory Mapped File	rwx	-
cryptbase.dll	0x74da0000	0x74da9fff	Memory Mapped File	rwx	-
sspicli.dll	0x74db0000	0x74dcdfff	Memory Mapped File	rwx	-
kernelbase.dll	0x74e70000	0x74fe5fff	Memory Mapped File	rwx	-
cfgmgr32.dll	0x75220000	0x75255fff	Memory Mapped File	rwx	-
kernel32.dll	0x75260000	0x7534ffff	Memory Mapped File	rwx	-
powrprof.dll	0x753b0000	0x753f3fff	Memory Mapped File	rwx	-
imm32.dll	0x75400000	0x7542afff	Memory Mapped File	rwx	-
shell32.dll	0x75430000	0x767eefff	Memory Mapped File	rwx	-
profapi.dll	0x76810000	0x7681efff	Memory Mapped File	rwx	-
ole32.dll	0x768b0000	0x76999fff	Memory Mapped File	rwx	-
advapi32.dll	0x76a10000	0x76a8afff	Memory Mapped File	rwx	-
setupapi.dll	0x76a90000	0x76c34fff	Memory Mapped File	rwx	-
sechost.dll	0x76c40000	0x76c82fff	Memory Mapped File	rwx	-
oleaut32.dll	0x76c90000	0x76d21fff	Memory Mapped File	rwx	-
msasn1.dll	0x76d30000	0x76d3dfff	Memory Mapped File	rwx	-
wintrust.dll	0x76d40000	0x76d81fff	Memory Mapped File	rwx	-
rpcrt4.dll	0x76d90000	0x76e3bfff	Memory Mapped File	rwx	-
combase.dll	0x76e40000	0x76ff9fff	Memory Mapped File	rwx	-
gdi32.dll	0x77000000	0x7714cfff	Memory Mapped File	rwx	-
user32.dll	0x77150000	0x7728ffff	Memory Mapped File	rwx	-
shlwapi.dll	0x77290000	0x772d3fff	Memory Mapped File	rwx	-
shcore.dll	0x77340000	0x773ccfff	Memory Mapped File	rwx	-
psapi.dll	0x773d0000	0x773d5fff	Memory Mapped File	rwx	-
windows.storage.dll	0x773f0000	0x778ccfff	Memory Mapped File	rwx	-
msctf.dll	0x778d0000	0x779effff	Memory Mapped File	rwx	-
msvcrt.dll	0x779f0000	0x77aadfff	Memory Mapped File	rwx	-
crypt32.dll	0x77ab0000	0x77c24fff	Memory Mapped File	rwx	-
kernel.appcore.dll	0x77c30000	0x77c3bfff	Memory Mapped File	rwx	-
ntdll.dll	0x77ca0000	0x77e18fff	Memory Mapped File	rwx	-
private_0x000000007fe4d000	0x7fe4d000	0x7fe4ffff	Private Memory	rw	-
private_0x000000007fe50000	0x7fe50000	0x7feaffff	Private Memory	rw	-
pagefile_0x000000007feb0000	0x7feb0000	0x7ffaffff	Pagefile Backed Memory	r	-
pagefile_0x000000007ffb0000	0x7ffb0000	0x7ffd2fff	Pagefile Backed Memory	r	-
private_0x000000007ffd5000	0x7ffd5000	0x7ffd7fff	Private Memory	rw	-
private_0x000000007ffd8000	0x7ffd8000	0x7ffdafff	Private Memory	rw	-
private_0x000000007ffdb000	0x7ffdb000	0x7ffddfff	Private Memory	rw	-
private_0x000000007ffde000	0x7ffde000	0x7ffdefff	Private Memory	rw	-
private_0x000000007ffdf000	0x7ffdf000	0x7ffdffff	Private Memory	rw	-
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	r	-
private_0x000000007fff0000	0x7fff0000	0x7ff8ee37ffff	Private Memory	r	-
ntdll.dll	0x7ff8ee380000	0x7ff8ee541fff	Memory Mapped File	rwx	-
private_0x00007ff8ee542000	0x7ff8ee542000	0x7ffffffeffff	Private Memory	r	-

Threads

Thread 0xf08

1335

Category	Operation	Information	Count	Logfile
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75260000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsAlloc, address_out = 0x7527a330	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsGetValue, address_out = 0x75277580	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsSetValue, address_out = 0x75279910	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = FlsFree, address_out = 0x7527f400	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75260000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77cff190	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75260000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77cff190	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75260000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77cff190	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75260000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77cff190	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75260000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77cff190	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75260000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77cff190	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75260000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77cff190	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75260000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77cfa200	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75260000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77cfa200	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75260000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = EncodePointer, address_out = 0x77cff190	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = DecodePointer, address_out = 0x77cfa200	1	Fn
File	Open	filename = STD_INPUT_HANDLE	1	Fn
File	Open	filename = STD_OUTPUT_HANDLE	1	Fn
File	Open	filename = STD_ERROR_HANDLE	1	Fn
Environment	Get Environment String	-	1	Fn Data
Module	Get Filename	process_name = c:\users\ciihmnxmn6ps\desktop\clifind.log.exe, file_name_orig = C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe, size = 260	1	Fn
Module	Get Handle	module_name = c:\windows\syswow64\kernel32.dll, base_address = 0x75260000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\kernel32.dll, function = IsProcessorFeaturePresent, address_out = 0x75279680	1	Fn
Keyboard	Get Info	type = KB_CODEPAGE, result_out = 437	1	Fn
Module	Get Filename	process_name = c:\users\ciihmnxmn6ps\desktop\clifind.log.exe, file_name_orig = C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe, size = 260	1	Fn
File	Delete	filename = _U_clifind.log.exe	1	Fn
File	Create	filename = CONOUT$, desired_access = GENERIC_WRITE, GENERIC_READ, share_mode = FILE_SHARE_READ, FILE_SHARE_WRITE	1	Fn
Module	Get Filename	process_name = c:\users\ciihmnxmn6ps\desktop\clifind.log.exe, file_name_orig = C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe, size = 260	1	Fn
File	Read	filename = STD_ERROR_HANDLE, size = 0	1	Fn
System	Get Cursor	x_out = 1099, y_out = 854	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
File	Open	-	2	Fn
File	Create Pipe	pipe_name = Anonymous read pipe, size = 0	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:31 (UTC)	1	Fn
System	Sleep	duration = 0 milliseconds (0.000 seconds)	1	Fn
For performance reasons, the remaining 78 entries are omitted. The remaining entries can be found in glog.xml.

Thread 0xfe4

Category	Operation	Information	Count	Logfile
System	Get Computer Name	result_out = LHNIWSJ	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = InstallDate, data = 65	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\F57916AF, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\F57916AF, desired_access = GENERIC_READ	1	Fn
System	Get Computer Name	result_out = LHNIWSJ	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = InstallDate, data = 65	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\FA6AEE10, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\FA6AEE10, desired_access = GENERIC_READ	1	Fn
Module	Get Handle	module_name = sbiedll.dll, base_address = 0x0	1	Fn
System	Get Computer Name	result_out = LHNIWSJ	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = InstallDate, data = 65	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\FA6AEE10, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\FA6AEE10, desired_access = GENERIC_READ	1	Fn
System	Get Time	type = Ticks, time = 134906	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	1	Fn
System	Get Time	type = Ticks, time = 135437	1	Fn
System	Get Computer Name	result_out = LHNIWSJ	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = InstallDate, data = 65	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\FA6AEE10, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\FA6AEE10, desired_access = GENERIC_READ	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\HARDWARE\Description\System	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\HARDWARE\Description\System, value_name = VideoBiosVersion, data = 0	1	Fn
System	Get Computer Name	result_out = LHNIWSJ	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = InstallDate, data = 65	1	Fn
System	Get Info	type = Operating System	1	Fn
System	Get Info	type = Operating System	1	Fn
System	Get Computer Name	result_out = LHNIWSJ	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = InstallDate, data = 65	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\FA6AEE10, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\FA6AEE10, desired_access = GENERIC_READ	1	Fn
Module	Load	module_name = setupapi, base_address = 0x76a90000	1	Fn
Module	Get Filename	module_name = sbiedll.dll, process_name = c:\users\ciihmnxmn6ps\desktop\clifind.log.exe, file_name_orig = C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe, size = 501	1	Fn
Mutex	Open	mutex_name = Global\UzFCA0D558, desired_access = SYNCHRONIZE	1	Fn
System	Get Computer Name	result_out = LHNIWSJ	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = InstallDate, data = 65	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\FA6AEE10, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\FA6AEE10, desired_access = GENERIC_READ	1	Fn
Debug	Check for Presence	c:\users\ciihmnxmn6ps\desktop\clifind.log.exe	1	Fn
Module	Get Filename	module_name = sbiedll.dll, process_name = c:\users\ciihmnxmn6ps\desktop\clifind.log.exe, file_name_orig = C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe, size = 259	1	Fn
File	Create	filename = C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
File	Read	filename = C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe, size = 64, size_out = 64	1	Fn Data
File	Read	filename = C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe, size = 20, size_out = 20	1	Fn Data
System	Get Cursor	x_out = 1099, y_out = 854	1	Fn
System	Get Computer Name	result_out = LHNIWSJ	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = InstallDate, data = 65	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\FA6AEE10, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
File	Create	filename = C:\Users\CIIHMN~1\AppData\Local\Temp\FA6AEE10, desired_access = GENERIC_READ	1	Fn
System	Sleep	duration = 500 milliseconds (0.500 seconds)	10	Fn
System	Get Info	type = Windows Directory, result_out = C:\Windows	1	Fn
Module	Get Handle	module_name = c:\users\ciihmnxmn6ps\desktop\clifind.log.exe, base_address = 0x400000	1	Fn
Process	Create	process_name = C:\Windows\SysWOW64\explorer.exe, os_pid = 0xc34, creation_flags = CREATE_SUSPENDED, show_window = SW_HIDE	1	Fn
Module	Create Mapping	filename = System Paging File, protection = PAGE_READWRITE, maximum_size = 65592	1	Fn
Module	Map	process_name = c:\users\ciihmnxmn6ps\desktop\clifind.log.exe, desired_access = FILE_MAP_ALL_ACCESS	1	Fn
Process	Get Info	type = PROCESS_BASIC_INFORMATION	1	Fn
Memory	Read	process_name = C:\Windows\SysWOW64\explorer.exe, address = 0x7f503008, size = 4	1	Fn Data
Memory	Read	process_name = C:\Windows\SysWOW64\explorer.exe, address = 0x9d0000, size = 4096	1	Fn Data
Memory	Read	process_name = C:\Windows\SysWOW64\explorer.exe, address = 0x9d00e8, size = 4096	1	Fn Data
Memory	Protect	process_name = C:\Windows\SysWOW64\explorer.exe, address = 0xa6dea0, protection = PAGE_EXECUTE_READWRITE, size = 684	1	Fn
Memory	Write	process_name = C:\Windows\SysWOW64\explorer.exe, address = 0xa6dea0, size = 684	1	Fn Data
Thread	Resume	process_name = c:\users\ciihmnxmn6ps\desktop\clifind.log.exe, os_tid = 0xfe4	1	Fn

Process #2: explorer.exe

349

Information	Value
ID	#2
File Name	c:\windows\syswow64\explorer.exe
Command Line	C:\Windows\SysWOW64\explorer.exe
Initial Working Directory	C:\Users\CIiHmnxMn6Ps\Desktop\
Monitor	Start Time: 00:01:01, Reason: Child Process
Unmonitor	End Time: 00:04:36, Reason: Terminated by Timeout
Monitor Duration	00:03:35

OS Process Information

Information	Value
PID	0xc34
Parent PID	0xf04 (c:\users\ciihmnxmn6ps\desktop\clifind.log.exe)
Is Created or Modified Executable
Integrity Level	High (Elevated)
Username	LHNIWSJ\CIiHmnxMn6Ps
Enabled Privileges	SeChangeNotifyPrivilege, SeImpersonatePrivilege, SeCreateGlobalPrivilege
Thread IDs	0x C60 0x C30 0x 888 0x CB0 0x CFC 0x CF8

Region

Name	Start VA	End VA	Type	Permissions	Actions
private_0x0000000000650000	0x00650000	0x0066ffff	Private Memory	rw	-
pagefile_0x0000000000650000	0x00650000	0x0065ffff	Pagefile Backed Memory	rw	-
private_0x0000000000660000	0x00660000	0x00663fff	Private Memory	rw	-
private_0x0000000000670000	0x00670000	0x00670fff	Private Memory	rw	-
explorer.exe.mui	0x00670000	0x00677fff	Memory Mapped File	r	-
pagefile_0x0000000000680000	0x00680000	0x00693fff	Pagefile Backed Memory	r	-
private_0x00000000006a0000	0x006a0000	0x006dffff	Private Memory	rw	-
private_0x00000000006e0000	0x006e0000	0x0071ffff	Private Memory	rw	-
pagefile_0x0000000000720000	0x00720000	0x00723fff	Pagefile Backed Memory	r	-
pagefile_0x0000000000730000	0x00730000	0x00732fff	Pagefile Backed Memory	r	-
private_0x0000000000740000	0x00740000	0x00741fff	Private Memory	rw	-
private_0x0000000000750000	0x00750000	0x0075ffff	Private Memory	rw	-
locale.nls	0x00760000	0x0081dfff	Memory Mapped File	r	-
private_0x0000000000820000	0x00820000	0x0085ffff	Private Memory	rw	-
private_0x0000000000860000	0x00860000	0x0089ffff	Private Memory	rw	-
private_0x00000000008a0000	0x008a0000	0x008a0fff	Private Memory	rw	-
private_0x00000000008b0000	0x008b0000	0x009affff	Private Memory	rw	-
private_0x00000000009b0000	0x009b0000	0x009b0fff	Private Memory	rw	-
private_0x00000000009c0000	0x009c0000	0x009c3fff	Private Memory	rw	-
explorer.exe	0x009d0000	0x00da6fff	Memory Mapped File	rwx	-
pagefile_0x0000000000db0000	0x00db0000	0x04daffff	Pagefile Backed Memory	-	-
private_0x0000000004db0000	0x04db0000	0x04deffff	Private Memory	rw	-
private_0x0000000004df0000	0x04df0000	0x04e2ffff	Private Memory	rw	-
display.pnf	0x04e30000	0x04e31fff	Memory Mapped File	r	-
pagefile_0x0000000004e30000	0x04e30000	0x04e30fff	Pagefile Backed Memory	rw	-
pagefile_0x0000000004e40000	0x04e40000	0x04e40fff	Pagefile Backed Memory	r	-
pagefile_0x0000000004e40000	0x04e40000	0x04e43fff	Pagefile Backed Memory	r	-
private_0x0000000004e50000	0x04e50000	0x04e60fff	Private Memory	rwx	-
private_0x0000000004e70000	0x04e70000	0x04eb3fff	Private Memory	rw	-
private_0x0000000004ef0000	0x04ef0000	0x04efffff	Private Memory	rw	-
pagefile_0x0000000004f00000	0x04f00000	0x05087fff	Pagefile Backed Memory	r	-
pagefile_0x0000000005090000	0x05090000	0x05210fff	Pagefile Backed Memory	r	-
pagefile_0x0000000005220000	0x05220000	0x0661ffff	Pagefile Backed Memory	r	-
private_0x0000000006620000	0x06620000	0x0665ffff	Private Memory	rw	-
private_0x0000000006660000	0x06660000	0x0669ffff	Private Memory	rw	-
pagefile_0x00000000066a0000	0x066a0000	0x06757fff	Pagefile Backed Memory	r	-
private_0x00000000067a0000	0x067a0000	0x067affff	Private Memory	rw	-
sortdefault.nls	0x067b0000	0x06ae6fff	Memory Mapped File	r	-
wow64cpu.dll	0x64ae0000	0x64ae7fff	Memory Mapped File	rwx	-
wow64win.dll	0x64af0000	0x64b62fff	Memory Mapped File	rwx	-
wow64.dll	0x64b70000	0x64bbefff	Memory Mapped File	rwx	-
wsock32.dll	0x73b20000	0x73b27fff	Memory Mapped File	rwx	-
sppc.dll	0x73b30000	0x73b4cfff	Memory Mapped File	rwx	-
dxgi.dll	0x73b50000	0x73bcdfff	Memory Mapped File	rwx	-
slc.dll	0x73bd0000	0x73bf0fff	Memory Mapped File	rwx	-
dcomp.dll	0x73c00000	0x73c9bfff	Memory Mapped File	rwx	-
d3d11.dll	0x73ca0000	0x73eb2fff	Memory Mapped File	rwx	-
twinapi.dll	0x73ec0000	0x73f58fff	Memory Mapped File	rwx	-
propsys.dll	0x73f60000	0x740a1fff	Memory Mapped File	rwx	-
winsta.dll	0x740b0000	0x740f3fff	Memory Mapped File	rwx	-
userenv.dll	0x74100000	0x74118fff	Memory Mapped File	rwx	-
devobj.dll	0x742a0000	0x742c0fff	Memory Mapped File	rwx	-
version.dll	0x748b0000	0x748b7fff	Memory Mapped File	rwx	-
wininet.dll	0x748c0000	0x74ae3fff	Memory Mapped File	rwx	-
dwmapi.dll	0x74c00000	0x74c1cfff	Memory Mapped File	rwx	-
uxtheme.dll	0x74c20000	0x74c94fff	Memory Mapped File	rwx	-
bcryptprimitives.dll	0x74d40000	0x74d98fff	Memory Mapped File	rwx	-
cryptbase.dll	0x74da0000	0x74da9fff	Memory Mapped File	rwx	-
sspicli.dll	0x74db0000	0x74dcdfff	Memory Mapped File	rwx	-
kernelbase.dll	0x74e70000	0x74fe5fff	Memory Mapped File	rwx	-
cfgmgr32.dll	0x75220000	0x75255fff	Memory Mapped File	rwx	-
kernel32.dll	0x75260000	0x7534ffff	Memory Mapped File	rwx	-
powrprof.dll	0x753b0000	0x753f3fff	Memory Mapped File	rwx	-
imm32.dll	0x75400000	0x7542afff	Memory Mapped File	rwx	-
shell32.dll	0x75430000	0x767eefff	Memory Mapped File	rwx	-
profapi.dll	0x76810000	0x7681efff	Memory Mapped File	rwx	-
ole32.dll	0x768b0000	0x76999fff	Memory Mapped File	rwx	-
ws2_32.dll	0x769b0000	0x76a0bfff	Memory Mapped File	rwx	-
advapi32.dll	0x76a10000	0x76a8afff	Memory Mapped File	rwx	-
setupapi.dll	0x76a90000	0x76c34fff	Memory Mapped File	rwx	-
sechost.dll	0x76c40000	0x76c82fff	Memory Mapped File	rwx	-
oleaut32.dll	0x76c90000	0x76d21fff	Memory Mapped File	rwx	-
msasn1.dll	0x76d30000	0x76d3dfff	Memory Mapped File	rwx	-
wintrust.dll	0x76d40000	0x76d81fff	Memory Mapped File	rwx	-
rpcrt4.dll	0x76d90000	0x76e3bfff	Memory Mapped File	rwx	-
combase.dll	0x76e40000	0x76ff9fff	Memory Mapped File	rwx	-
gdi32.dll	0x77000000	0x7714cfff	Memory Mapped File	rwx	-
user32.dll	0x77150000	0x7728ffff	Memory Mapped File	rwx	-
shlwapi.dll	0x77290000	0x772d3fff	Memory Mapped File	rwx	-
shcore.dll	0x77340000	0x773ccfff	Memory Mapped File	rwx	-
psapi.dll	0x773d0000	0x773d5fff	Memory Mapped File	rwx	-
nsi.dll	0x773e0000	0x773e6fff	Memory Mapped File	rwx	-
windows.storage.dll	0x773f0000	0x778ccfff	Memory Mapped File	rwx	-
msctf.dll	0x778d0000	0x779effff	Memory Mapped File	rwx	-
msvcrt.dll	0x779f0000	0x77aadfff	Memory Mapped File	rwx	-
crypt32.dll	0x77ab0000	0x77c24fff	Memory Mapped File	rwx	-
kernel.appcore.dll	0x77c30000	0x77c3bfff	Memory Mapped File	rwx	-
ntdll.dll	0x77ca0000	0x77e18fff	Memory Mapped File	rwx	-
private_0x000000007f3dd000	0x7f3dd000	0x7f3dffff	Private Memory	rw	-
pagefile_0x000000007f3e0000	0x7f3e0000	0x7f4dffff	Pagefile Backed Memory	r	-
pagefile_0x000000007f4e0000	0x7f4e0000	0x7f502fff	Pagefile Backed Memory	r	-
private_0x000000007f503000	0x7f503000	0x7f503fff	Private Memory	rw	-
private_0x000000007f506000	0x7f506000	0x7f508fff	Private Memory	rw	-
private_0x000000007f509000	0x7f509000	0x7f50bfff	Private Memory	rw	-
private_0x000000007f50c000	0x7f50c000	0x7f50efff	Private Memory	rw	-
private_0x000000007f50f000	0x7f50f000	0x7f50ffff	Private Memory	rw	-
private_0x000000007ffe0000	0x7ffe0000	0x7ffeffff	Private Memory	r	-
private_0x000000007fff0000	0x7fff0000	0x7df8ee37ffff	Private Memory	r	-
pagefile_0x00007df8ee380000	0x7df8ee380000	0x7ff8ee37ffff	Pagefile Backed Memory	-	-
ntdll.dll	0x7ff8ee380000	0x7ff8ee541fff	Memory Mapped File	rwx	-
private_0x00007ff8ee542000	0x7ff8ee542000	0x7ffffffeffff	Private Memory	r	-

Injection Information

Injection Type	Source Process	Source Os Thread ID	Information	Success	Count	Logfile
Modify Memory	#1: c:\users\ciihmnxmn6ps\desktop\clifind.log.exe	0xfe4	address = 0xa6dea0, size = 684		1	Fn Data

Threads

Thread 0xc60

167

Category	Operation	Information	Count	Logfile
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlReAllocateHeap, address_out = 0x77cdbae0	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlAllocateHeap, address_out = 0x77cdda90	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlSizeHeap, address_out = 0x77cf4f40	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlExitUserThread, address_out = 0x77d02570	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlInitializeCriticalSection, address_out = 0x77cf95f0	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlEnterCriticalSection, address_out = 0x77ce5e80	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlLeaveCriticalSection, address_out = 0x77ce5e00	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlDeleteCriticalSection, address_out = 0x77cf9920	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlAddVectoredExceptionHandler, address_out = 0x77cff090	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlRemoveVectoredExceptionHandler, address_out = 0x77cc8870	1	Fn
Module	Load	module_name = ntdll, base_address = 0x77ca0000	1	Fn
Module	Load	module_name = user32, base_address = 0x77150000	1	Fn
Module	Load	module_name = Psapi, base_address = 0x773d0000	1	Fn
Module	Load	module_name = winsta.dll, base_address = 0x740b0000	1	Fn
Module	Load	module_name = gdi32, base_address = 0x77000000	1	Fn
Module	Load	module_name = advapi32, base_address = 0x76a10000	1	Fn
Module	Load	module_name = shlwapi, base_address = 0x77290000	1	Fn
Module	Load	module_name = shell32, base_address = 0x75430000	1	Fn
Module	Load	module_name = ole32, base_address = 0x768b0000	1	Fn
Module	Load	module_name = api-ms-win-core-com-l1-1-0, base_address = 0x76e40000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\combase.dll, function = CoCreateInstance, address_out = 0x76ee8200	1	Fn
Module	Load	module_name = api-ms-win-core-com-l1-1-0, base_address = 0x76e40000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\combase.dll, function = CoUninitialize, address_out = 0x76eadca0	1	Fn
Module	Load	module_name = oleaut32, base_address = 0x76c90000	1	Fn
Module	Load	module_name = version, base_address = 0x748b0000	1	Fn
Module	Load	module_name = crypt32, base_address = 0x77ab0000	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlReAllocateHeap, address_out = 0x77cdbae0	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlAllocateHeap, address_out = 0x77cdda90	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlSizeHeap, address_out = 0x77cf4f40	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlExitUserThread, address_out = 0x77d02570	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlInitializeCriticalSection, address_out = 0x77cf95f0	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlEnterCriticalSection, address_out = 0x77ce5e80	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlLeaveCriticalSection, address_out = 0x77ce5e00	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlDeleteCriticalSection, address_out = 0x77cf9920	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlAddVectoredExceptionHandler, address_out = 0x77cff090	1	Fn
Module	Load	module_name = NTDLL, base_address = 0x77ca0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ntdll.dll, function = RtlRemoveVectoredExceptionHandler, address_out = 0x77cc8870	1	Fn
Module	Load	module_name = ntdll, base_address = 0x77ca0000	1	Fn
Module	Load	module_name = user32, base_address = 0x77150000	1	Fn
Module	Load	module_name = Psapi, base_address = 0x773d0000	1	Fn
Module	Load	module_name = winsta.dll, base_address = 0x740b0000	1	Fn
Module	Load	module_name = gdi32, base_address = 0x77000000	1	Fn
Module	Load	module_name = advapi32, base_address = 0x76a10000	1	Fn
Module	Load	module_name = shlwapi, base_address = 0x77290000	1	Fn
Module	Load	module_name = shell32, base_address = 0x75430000	1	Fn
Module	Load	module_name = ole32, base_address = 0x768b0000	1	Fn
Module	Load	module_name = api-ms-win-core-com-l1-1-0, base_address = 0x76e40000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\combase.dll, function = CoCreateInstance, address_out = 0x76ee8200	1	Fn
Module	Load	module_name = api-ms-win-core-com-l1-1-0, base_address = 0x76e40000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\combase.dll, function = CoUninitialize, address_out = 0x76eadca0	1	Fn
Module	Load	module_name = oleaut32, base_address = 0x76c90000	1	Fn
Module	Load	module_name = version, base_address = 0x748b0000	1	Fn
Module	Load	module_name = crypt32, base_address = 0x77ab0000	1	Fn
Module	Load	module_name = wsock32, base_address = 0x73b20000	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = getpeername, address_out = 0x769c12c0	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = inet_ntoa, address_out = 0x769c4b00	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = ntohs, address_out = 0x769c3650	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = send, address_out = 0x769bce20	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = connect, address_out = 0x769c33a0	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = select, address_out = 0x769c48e0	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = ioctlsocket, address_out = 0x769bd860	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = socket, address_out = 0x769b9780	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = closesocket, address_out = 0x769b9ba0	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = WSAStartup, address_out = 0x769c2420	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = bind, address_out = 0x769be0f0	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = listen, address_out = 0x769c3f40	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = accept, address_out = 0x769c4030	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = __WSAFDIsSet, address_out = 0x769c2f20	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = htons, address_out = 0x769c3650	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = WSACleanup, address_out = 0x769bda00	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = gethostname, address_out = 0x769dc920	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = gethostbyname, address_out = 0x769dc790	1	Fn
Module	Load	module_name = ws2_32, base_address = 0x769b0000	1	Fn
Module	Get Address	module_name = c:\windows\syswow64\ws2_32.dll, function = inet_addr, address_out = 0x769c2e90	1	Fn
Module	Load	module_name = wininet, base_address = 0x748c0000	1	Fn
System	Get Info	type = Operating System	1	Fn
System	Get Info	type = Operating System	1	Fn
Mutex	Create	mutex_name = Global\UzFCA0D558	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = ProductID, data = 48	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = InstallDate, data = 65	1	Fn
Module	Get Filename	process_name = c:\windows\syswow64\explorer.exe, file_name_orig = C:\Windows\SysWOW64\explorer.exe, size = 1025	1	Fn
File	Create	filename = C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe, desired_access = GENERIC_READ, share_mode = FILE_SHARE_READ	1	Fn
File	Get Info	filename = C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe, type = size	1	Fn
File	Read	filename = C:\Users\CIiHmnxMn6Ps\Desktop\clifind.log.exe, size = 276992, size_out = 276992	1	Fn Data
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\137FBF1F\	1	Fn
Module	Load	module_name = setupapi, base_address = 0x76a90000	2	Fn
System	Get Computer Name	result_out = LHNIWSJ	1	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = ProductID, data = 48	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = ProductName, data = 87	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = CurrentVersion, data = 54	1	Fn
Registry	Read Value	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion, value_name = InstallDate, data = 65	1	Fn
System	Get Time	type = System Time, time = 2018-11-14 12:10:46 (UTC)	2	Fn
Registry	Open Key	reg_name = HKEY_LOCAL_MACHINE\SOFTWARE\137FBF1F\	1	Fn
System	Sleep	duration = 1000 milliseconds (1.000 seconds)	210	Fn

Thread 0xcb0

Category	Operation	Information	Success	Count	Logfile
Window	Create	class_name = C16B7627891373F4, wndproc_parameter = 0		1	Fn

Monitored Processes

Behavior Information - Sequential View

Before

After